Hack a Website in 3 simple steps.

               WEBSITE HACKING IN 3 SIMPLE STEPS

                               

STEP 1: search for an google hacking dork. A dork is passage through which an attacker can gain access to a website.There are many many google hacking dorks I will just take one.For more dorks just search"google hacking dorks". This will help you get many websites.

 DORK example:

inurl:adminlogin.aspx

            inurl:admin/index.php
            inurl:administrator.php
            inurl:administrator.asp
            inurl:login.asp
            inurl:login.aspx
            inurl:login.php
            inurl:admin/index.php
            inurl:adminlogin.aspx

I will be using this one:-Inurl:adminlogin "city"

STEP 2: Click on any site which is listed. An admin login page will appear on the screen.

NOTE: if the site has protection then this method will not work.

for eg:

STEP 3: After we get the login page the only process left is the authentication process. A user name and a password is to be filled which only the admin knows. So for this we will use SQL injection.

Just fill Username : admin

passowrd: 'or''='

(This is the basic combination)

NOTE: there are many combinations of SQL, if this combonation doesnt work try another one there are many.

After filling the username and password you now gain access to the website.

(this is the dashboard of the website)

This is an educational tutorial. I donnot take responsibility for any damage caused.I hope this tutorial will help you in many ways. Always be an Ethical Hacker.

HAPPY HACKING

SQL Vulnerable Sites Updated

                                         SQL Vulnerable Sites [Latest Update]

 =x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x= =x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x= 

http://www.genhound.co.uk/source.php?id=477

http://www.lcoastpress.com/journal.php?id=8

http://www.travellers-tales.co.uk/travelJournal.php?id=42

http://www.arrowvalves.co.uk/content.php?id=8

http://www.reaplasrack.co.uk/content.php?id=129

http://www.arrowvalves.co.uk/content.php?id=28

http://www.woodlandsschool.org/content.php?id=1&text=

http://www.qwc.org.uk/projects.php?ID=1

http://www.vx10.co.uk/blog.php?Id=5

http://www.readingmatters.co.uk/author.php?id=12

http://www.readingmatters.co.uk/author.php?id=56

http://www.topgear-cars.co.uk/popup2.php?id=394

http://www.regendafirst.org.uk/howto.php?id=1

http://www.cyberthing.net/video-play.php?id=105

http://www.thehopeforamerica.com/play.php?id=3392

http://www.woodfines.co.uk/press_release.php?id=7

http://www.areyoureadytoorder.co.uk/interview.php?id=10

http://planet.selfcateringhols.com/country.php?id=504

http://www.wellthatsucked.co.uk/viewflash.php?id=2

http://championship.netii.net/smt/dskill.php?id=117

http://www.robertsmith.co.uk/links.php?id=6

http://www.zwcad.org/download_form.php?id=107

http://www.yhmag.co.uk/comp_form.php?id=78

http://www.athenapress.com/book.php?ID=2693

http://www.lcoastpress.com/book.php?id=187

http://abslatin.co.uk/node.php?id=16

http://www.umtv.co.uk/release.php?id=524

http://www.emiclassics.co.uk/release.php?id=13828

http://emiclassics.co.uk/release.php?id=5099962946223

http://www.onradio.gr/play_old.php?id=388

http://www.onradio.gr/play_old.php?id=245

http://www.leadacidbatteryinfo.org/newsdetail.php?id=10

https://powertraveller.com/news/detail.php?id=000126

http://www.firstsquare.com/product_item.php?id=35

http://www.standardbred.org/pages.php?id=16

http://www.nanogenad.net/prod_detail.php?id=1&action=cat&check_prod=51

http://www.tek-tite.com/src/product_info.php?id=2162

http://www.thefutureisfierce.com/releases.php?ID=25

http://inrecs.com/releases.php?id=47

http://www.metronome-technologie.com/admin/produit.php?id_titre=184

http://www.thedockyard.co.uk/photo_gallery_pop.php?id=23

http://www.thedockyard.co.uk/photo_gallery_pop.php?id=314

http://www.arrowvalves.co.uk/productdetail.php?id=1

http://www.arrowvalves.co.uk/productdetail.php?id=10

http://www.adas-fusion.eu/theme.php?id=3

http://blackhistorycanada.ca/theme.php?id=2

http://www.twitney.co.uk/theme.php?id=7

http://rainydaymv.com/toys/games-toys-all-ages.php?id=21

http://www.minesandcommunities.org/look.php?id=87

http://www.minesandcommunities.org/look.php?id=117

http://www.coastal-koi.com/view_product.php?id=1393

http://www.istl.com/view-product.php?ID=56

http://www.musicintheround.co.uk/event.php?id=236

http://www.theatreroyalwindsor.co.uk/event.php?id=273

http://biblioteca-ua.com/select_biblio.php?id=1599

http://biblioteca-ua.com/select_biblio.php?id=712

http://www.dwib.org/faq2.php?id=8

http://www.wardrobesystems.co.uk/preview.php?id=365

http://www.crewsaver.co.uk/download.php?id=1240

http://www.newmasterplanning.com/project_main.php?id=16

http://aggiehill.com/aggie-hill-private-showing.php?id=7

http://www.emaxxtech.com/view_faq.php?id=34

http://www.neilprydemaui.com/category.php?id=6

http://www.cornerstone.org.uk/publications.php?id=newsletters

http://mx5.brighton-rock.net/BandInfo.php?ID=315

http://mx5.brighton-rock.net/BandInfo.php?ID=448

http://www.brighton-rock.net/BandInfo.php?ID=136

http://www.brighton-rock.net/BandInfo.php?ID=495

http://nightlife.e-rockford.com/localbands/bandinfo.php?id=314

http://nightlife.e-rockford.com/localbands/bandinfo.php?id=217

http://www.oiwsba.com/oiwsba/memberinfo.php?id=54

http://www.bayareaassn.com/memberinfo.php?id=1

http://www.bayareaassn.com/memberinfo.php?id=7

http://www.oiwsba.com/oiwsba/memberinfo.php?id='59

http://www.atitelemetry.com/viewapp.php?id=7

http://www.medix.com.hr/aboutbook.php?id=39

http://familynewsabout.com/aboutBook.php?id=59

http://familynewsabout.com/aboutBook.php?id=92133

http://www.thehousedirectory.com/view.php?subcat=106

http://bbqjointz.com/show.php?xplacesid=997

http://www.northport.com.my/info_general.php?menu=General%20Info

http://www.geruest-bau.at/general.php?menu_id=23

http://www.roesslhuber.com/general.php?menu_id=1

http://www.nahipa.org/Chapter_info.php?Chapter=2

http://www.webdictionary.co.uk/index.php?query=gorgeous

http://www.webdictionary.co.uk/index.php?query=precipitation

http://www.fip.nl/www/?page=pe_wlops_ns_poland

http://www.stjudes-southsea.org.uk/home.php?category_ID=25

http://www.stjudes-southsea.org.uk/home.php?category_ID=4

http://www.omakitchens.com/uk/home.php?category=classic

http://tutors4you.com/home.php?category2_id=34

Hacking website with Havij

Introduction:

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and  password hashes, dump tables and columns, fetching data from the database, running SQL  statements and even accessing the underlying file system and executing commands on the  operating system.

Preparation :

• Download Free edition from Havij (In the same page, you can see the difference between free and professional edition). It is matter of what your target is.
• Now you google with below options to find websites  vulnerable for targetting SQL Injection with Havij

                 inurl:index.php?id=
                 inurl:article.php?id=

Once you choose a website, type ‘ at the end like shown below and press enter. If you get an error, then the website is vulnerable to SQL Injection.

http://www.hackinvasion/site/content.php?vn=3&id=77′

1. Retrieve DB Information:

Copy and paste the target url in ‘Target’ column and click ‘Analyze’

                          

Once Havij is successful in retrieving DB name, it will stop and you can see the database details either at the log window or ‘Info’ option. Havij will retrieve Web Server Type (Apache, IIS or other), DB Type (My SQL, MS SQL or other) and DB Name

Once this is successful, you can make sure that you are in right path i.e; your target is vulnerable to SQL Injection Attack

2. Retrieve Tables:

Now you need to retrieve all table that contains user name and password to login to the website. Choose the db and Click ‘Get Tables’ option.

                                

Here you go, now all the tables are retrieved from DB. You can either wait till it retrieves all the tables or you can just stop the top when you see any suspected table like one below. I stopped the processing when Havij found a table that I suspected to be containing user names and passwords for the website.
                                   

3. Retrieve Table Columns:

Before you start retrieving data of a specific table, you need to get the columns. So mark the suspected password table and click ‘Get Columns’ 

I am really sorry for marking all website specific details with red mark, I must do that to safeguard.

 

4. Retrieve User name and Password:

You are at final stage of hacking . Mark the database, table and columns to be retrieved and you have option of retrieving only one row. Choose ‘Get Data’  to let Havij give you member access to the site.

I am done now, luckily my target website didn’t store passwords encrypted and I have their website’s admin password. That’s it!

 If the password is encrypted, Havij has inbuilt MD5 option where you can specify the MD5 hash to be cracked.  Havij will look for hash in several sites in mul thread mode and displays the result.

Thanks to :www.hackandsecure.com