Website Hijacking – Complete Tutorial Part-1

Feb 17

Posted by shailabh

Hello viewers!
I would make sure that all the viewers are comfortable and enjoying the posts
Okay now lets begin with the topic I have mentioned above.
What is the first thing that comes to your mind when you see a topic like Website Hijacking ?? Do you feel like today after reading this you gonna hijack somebody’s website and bring the hell out of him?
lolz.. Well you can do that unless you are good at heart just to use this material for educational and awareness purpose and the most important thing is to safeguard your own website or your related website that may be your family business or someone close enough needs to be secured.
Alright as some of you may think why am I teaching you this and why is the topic name hijack if I recommend you to secure and not steal. Then let me tell you that the best way to secure yourself is to hack it yourself. You can provide yourself the best security only when you are good enough a thief
Well so here I begin with a motto to teach you guys how to secure yourselves.
Shall I ??
Okay! Here I go…
Every website that you visit or every website that is completely well available in the net obviously has somebody controlling it. I guess you call the guy ADMIN ?
Alright so does the admin sit there at the other end and wait for you to enter login ID and password and then check it out with his collection and allows or denies permission to access ?
Is it the case ?
Obviously “NO” would be the reply, the admin has a control panel as in case of your PC you have a control panel where you have designed and predefined things to manage your system. The same goes here the control panel is the mother of any website where the admin acts as a very good obedient kid. The control gives a database to the admin to store all the ID’s and passwords and when you try logging in you enter the ID and password which is then approved by the website database storing the ID’s and passwords.
Hence we all know that human are more intelligent than machine as we created machine so we can cheat the machine, that is we bypass the database procedure in some cases and in some cases we cheat the machine and upload our shells or deface the website or in some cases the worst is we poke and poke and poke the database using database management system technique and steal all the information from the database and gain access to the website. Have you guys not seen movies where one guy gets the other guy drunk and flatter him and acquire the required info ? That is the same in this case 3 too. We name this cases like the first case is called kidding where you bypass the asp governed sites, the second is XSS (cross site scripting method) and 3rd is the SQLi (my sequel commands injection).
Now how many of you are aware of binary coding ?
Well I am here for the one’s who haven’t yet.
Binary coding is in terms of 0′s and 1′s for every single thing we type as this is only what the system understands actually. even for ON ad OFF its o for OFF and 1 for ON.
in case of TRUE-FALSE o for FALSE and 1 represents TRUE.
so we’ll move direct to the first hijacking method that is KIDDING or call it KIDDO method:
usually the admins are a bit more intelligent as they have been gifted with few extra pounds of brain by their mother, so they use their login page as followed by domain name:
/ADMIN
/admin
/Admin
/Administrator
/administrator
/ADMINISTRATOR.
Now whats the password how do we find that out? In fact who cares and why should we waste our limited pounds brain finding the password for an asp governed website when we can simply bypass the database.
Lets see how…
There are few gates that you must know before you attempt the bypass method:
AND gate and OR gate, as the name suggest AND similar to ADD (so this gate multiplies any two input and returns the output)
where as the OR gate adds the inputs and returns the output value correspondingly.
““““““““““““““““““““““““““““““““““`
Okay now understand these tables:                                                                                    `
                                     
““““““““““““““““““““““““““““““““““`
Now we bypass the password using these tables making the database to read this conditions instead of typing the password and then the machine converts it to binary and then checks it out, we simply give it the binary codes directly and make the machine check the condition and give us access!
Remember this bypass is for asp governed site only so lets take an asp governed site and show it to you:
Go to Google and search for  asp login site and type the username/user ID as types I have mentioned above and in place of password try bypassing it using this method.
0 ‘or’ 0 ‘=’ 0 and hit enter you are either logged in or denied, if denied then try
1 ‘or’ 1 ‘=’ 1 and enter
Enjoy this, you have the entire tables above
Then XSS and SQLi are too big to be posted in this post so it will be posted in my next post following thing… Hope you enjoy by then
http://www.webstatschecker.com/stats/keyword/adminlogin_asp_pk
Here are some dorks that will avail you this kinda vulnerable websites. Copy and paste them in Google search!
"inurl:admin.asp"
"inurl:login/admin.asp"
"inurl:admin/login.asp"
"inurl:adminlogin.asp"
"inurl:adminhome.asp"
"inurl:admin_login.asp"
"inurl:administratorlogin.asp"
"inurl:login/administrator.asp"
"inurl:administrator_login.asp"
cheers!!

The Real Hacker Skills

Feb 13

Posted by Shailabh

Hey buddies, I’m back again! Well, coming to the topic today I am going to discuss about the real hacking skills. If you want to make your career in hacking then you must have these skills and you must read this article because this is gonna really help you out very much.
As you all know who a hacker is, yes a computer geek! So what a computer geek must know is everything about a computer. What I mean by everything is,  in and out of a computer, that is every single bit of a system. You must have the complete software knowledge and a little of hardware is enough. You must understand how the hardware stuff works, the hardisk, the RAM and the most important the mother board!
So now coming to software, you need to have a very good programming skills… Because you can break it only when you can make it! You need to know all the scripting languages, most of them.
Below are few programming and scripting languages which a hacker must have a sound knowledge on!
1. C++ programming
2. JavaScript
3. Python programming
4. MySQL
5. PHP
6. Perl and Pascal
7. Assembly language
8. Basics of HTML, CSS, ASP  and Java
Now suppose, you know all of the stuff which I have mentioned above, you thing you are a hacker now…? No, not at all you just are a programmer not a hacker yet. What I mean is you just learn to make it not to break yet!
So what’s your next step? Its to go ahead and experiment on these stuff, remember to be creative everytime you start experimenting!

How Hacker Hack Email IDs

Posted by Shailabh

Hello guys, today I am going to write about how hackers hack email IDs and spoof into them for personal information of the victim. I will mention all the methods used by hackers which will help you understand the basic idea about it. You might have a doubt about what advantage a hacker can gain  hacking an email id and spoofing in that. A hacker will be able to steal money, hack into a web server, access victim’s bank account etc just by hacking an email id! Surprised? Yes that’s true a hacker can gain access into all of them. If you still don’t believe this then read this…
While practicing with my skills once I hosted a fake page on a public computer which was linked to my email! I constructed the page in such a way that once a victim enters his username, password and hits “log in” he will be redirected to his inbox but his username and password will be sent to my email id. I got a victim in my trap and I entered into his email account then I saw that he was an internet banker and hence his bank account was linked to his email. I simply sent a mail to the bank contact person and i received his personal data related to the bank. This way I was able to access his bank account and also was able to shop online by using his bank info but he was my Maternal uncle so i didn't lead to any problem.

NOTE:- THIS MAY LEAD TO PRISON IF U GOT CAUGHT

So here are the methods used by hackers to hack an email id.
Method 1: Fake mail
This is the basic method employed by laymen to hack an email id. Hackers do not use this method unless the victim is a fool. You just have to send a mail containing false info and ask them to mention their username and password in the reply to get the access into that service which you mentioned in your mail!
This trick is not so efficient therefore hackers don’t prefer this method. You don’t have to be a hacker to perform this type of attack because this is just like a child’s play. This trick works only if you are able to fool the victim properly.
Method 2: Keylogging
This is the best method to hack an email id. You just need a keylogger which will send you every keystroke of the victim. You will have to pass a link containing the keylogger and it automatically gets installed in the victim’s computer. You have to find the best keylogger for employ this type of trick.There are keyloggers which work remotely and available online.
A professional hacker is capable of writing his own keylogger but if you are not one of them then you have to buy a keylogger online. If you have physical access to victims computer then you can upload a keylogger yourself and then later check out the keystrokes.
Method 3: Cookie Stealing
Cookie is a piece of text stored on victim’s computer by websites visited by the user. This stored cookie is used by web server to identify and authenticate the user. So, if you steal this cookie (which is stored in victim browser) and inject this stolen cookie in your browser, you can imitate victim identity to web server and enter his email account easily.
A hacker steals a session of the victim and logs into his email without giving the victim an idea about the stolen cookie. This is called Session Hijacking/ Cookie stealing
Method 4: Phishing
This is the trick I used in hacking the victim’s id which i mentioned above in the example! This is very simple trick, you just have to create a web page of the login form which exactly looks like the email service. Then you have to host it on a public server and send it to victim. When a victim uses that page to login his email and password will be sent to you via email!
To hack an email using phishing you must have a basic knowledge on HTML or there are many online tools which will automatically create a fake page. If you want to be a pro hacker then you must learn HTML and create a page.
Method 5: Remote Administration Tools
This is similar to keylogging! Remote Administration Tools (RAT) is the remote keylogging. Here you do not have physical access to the victim’s computer, but you still install it without alerting the victim about it.A keylogger software will operate in a complete stealth mode and thus remains undetected.
Method 6: Malware/ JavaScript
A hacker writes a simple code which is referred as malware or JavaScript. Once the code is executed on the victim’s computer his credential data is sent to the hacker through the internal ports. A hacker saves the code on a web page which is later sent to the victim, when the victims opens the web page the code automatically executes and his system get vulnerable to the attacks.

I am still learning method 6 ,will upload more info as i get into it :)
So these are the common methods used by a hacker to hack into an email id. In my later articles I will describe each method with an example, so stay updated.

Introduction to BackTrack

Posted by Shailabh

Add caption

Hello guys, in this post I will talk about backtracking. This will be just an introductory post for now. So read on…!
BackTrack is an all-in-one tool which is the heart of hackers (Both for Newbies and Professionals). If I had to talk about BackTrack and hacking then I would tell it off in just a single sentence that is ” BackTrack takes out the word impossible from a hackers dictionary!” BackTrack contains all the tools which are required for a hacker. Once you master the backtracking stuff then no one can beat you.
As this an Operating System (OS) I can’t give you a theoretical tutorial but will be giving a visual so I have embedded a video which will be helpful for you to understand how to handle and use BackTrack. This video I have found on YouTube and I am sharing with you guys!
Have a look…




The advance stuff will be posted in my upcoming articles so stay updated by following us…!