Showing posts with label Website Hacking. Show all posts
Showing posts with label Website Hacking. Show all posts
Saturday, November 12, 2011
Its Real,On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, eBay (EBAY), Amazon.com (AMZN), and CNN (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off.
What is a Denial Of Service Attack?
- A denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.
- If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack.
Saturday, November 12, 2011 4
Saturday, August 20, 2011
When you receive an email, you receive more than just the message. The email comes with headers that carry important information that can tell where the email was sent from and possibly who sent it. For that, you would need to find the IP address of the sender. The tutorial below can help you find the IP address of the sender. Note that this will not work if the sender uses anonymous proxy servers.First of all, the IP address is generally found in the headers enclosed beween square brackets, for instance, [129.130.1.1]
Finding IP address in Gmail
1. Log into your Gmail account with your username and password.
2. Open the mail.
3. To display the email headers,
- Click on the inverted triangle beside Reply. Select Show Orginal.
Saturday, August 20, 2011 2
Bad news for just about every WordPress blogger out there. Thousands of WordPress 3.2.1 installations are at risk of being compromised. It has been found that the latest version 3.2.1 of WordPress, an extremely popular suite of tools for powering blogs, is vulnerable to XSS injection attack which allows users to inject malicious JavaScript as a result of failure in sanitizing the comments field. Without discussing much about what this vulnerability could do to your blog I will jump to how it works and the solution.
How does it work?
Inject one of the below codes into the comment field of the target. Or use your brain to make a more powerful injection
Popup “alert” Box
<script>alert(‘www.cybertricks.co.cc’)</script>
Cookies stores all the necessary Information about one’s account , using this information you can hack anybody’s account and change his password. If you get the Cookies of the Victim you can Hack any account the Victim is Logged into i.e. you can hack Google, Yahoo, Orkut, Facebook, Flickr etc.
What is a CookieLogger?
A CookieLogger is a Script that is Used to Steal anybody’s Cookies and stores it into a Log File from where you can read the Cookies of the Victim.
Today I am going to show How to make your own Cookie Logger…Hope you will enjoy Reading it …
Step 1: Save the notepad file from the link below and Rename it as Fun.gif:
Step 2: Copy the Following Script into a Notepad File and Save the file as cookielogger.php:
Monday, May 16, 2011
Robert Hansen, a guru in the field of security, has released a new tool for DoS-attacks, exposing serious Web server’s vulnerabilities including Apache and other servers.
Hansen called his tool Slowloris
, the most interesting in this utility that it can cause a DoS attack without using a huge amount of traffic as we usually find in other DoS tools.
, the most interesting in this utility that it can cause a DoS attack without using a huge amount of traffic as we usually find in other DoS tools.According to Hansen typically 1000 machine are required to crash down a web server by bombarding the site with traffic but for Slowloris is not the case because it takes up all the available connection for the server by sending unlimited http requests without closing those connections and this makes Apache waiting for the response too long. Apache web servers do have a limit for number of threads which can be used to deplete the memory and cause defacement.
Monday, May 16, 2011 0
Monday, May 9, 2011
I hope you have already heard about Cross Site Scripting known as XSS. Just go through this first en.wikipedia.org/wiki/Cross-site_scripting . I have focussed on finding an XSS hole and bypssing a filter.
XSS is a web application vulnerability that occurs due to improper or no filteration of user's input . It enables the malicious attackers to inject client-side script into web pages. This is not something with which you are gonna deface a website or break in admin panel. This bug can be dangerous for users if found on any online forms . Basically you can do mainly two things that are stealing user sessions and injecting iframes. Actually this bug is basically exploited to harm the visitors rather than administrators.Okay Lets learn the approach to find XSS bugs.
You might have tried finding an XSS hole by inserting a script like this <script>alert('XSS')</script> in Search fields and hoping for a box to popup saying XSS. But its not always the way to find a XSS bug.
This example will make you everything clear.
Okay, go to this URL
http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=Overview
Lets Replace 'Overview' with any keyword . Say 'test' and hit enter
http://www.chitkara.edu.in/chitkara/esl.php?page=overview.php&sitetitle=test
Monday, May 9, 2011 0
Saturday, April 30, 2011
Now signup for a account on any free web hosting site . Say 110mb.com. Now sign into your account,go to Filemanager, upload some files and then upload c99 shell here. Now just log out and visit the URL of shell you uploaded.
http://username.110mb.com/shell.php
and you would find that you can manage all your directories and files without logging in your account,that is without entering your password anywhere.
Both images are showing the filemanager, In Ist I am accesing by signing into my account and 2nd just by accessing shell without logging into.
Saturday, April 30, 2011 2
Wednesday, April 27, 2011
What is SQL injection ?
SQL stands for Structured Query Language.SQL is used to design the databses. The information is stored in databses. SQL injection is the vulnerability occuring in database layer of application which allow attacker to see the contents stored in database. This vulnerabilty occures when the user's input is not filtered or improperly filtered.
The main goal of attacker is use to access the information stored in website's database. It can be done manually, read more here. In this tutorial, I am using to do the same thing easily using a tool.
I remind you again that its only for educational purposes.
SQL stands for Structured Query Language.SQL is used to design the databses. The information is stored in databses. SQL injection is the vulnerability occuring in database layer of application which allow attacker to see the contents stored in database. This vulnerabilty occures when the user's input is not filtered or improperly filtered.The main goal of attacker is use to access the information stored in website's database. It can be done manually, read more here. In this tutorial, I am using to do the same thing easily using a tool.
I remind you again that its only for educational purposes.
Wednesday, April 27, 2011 0
Saturday, April 23, 2011
Domain hijacking is a process by which Internet Domain Names are stolen from it’s legitimate owners. Domain hijacking is also known as domain theft. Before we can proceed to know how to hijack domain names, it is necessary to understand how the domain names operate and how they get associated with a particular web server (website).
Saturday, April 23, 2011 2
Subscribe to:
Posts (Atom)
