Common Methods to Hack a Website

Gone are the days when website hacking was a sophisticated art. Today any body can access through the Internet and start hacking your website. All that is needed is doing a search on google with keywords like “how to hack website”, “hack into a website”, “Hacking a website” etc. The following article is not an effort to teach you website hacking, but it has more to do with raising awareness on some common website hacking methods.


The Simple SQL Injection Hack

SQL Injection involves entering SQL code into web forms, eg. login fields, or into the browser address field, to access and manipulate the database behind the site, system or application. 
When you enter text in the Username and Password fields of a login screen, the data you input is typically inserted into an SQL command. This command checks the data you've entered against the relevant table in the database. If your input matches table/row data, you're granted access (in the case of a login screen). If not, you're knocked back out.


In its simplest form, this is how the SQL Injection works. It's impossible to explain this without reverting to code for just a moment. Don't worry, it will all be over soon.
Suppose we enter the following string in a User name field:

' OR 1=1  

The authorization SQL query that is run by the server, the command which must be satisfied to allow access, will be something along the lines of:
SELECT * FROM users WHERE username = ‘USRTEXT ' 
AND password = ‘PASSTEXT’
…where USRTEXT and PASSTEXT are what the user enters in the login fields of the web form.
So entering `OR 1=1 — as your username, could result in the following actually being run:
SELECT * FROM users WHERE username = ‘' OR 1=1 — 'AND password = '’
Two things you need to know about this:
['] closes the [user-name] text field.
'' is the SQL convention for Commenting code, and everything after Comment is ignored. So the actual routine now becomes:
SELECT * FROM users WHERE user name = '' OR 1=1
1 is always equal to 1, last time I checked. So the authorization routine is now validated, and we are ushered in the front door to wreck havoc. 
Let's hope you got the gist of that, and move briskly on.

Brilliant! I'm gonna go to hack a Bank! 

Slow down, cowboy. This half-cooked method won't beat the systems they have in place up at Citibank,
evidentlyBut the process does serve to illustrate just what SQL Injection is all about — injecting code to manipulate a routine via a form, or indeed via the URL. In terms of login bypass via Injection, the hoary old ' OR 1=1 is just one option. If a hacker thinks a site is vulnerable, there are cheat-sheets all over the web for login strings which can gain access to weak systems. Here are a couple more common strings which are used to dupe SQL validation routines:
username field examples:

• admin'—
• ') or ('a'='a
• ”) or (“a”=”a
• hi” or “a”=”a

… and so on.

Cross site scripting ( XSS ):

Cross-site scripting or XSS is a threat to a website's security. It is the most common and popular hacking a website to gain access information from a user on a website. There are hackers with malicious objectives that utilize this to attack certain websites on the Internet. But mostly good hackers do this to find security holes for websites and help them find solutions. Cross-site scripting is a security loophole on a website that is hard to detect and stop, making the site vulnerable to attacks from malicious hackers. This security threat leaves the site and its users open to identity theft, financial theft and data theft. It would be advantageous for website owners to understand how cross-site scripting works and how it can affect them and their users so they could place the necessary security systems to block cross-site scripting on their website.

Denial of service ( Ddos attack )

A denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.this is not actually hacking a webite but it is used to take down a website.

If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack,this one of the most used method for website hacking

Cookie Poisoning:

Well, for a starters i can begin with saying that Cookie Poisoning is alot like SQL Injection

Both have 'OR'1'='1 or maybe '1'='1'

But in cookie poisoning you begin with alerting your cookies

Javascript:alert(document.cookie)

Then you will perharps see "username=JohnDoe" and "password=iloveJaneDoe"

in this case the cookie poisoning could be:

Javascript:void(document.cookie="username='OR'1'='1"); void(document.cookie="password='OR'1'='1");

It is also many versions of this kind... like for example

'

'1'='1'

'OR'1'='1

'OR'1'='1'OR'

and so on...

You may have to try 13 things before you get it completely right...

Password Cracking

Hashed strings can often be deciphered through 'brute forcing'. Bad news, eh? Yes, and particularly if your encrypted passwords/usernames are floating around in an unprotected file somewhere, and some Google hacker comes across it. 
You might think that just because your password now looks something like XWE42GH64223JHTF6533H in one of those files, it means that it can't be cracked? Wrong. Tools are freely available which will decipher a certain proportion of hashed and similarly encoded passwords.

Know more about Brute force attack

A Few Defensive Measures

* If you utilize a web content management system, subscribe to the development blog. Update to new versions soon as possible.
* Update all 3rd party modules as a matter of course — any modules incorporating web forms or enabling member file uploads are a potential threat. Module vulnerabilities can offer access to your full database.
* Harden your Web CMS or publishing platform. For example, if you use WordPress, use this guide as a reference.
* If you have an admin login page for your custom built CMS, why not call it 'Flowers.php' or something, instead of “AdminLogin.php” etc.?
* Enter some confusing data into your login fields like the sample Injection strings shown above, and any else which you think might confuse the server. If you get an unusual error message disclosing server-generated code then this may betray vulnerability.
* Do a few Google hacks on your name and your website. Just in case…
* When in doubt, pull the yellow cable out! It won't do you any good, but hey, it rhymes. 

hope u like this article...

Read More

How To Prevent cut, paste, copy, delete, re-naming of files & folders.

We are pleased to release Prevent v 1.0, a freeware app which runs on all Windows. If you don’t want anyone deleting or renaming or messing around with your data, maybe your younger sibling, then Prevent may be able to help you.

The downloaded zip file consists of:
1. Prevent.exe
2. Pre_1
3. Pre_2
4. Read Me file.
5. Uninstall

Run the Prevent installer setup. The installer only places the Prevent folder in the system Program Files folder. A desktop shortcut will also be created. To run the program, click on Prevent. Set your Hot key to stop Prevent. You may set it asCtrl+P if you wish. Hotkeys Win+F8 kills Pre_1 and Win+F9 kills Pre_2, too. But the single hotkey set by you will kill all Prevent processes at the same time.

Prevent :1. Stops Cut
2. Stops Paste
3. Stops Copy
4. Stops Delete
5. Stops Copy To
6. Stops Move to
7. Stops Send To
8. Prevents renaming
9. Disables Task Manager’s End Process button. Alsoit doesn’t allow you to right click on process name and click on end process. It also grays out the context menu items, disable Ctrl+C, Ctrl+X and Ctrl+V and/or stops the process.

To uninstall or remove Prevent, use the Uninstaller situated in the Prevent folder, or uninstall it via the Control Panel or simply delete its Program folder.

Read More

MIT University website defaced by Anonymous hackers in honor of Aaron Swartz

Today is January 11, 2014 and the last year on the same day a 26-year-old, young hacker, Reddit cofounder and the digital Activist, Aaron H. Swartz committed suicide. He found dead in his Brooklyn, New York apartment, where he had hanged himself.

Swartz was indicted by a federal grand jury in July 2011, accused of hacking the MIT JSTOR database and stealing over four million documents with the intent to distribute them.

He could have prison for 50 years and $4 million in fines by the Court, but before that he committed suicide in fear. Swartz's father, Robert, later blamed the MIT and the judiciary system for his son's death.

On the first Anniversary of Aaron Swartz, today the Anonymous group of hackers defaced the sub-domain of the Massachusetts Institute of Technology (MIT) website (http://cogen.mit.edu/) for about an hour as part of #OPLASTRESORT.

Defacement page was titled 'THE DAY WE FIGHT BACK'. The message posted on it, “Remember The Day We Fight Back, Remember. We Never Forget, We Never Surrender, Expect Us.”

At the time of writing, the domain was down. The attack on the website of MIT is a part of the tragic suicide of hacker Aaron Swartz to give him tribute.

It was the MIT's role in the federal prosecution against an activist, which ultimately led to him committing suicide, but the U.S Government has not learned anything and they are planning to make laws stricter against hackers. Recently, The Senate Judiciary Committee Chairman 'Patrick Leahy' reintroduced a revamped version of the "Personal Data Privacy and Security Act" for tough criminal penalties for hackers. The new bill suggests 20 years in prison, rather than 10 years (currently) and also recommending to give same penalties for the hackers who even attempt to hack the systems, but doesn't succeed.

Read More

Top 10 Threat Predictions for 2014

During the past few years, security threats and actual breaches have grown exponentially. Malware has gone mainstream, social engineering has become far more sophisticated, high-profile database hacks have become disturbingly common, and distributed denial-of-service (DDoS) attacks have rocked businesses across a wide range of industries. These attacks have rendered countinue ...

Android Malware Will Expand

As the Android OS takes root in game consoles, wearable devices, home automation equipment and industrial control systems, malware will appear on these devices.

Use of Encryption Will Increase

Fears that critical data and intellectual property could be compromised or stolen through malware or government eavesdropping will lead to an uptick in the use of encryption.

Shutting Down Botnet Operators

Law enforcement will broaden its scope and focus on a broader set of global cyber-targets, including botnet operators and individuals selling cyber-crime services.

Battling for the Deep Web

Improved versions of anonymous services and file-sharing  applications will grow, and it will become more difficult to infiltrate and take down these systems.

Targetig Off-Net Devices

Cyber-crooks will target infrastructure over desktops. The first generic exploitation frameworks and mass malware agents for home devices will appear.

Becoming More Transparent

On the heels of an FTC crackdown in 2013, network security vendors will face increased scrutiny and accountability.

Botnets Will Migrate

Cyber crooks will transition from a traditional client-server botnet approach to a P2P strategy that makes it more difficult to dismantle and disrupt their activities.

Botnets Will Cross-Breed

Increasingly sophisticated botnets will seek out other botnets and cross-infect with them to more effectively increase their base of machines.

More Attacks on Windows XP

When Microsoft stops supporting Windows XP on April 8, newly discovered vulnerabilities will not be patched, and systems will become vulnerable.

Biometrics Will Increase

The use of two-factor authentication and biometric methods—including tattoos, iris scanning and facial recognition—will grow.

Click here to view original web page at :- www.baselinemag.com

Read More

Snapchat Got Hacked 4.6million Users Phone Numbers Leaked Online

Snapchat Got Hacked 4.6million Users Phone numbers Leaked Online. First biggest hack starting with this New Year 2014. ZDnet has reported earlier that, "The Australian hackers announced its publication of Snapchat's API and the two exploits on the GibSec Twitter account on Christmas Eve ".
After this report hackers  use this trick and create a Video to access Snapchat hacks.

video

 Snapchat is a photo messaging application developed by Evan Spiegel and Robert Murphy, then Stanford University students. Using the app, users can take photos, record videos, add text and drawings, and send them to a controlled list of recipients. These sent photographs and videos are known as "Snaps".

When cyber security researcher submits website exploit report to companies, they didn't take it seriously. If Snapchat took action on these exploits before, then this was not happened.

As before True caller database was also hacked in July 2013. we hope other social network website will learn from these hacks and will more secure their servers.

Now SnapchatDB.info has been suspended after this leaked.

Read More

Google Need So Many Robots ? To Jump From The Web To The Real World

Posted 2 hours ago by John Biggs (@johnbiggs) techcrunch

Why does Google need robots Because it already rules your pocket. The mobile market, except for the slow rise of wearables, is saturated. There are millions of handsets around the world, each one connected to the Internet and most are running either Android or iOS. Except for incremental updates to the form, there will be few innovations coming out of the mobile space in the next decade.

Then there’s Glass. These devices bring the web to the real world by making us the carriers. Google is already in front of us on our small screens but Glass makes us a captive audience. By depending on Google’s data for our daily interactions, mapping, and restaurant recommendations – not to mention the digitization of our every move – we become some of the best Google consumers in history. But that’s still not enough.

Google is limited by, for lack of a better word, meat. We are poor explorers and poor data gatherers. We tend to follow the same paths every day and, like ants, we rarely stray far from the nest. Google is a data company and needs far more data than humans alone can gather. Robots, then will be the driver for a number of impressive feats in the next few decades including space exploration, improved mapping techniques, and massive changes in the manufacturing workspace.

Robots like Baxter will replace millions of expensive humans – a move that I suspect will instigate a problematic rise of unemployment in the manufacturing sector – and companies like manufacturing giant Foxconn are investing in robotics at a clip. Drones, whether human-control or autonomous, are a true extension of our senses, placing us and keeping us apprised of situations far from home base. Home helpers will soon lift us out of bed when we’re sick, help us clean, and assist us near the end of our lives. Smaller hardware projects will help us lose weight and patrol our streets. The tech company not invested in robotics today will find itself far behind the curve in the coming decade.

That’s why Google needs robots. They will place the company at the forefront of man-machine interaction in the same way that Android put them in front of millions of eyeballs. Many pundits saw no reason for Google to start a mobile arm back when Android was still young. They were wrong. The same will be the case for these seemingly wonky experiments in robotics.

Did Google buy Boston Dynamics and seven other robotics companies so it could run a thousand quadrupedal Big Dogs through our cities? No, but I could see them using BD’s PETMAN, a bipedal robot that can walk and run over rough terrain – to assist in mapping difficult-to-reach areas. It could also become a sort of Google Now for the real world, appearing at our elbows in the form of an assistant that follows us throughout the day, keeping us on track, helping with tasks, and becoming our avatars when we can’t be in two places at once. The more Google can mediate our day-to-day experience the more valuable it becomes.

Need more proof? Follow the money. Robotics is big business and analysts estimate that Boston Dynamics could be a $5 billion company in the next few years. With the right contracts and the right product mix, almost any of member Google’s current robot horde can hit nearly any market, from consumer robotics on a large scale to massive installations in manufacturing – not to mention those lucrative DARPA contracts.

Read More

[THC-Hydra v7.5] Fast network logon cracker

CHANGELOG for 7.5

        * Moved the license from GPLv3 to AGPLv3 (see LICENSE file)
        * Added module for Asterisk Call Manager
        * Added support for Android where some functions are not available
        * hydra main:
           - reduced the screen output if run without -h, full screen with -h
           - fix for ipv6 and port parsing with service://[ipv6address]:port/OPTIONS
           - fixed -o output (thanks to www417)
           - warning if HYDRA_PROXY is defined but the module does not use it
           - fixed an issue with large input files and long entries

        * hydra library:
           - SSL connections are now fixed to SSLv3 as some SSL servers fail otherwise, report if this gives you problems
           - removed support for old OPENSSL libraries
        * HTTP Form module:
           - login and password values are now encoded if special characters are present
           - ^USER^ and ^PASS^ are now also supported in H= header values
           - if you the colon as a value in your option string, you can now escape it with \: - but do not encode a \ with \\
        * Mysql module: protocol 10 is now supported
        * SMTP, POP3, IMAP modules: Disabled the TLS in default. TLS must now be defined as an option "TLS" if required. This increases performance.
        * Cisco module: fixed a small bug (thanks to Vitaly McLain)
        * Postgres module: libraries on Cygwin are buggy at the moment, module is therefore disabled on Cygwin

 You can also take a look at the full CHANGES file

Download THC-Hydra v7.5


1. The source code of state-of-the-art Hydra: hydra-7.5.tar.gz
    (compiles on all UNIX based platforms - even MacOS X, Cygwin on Windows, ARM-Linux, Android, etc.)

 2. The source code of the stable tree of Hydra ONLY in case v7 gives you problems on unusual and old platforms: hydra-5.9.1-src.tar.gz

 3. The Win32/Cywin binary release: --- not anymore ---
    Install cygwin from http://www.cygwin.com  and compile it yourself. If you do not have cygwin installed - how do you think you will do proper securiy testing? duh ...

Read More

FBI Can Spy Through Your Webcam - And Much More

The FBI has developed advanced surveillance techniques that give it the power to covertly activate Web cams to spy on unsuspecting computer owners.

Tech savvy G-men can remotely turn on cameras that transmit real-time images to investigators — without triggering the light that shows the camera is in use, according to The Washington Post.

The FBI can also burrow into a suspect’s computer and download files, photographs and stored e-mails.

The new snooping capabilities came to light during an investigation of a mysterious man named “Mo’’ – who threatened to blow up a building filled with innocent people unless authorities free Colorado movie-theater shooting suspect James Holmes.

He also threatened to bomb a jail, a hotel, three colleges and two airports.

No bombs were found at the targets he mentioned.

He first contacted federal authorities in July 2012. It’s not clear how long Mo and the FBI were in touch.

The paper said he sometimes used an untraceable e-mail, other times an encrypted phone.

Mo even sent the FBI pictures of himself fashionably decked out in an Iranian military uniform.

The FBI, frustrated in its attempts to track him down, used special software that would install itself in Mo’s computer when he opened his e-mail.

It was designed specifically to help agents track his location and his movements.

But the software never worked as designed, the paper said, and Mo remains at large.

The feds had gotten permission to install the software from a Denver judge.

The agency tried to use it on at least one other probe, but a Houston judge described the method as “extremely intrusive’’ and probably unconstitutional — and shot it down.

The FBI has had the capability to sneak into computers’ Web cams for several years, a former employee of the agency told the Washington Post.

It was not clear how many times it tried to do it, but the paper’s source said the FBI has used its tool mainly in terrorism and the “most serious’’ investigations.

The technology is highly controversial.

“We have transitioned into a world where law enforcement is hacking into people’s computers and we have never had public debate,” Christopher Soghoian of the American Civil Liberties Union complained to the paper.

Read More

Attention: The NSA is Tracking Online Porn Viewers to Discredit

Sitting on the wire, the NSA has the ability to track and make a record of every website you visit.  Today, the Huffington Post revealed that the NSA is using this incredible power to track who visits online porn websites, and to use this information to discredit those it deems dangerous. Their porn habits would then be "exploited to undermine a target's credibility, reputation and authority."   

The story was illustrated with six individuals, none of whom are designated terrorists themselves. Instead, they are deemed "radicalizers," people—two of which the NSA itself characterized as a "well-known media celebrity" and a "respected academic"—whose speeches and postings allegedly incite hatred or promote offensive jihad. 

The report raises the specter of abusing online viewing records to discredit other political opponents of the US government. The NSA document was reviewed not just by the NSA and counter-terrorism officials, but by entities like the Department of Commerce and the US Trade Representative. The USTR negotiates treaties (like the controversial Trans-Pacific Partnership), and one could certainly imagine that the leverage from this program could be useful in pushing for the US position. In fact, EFF and three dozen civil society groups have already asked the NSA to explain if they are spying on those advocating for the public interest in US trade policy.

Ed Snowden's latest revelation may leave SEC officials quaking as the NSA "has been gathering records of online sexual activity and evidence of visits to pornographic websites as part of a proposed plan to harm the reputations of those whom the agency believes are radicalizing others through incendiary speeches." Of course, as we have seen, this 'information' would never be used by the government for non-radical-terrorist suppressing reasons, as the ACLU notes, is is "an unwelcome reminder of what it means to give an intelligence agency unfettered access to individuals' most sensitive information using tactics associated with the secret police services of authoritarian governments."

Via Snowden...

The National Security Agency has been gathering records of online sexual activity and evidence of visits to pornographic websites as part of a proposed plan to harm the reputations of those whom the agency believes are radicalizing others through incendiary speeches, according to a top-secret NSA document.

The document, provided by NSA whistleblower Edward Snowden, identifies six targets, all Muslims, as “exemplars” of how “personal vulnerabilities” can be learned through electronic surveillance, and then exploited to undermine a target’s credibility, reputation and authority.

The NSA document, dated Oct. 3, 2012, repeatedly refers to the power of charges of hypocrisy to undermine such a messenger.”

Full ACLU Statement:

The NSA considered discrediting six people by revealing surveillance evidence of their online sexual activity, visits to pornography websites, and other personal information, according to a report today in The Huffington Post. The article cited documents leaked by former NSA contactor Edward Snowden. The targets of the NSA’s plan were all Muslims whom the NSA characterized as “radicals” but who were not believed to be involved in terrorism. The documents say one of the targets was a “U.S. person,” a term describing American citizens and legal permanent residents, but all of the targets were reportedly outside the United States.

American Civil Liberties Union Deputy Legal Director Jameel Jaffer had this reaction:

“This report is an unwelcome reminder of what it means to give an intelligence agency unfettered access to individuals' most sensitive information. One ordinarily associates these kinds of tactics with the secret police services of authoritarian governments. That these tactics have been adopted by the world’s leading democracy – and the world’s most powerful intelligence agency – is truly chilling.”

The administration keeps on attempting to justify the NSA spying by claiming there is oversight from the other branches of government. But, as Pentagon Papers whistleblower Daniel Ellsberg noted in the Why Care About NSA Spying video, spying makes a mockery of that separation. How can that oversight be meaningful if the NSA's huge storehouse of information contains the private viewing habits of every senator, representative, and judge? When the only protection against abuse is internal policies, there is no serious oversight. Congress needs to take action now to rein in the spying.

Read More