webhacks

Firesheep:Trick to Hack Facebook and Twitter Password on Wifi

Sun, 07 Aug 2011 11:51:26 +0100

Do you access your Facebook or Twitter account while you are on a public network like your college’s or office’s unsecured wifi.Then this is the time that you should think about your account security.If you think that facebook or Twitter are secured websites then it’s the time to face the reality they are not secured.Whenever you login into your facebook or twiiter account check the address bar of your browser you will see something like http://www.facebook.com/home.php? Similar is the case with twitter.They use http protocol instead of secured https protocol.But if you login into your gmail account you will notice that it uses https protocol.

So, the trick I am telling you works only on websites like facebook,twiiter,flickr but not on secured websites like Gmail.So here is Trick to Hack Facebook and Twitter Password on Wifi and also the method of protection from this hack.This trick doesnot require any programming knowlege and everyone can use this trick easily.

1.Download firesheep Firefox extension.This is a freeware extension for firefox browser.

2. Once installed it will open a sidebar window into your firefox browser.

3.Now it will show all the people who are connected to unsecured wifi network.Once they login into your facebook or twitter account you will get a notification and with a single click you can login into their account.

This whole thing work on the technique of cookie hijacking.Once your session cookie is hacked then anybody can login into your account.These cookies can be easily caputered on unsecured wifi network.

The best way to protect yourself from such a hacking trick is to avoid using your facebook or twitter accounts on unsecured wifi networks as it is a security lapse from the websites not on your side.

Note:-This article is to inform you about how your password can be hacked and how to prevent it.This article is purely for educational purposes.

Trick for Advanced SQL Injection

Sun, 07 Aug 2011 11:40:35 +0100

I recommend you to go through the earlier post so get a slight idea about What Sql injection Is And How It Works.

Well to make the Sql injection easier for you I would be using a tool Havij.Its has both a free version and and a paid version.In this tutorial I will be demonstrating how to use the free version of Havij.The success rate for this tool is more then 94% on the vulnerable website.

It is automated tool for SQL injection for penetration testers to check whether a website is vulnerable to SQL injection or not.All you need to do is to enter the URL of the site that you want to test for the vulnerability and click on ANALYZE button.It will automatically scan the website for Sql Injection.

Below Is the Download link For Havij

CLICK HERE TO DOWNLOAD HAVIJ

Here Are the Features of Havij

Supported Databases with injection methods:
a. MsSQL 2000/2005 with error
b. MsSQL 2000/2005 no error (union based)
c. MySQL (union based)
d. MySQL Blind
e. MySQL error based
f. Oracle (union based)
g. MsAccess (union based)

Automatic database detection

Automatic type detection (string or integer)

Automatic keyword detection (finding difference between the positive and negative response)

Trying different injection syntaxes

Proxy support

Real time result

Options for replacing space by /**/,+,… against IDS or filters

Avoid using strings (magic_quotes similar filters bypass)

Bypassing illegal union

Full customizable http headers (like referer and user agent)

Load cookie from site for authentication

Guessing tables and columns in mysql<5 (also in blind) and MsAccess

Fast getting tables and columns for mysql

Multi thread Admin page finder

Multi thread Online MD5 cracker

Getting DBMS Informations

Getting tables, columns and data

Command executation (mssql only)

Reading system files (mysql only)

Insert/update/delete data

What Havij can do for you ?

By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.

How to Find A vulnerable website

Go to google homepage and search for inurl:php?id=

You will get probably thousands of result.Now open any page and add a apostrophe ( ‘ )to the end of the url.Example if the Url was http://www.mytargetsite.com/php?id=34 it should be now http://www.mytargetsite.com/php?id=34’

If you get a SQL syntax error then this website can be vulnerable to SQL injection.Now you should use Havij on this URL.

NOTE:This tutorial is for only educational and testing purposes.In some countries SQL injection is an offence.

Basics And Working of SQL Injection Attacks

Sun, 07 Aug 2011 11:36:26 +0100

SQl injection is a vulnerability that allows an attacker to influence the queries that are passed to the back-end database.It has been present since the time databases have been attached to the web applications.However, the main credit of bringing SQL injection into public notice goes to Rain Forest Puppy who in 1998 wrote an article on it and in 2000 he wrote another article describing how he hacked one of the popular website on the internet using SQL injection.

Before understanding the how SQL injection attacks we need to understand the Simple Three Tier Architectureor a Four Tier Architecture.This will clear your basics and give you a rough idea of how database-driven web applications work.

Three Tier Architecture

In a simple three tier datbase-driven architecture the three layers that are used are:-

Presentation Tier(Browsers)
Logic Tier
Storage Tier(Database)

The three tier architecture follows a linear relationship i.e Presentation Tier connects to the Logic Tier and theLogic Tier connects to the Storage Tier

Presentation Tier <–> Logic Tier <--> Storage Tier

To understand this consider an example

Suppose you connect to the http://www.website.com using his web browser.This is your presentation tier.Now the web server residing in the logic tier will load the script for the entered url and will pass it to the scripting engine which will parse and execute the script.It will also open a connection to the database i.e Storage Tier .It will perform the queries and the data from the database is transferred to the logic tier which will now convert into HTML which is rendered by the Browser.

Four Tier Architecture

In Four Tier Architecture an layer of Application Server is inserted between a web server and the database.

Presentation Tier(Browsers)
Logic Tier
Application Tier
Storage Tier(Database)

In four tier architecture the connection to the database is opened by application server which has Application Programming Interface (API) that implements the business logic before transferring the data to the Logic tier.

Presentation TierLogic Tier Application Server Storage Tier

Working Of SQL Injection

SQL injection can be used using various methods.In this tutorial I will explain to the basic concepts behind the SQL injection.

Suppose you are on a shopping site and you have selected the option of showing all the accessories that costless then 200$ and its Url is like

http://www.shoppingsite.com/products.php?val=100

To test this website for SQL injection try appending your SQl injection commands in the val parameter ‘OR ‘1’=’1

http://www.shoppingsite.com/products.php?val=100’OR’1’=’1

If the above injection works and shows the list of all the accessories then the website is vulnerable to this type of SQL injection

This means that at the backend the script will be executed as shown:

SELECT *

FROMProductstbl

WHEREPrice<’200.00’ OR ‘1’=’1’

ORDER BYProductdescription

As the condition 1=1 so this will give you list of all the products

How this SQL injection Attack Can Be Harmful

Suppose a website uses the following url for logging into admin panel

http://www.website.com/cms/login.php?username=saini&password=go

now if the above website is vulnerable to the SQL injection as mentioned in the above example then by entering any username and password in the url you can login

http://www.website.com/ms/login.php?username=dnt&password=dnt’OR’1’=’1

so you will just login without valid username and password to the admin panel of a website.

This tutorial is becoming very long so I will explain the rest and the best methods of SQL injection in my next post On SQL injection.

All types of serial keys for everything

Sat, 06 Aug 2011 11:38:21 +0100

More than 70000 Serial key of games

This is collection serial key of more than 70000 games

SO ENJOY THEM

Download :- click here

1 000 000 serial keys for softwares (New updated 17/11/09)

Collection of serial numbers and keys for most programs. Using this database, you can turn every trial in full. Base keys updated on December 9, 2009.
- Base is presented in the form of organized text files (MS Office Word 2003, notebook)
- Over 1 million serial numbers and keys
- Fully working (verified)
- Completely original (these serials are not blacklisted)
- The serial number of almost every software
- Archive scanned with Kaspersky Internet Security 2009 Avast Pro Nod32
- Working Keygen patches and for some programs
- Easy to find (in the series are arranged alphabetically, so there will be no difficulty in finding those that you want)
- Also included are the keys for some games.
- Also a lot of genuine keys for Windows XP and Vista, MS Office 2003/2007
- Added database keys for the best programs in 2007-2008

Year: 2009
Format: txt / doc
File size: 1.35 Mb

Download :-

mirror 1

mirror 2

10,20,000 serial keys for all the softwares

1,20,000 serial keys(8.3MB)

Hey friends this file really contains 1 million serial keys of all the softwares as well as games.This file contains keys of latest keys of games like FIFA 09,Frontlines Fuel Of War and many more and it contains keys for latest softwares like NORTON 2010,BitDefender 2010 total security and many more.

Download :- click here

1 MILLION SERIAL KEYS OF SOME FAMOUS SOFTWARES AND GAMES

Hey friends this file really contains 1 million serial keys of all the softwares as well as games.This file contains keys of latest keys of games.

DOWNLOAD:- 6.8 MB

click here for download

3 Million Serial Keys For All Games And Softwares(Latest) | 20MB

3 Million Serial Keys For All Games And Softwares(Latest) | 20 MB

Hey friends download this and enjoy!!!!!!!!!!!

click here for download

1 Million Serial Numbers of Different Software

1 Million Serial Numbers of Different Software

If u r searching for the serial now search for the software

click here for download

1300 generator key serial, and to programs

Please note - 1300 key generator and serial to certain programs and games at this point. The most essential book to anyone who enjoys Compon. Cachan CPA necessarily!

Released: 2009
Platform: Windows 2000/XP/Vista
Size: 69.3 MB
Terms of use: free

click here for download

Hack the passwords

Sat, 06 Aug 2011 06:52:44 +0100

Hack the passwords

Can you recheck your first php program which you have done with database backend support. Is there any password storing field in that ?.

If so you might saved your password as its plain text format without any encryption or hashing , right ? If not, you are very genius programmer by birth. What would happen if your database is leaked or somebody hacked your database, after you hosted your website and a lots of user registered or submitted their account with password. You are trapped. The hacker can access the user account by acquiring the password (saved without any encryption). The user can sue you for publishing his password open. So beware of this password saving while doing big project which is being hosted for a huge public usage.

Then what are the mechanism for saving password in database ?

One is you can save password after digesting or hashing , and and while rechecking the account or login you can compared the hash of password entered with the password stored in database. For that in php you can use this function:

$hash_password = sha1($password); ?>

Is this method all enough for full security. No , Never. For example, if you already know somebody’s password, say Sanjay’s password is : access, and you got the database and you will get the hash encoded string of the password: access. Suppose “XYZ123#@!” is the hash password got from database. Then you can reverse compare whether there any other user having hash text with “XYZ123#@!”, and thus you can get the password of that particular user. Hacked Again !!!

How to avoid this. Yes solution is Salting. Add some salt(random string) to current password and hash the whole password and save in database. Remember to save the salt value too in another field of the table , for rechecking the account login. Then for same password say”accesss”, you will get different hash digests. Thus the reverse caparison from know password can be avoided.

$salt = rand(1000,99999);
$hash_password = sha1($password . $salt ); ?>

Is this all enough for full security. Need not to think about the same salt for same password while creating random salt value. The probability for that is .00000….followed by 1000000 zeros …1 . Means Never.
But we are not taking risk. Add some more information to the password before hashing it. Generate a global constant string that only know to the programmer say : &555$34E$ and call it Global pattern . Append this string also with password+salt string before hashing. This will create more secured digest for your password. Remember , never forgot or miss this Global pattern, otherwise you can never check the login password later. (And it is not like the salt, the value of salt is there in database table) .
$hash_password = sha1($password . $salt . auth::GlobalPattern()); ?>
Enough … No one can hack your password now, even though he get your database. Okay .
(Saving encrypted password also helps to avoid sql injection)
Okay, enjoy programming.

SKIP OR BYPASS SOFTWARE

Sat, 06 Aug 2011 06:50:23 +0100

SKIP OR BYPASS SOFTWARE

Rapidshare limit bypasser

1.rapidshare limit bypasser--click here

Skip or bypass Rapidshare, Megaupload Waiting time

Yes, you are reading it correctly, its not a prank or joke, now you can easily avoid the waiting time or usually we say time limit when you download as a free user from the file sharing services such as rapidshare, megaupload, deposifiles, hotfile. Normally you have to wait for 20-60 minutes to download the second file after downloading the first one. They implement ways to invite users to purchase a premium service. But this way of limiting Free download limit and asking free users to wait for long time to start another download can be annoying one.

Skipscreen is an extension to browser to by pass waiting time on download. Unfortunately it can only be used with Firefox browsers to avoid waiting time while downloading files from some popular File hosting services like:
* Rapidshare.com
* zShare.net
* MediaFire.com
* Megaupload.com
* Sharebee.com
* Depositfiles.com
* Sendspace.com
* Divshare.com
* Linkbucks.com
* Uploaded.to
* Hotfiles.com
* 4shared.com
* Limelinx.com
* Link-Protector.com
Its use is very simple and does not require any configuration, just go to the addon page of the extension and install it, restart your browser and enter one of thesedownload sites and you will no longer have to wait.
Download Skip ----Screen Firefox Extention

Alternative Methods or Hacks to Beat Rapidshare Download Limits and Waiting Time
Method 1: Using Java Script:
1. Goto the page you want to download
2. Select FREE button
3. In the address bar put the following: javascript:alert(c=0)
4. Click OK
5. Click OK to the pop-up box
6. Enter the captcha
7. Download Your File
Method 2: Request a new IP address from your ISP server
Here’s how to do it in windows:
1. Click Start
2. Click run
3. In the run box type cmd.exe and click OK
4. When the command prompt opens type the following.
ENTER after each new line.
ipconfig /flushdns
ipconfig /release
ipconfig /renew
exit
Note: This might only work for DSL/Modem Internet Connection, not for Cable Internet users

2). Skipping or Bypassing Rapidshare or Megaupload, hotfile waiting time.

In this post I have a new Rapidshare hacking tip for you. Well, you might be aware of Browsers like Firefox, or Internet Explorer. I would like to introduce you to a browser known as Torpark Browser, which works as a anonymous web browser. It is like a proxy browser where you can change your permanent IP Address to dynamic IP Address. So, when ever you run this browser you get a new IP address. Now download mutliple files at the same time. Yes you read it right, you can download multiple rapidshare files or megaupload, hotfile files at the same time. You can even skip or bypass the time limit on downloading files. The most amazing thing is IDM works with this browser.

DOWNLOAD
Note: You need to close the browser window after each download coz it will reset the ip address

Earn Money 100% free

Sat, 06 Aug 2011 06:27:49 +0100

1)For One Click Earn 2$ in 30 Seconds

2)For One Click Earn 5$ in 30 Seconds

3)For one click Earn 10$ in 60 seconds

4)For one click Earn 0.02 $ with in 30-10 seconds,minimum payout is 4$ so HURRY UP!!

Step 1: Register in above three links

Just give your name amd emails address(If u want u can give fake email address which access by u only )

In Registration Referrer is must……. Just type “indiantoplink”

Referrer : INDIANTOPLINK

2$ in 30 Seconds

First You have to make 1000$ then only you can cash out the 1000$.

Imp : You need login every 24 hours once and click the “view Ads” you can see the Fig 1.

You need to Click one link first and wait for 30 seconds see the Fig 2. And it tells you click One number among four Number.After you clikc the correct number 2$ will be added in ur account.So everyday u need to login and click the adds.If u miss a single day then ur balance will be Zero.So don’t miss it………..

TO cash out the 1000$ u need to have the Paypal Account…..If u r scare means Create one new account in bank and add to paypal account……..but not now first make 1000$ then u create a paypal acc and bank account.

5$ in 30 seconds

As same for 5$ in 30 seconds but to cash out here u need to do 5000$....then only u can transfer 5000$ to ur bank acc by paypal………This is just 10 min for two websites and u can earn 20$ + 35$ = 55$ per day…….

10$ in 60 seconds
10$ per click site is also the same the ads are of 10$ /60 seconds and you can transfer 10000$ to your bank account by paypal /alertpay

Just in one month u can Earn 1000$ -10000$ = 45,000/- rupees till 2,00,000 rupees which is more equal to ur Job salary guys……….

once you join the site keep on checking it with in 24 hrs and also transfer the referral to your friends ..and earn money .every site have some down-line income means if your friends earn 100$ per day then you will get 5 to 10% of there income .so guys be active and happy earning

NOTE:- Guy's be active , 75% of the people just lost interest because this process take bit longer as it seem . but i am sure if you will be active you can earn $ 1000/5000$/10000$ with in 1-2 month .

whenever you join these sites try to be active ..sign in everyday and don't forget to forward your referral links to your friends and dear ones .

HAPPY EARNING !!!

Quick guide to Google+ for Dummies!

Fri, 05 Aug 2011 16:12:14 +0100

Everyone is struggling to get Google+ account and those who have already got one are busy exploring it. Just when i joined Google+, I literally spent whole day on it exploring and Googling more about it. The User interface of Google+ is clean and Impressive, though it closely resembles to Facebook’s UI.

Interestingly Google+ let’s you edit your posts after publishing, this was really unexpected feature and one can use this feature in a wrong way. Overall Google+ seems to be promising next generation social Network.

I remember my old days, when i joined facebook couple of years ago, i felt really difficult to use it but then with time i mastered it..i can say . Now same thing is happening again with Google+. So if you don’t wanna waste your time Googling how to use Google+, here’s a Quick Google+ cheat sheet that explains all the stuff that you can do on Google+, as well as useful shortcuts that are supported by Google+.

#1. Circles are like grouping people and Following them like on Twitter. In other words, it is similar to Facebook friend lists or Twitter Lists. You can create your own custom circle and add people by dragging them in from a list of contacts.

#2. +1 Button on a post is the same as “Like” button on Facebook. +1 Button on any Website is Similar to Facebook “Share” Button.#3. Text Options in post: unlike Facebook, here you can make your words bold, italic & ~~Strike out~~. To do so you just need to add some ‘special characters’ before and after the text, see below:

#4. Just like Facebook you can add photos, videos, or links to your posts. You can drag photos and videos from your desktop or folder and drop them (in post) into the Stream editor.

#5. To mention people in your Posts, Just add + or @ in front of their name.

#6. If you set your Post to “Public” then people who are not in your circle may see this post. You can also make it visible to only selected circles or friends. If you Select “Extended circles” then everyone in your circles, plus all the people in their circles can see your post; this is similar to friends of friends in Facebook.

#7. Like Twitter, you can also Re-share other peoples Posts. If you don’t want people to re-share your posts then Click the arrow at the Top-Right of the post and choose “Disable”.

#8. In Google+ you cannot send Private messages to people. The only way to do so is by sharing your post with them privately. Make sure you disable Re-share option for that post, because the person with whom you are sharing can Re-share it.

#7. Keyboard Hot-keys:

Do you download Free Softwares from UN-OFFICIAL websites?

Fri, 05 Aug 2011 16:08:57 +0100

I know you are pro in searching and downloading pirated software’s and am sure you are aware of the risk behind it. But what about Open source and Free software’s? Do you download them from any 3rd party websites or file sharing networks? ..well its time to be aware of the Risk.

Popular open-source software’s that are being downloaded by thousands of internet users everyday includes VLC media player, Google Chrome browser and others. Most people prefer downloading these from unofficial websites, because they feel its more complicated when downloading from Official Websites, Like in the case of downloading ‘Google chrome browser’ from official webpage, you are first required to download small downloader which will then download and install the chrome browser on your PC. But many other websites provide download link for the full “Google chrome” exe file and people prefer this way.

We all know that the main objective of open-source software developers, is to share the source code with everyone. Because they expect other developers to fix any bugs or add new features to it and make it more beautiful. But some time it gets abused.

Scammers are taking advantage of the availability of the source code to trick users and make money. The Scammers are adding malware and adware to these software’s and releasing them as the original product. Some deceptive sites are even re-branding the original open-source project and selling them as a new product.

Trusted Websites: brother-soft | cnet | sourceforge | filehippo

The Scammers are Binding “open-source sofwares” with various crapware to monetize the software with loads of advertisements and earn money. The result of this is a poor product that doesn’t work as intended, that can’t be uninstalled and that clearly abuses its users and their privacy. Recently there were reports that some websites are selling “Mozilla Firefox browser”, using the Mozilla trademarks to promote other products and services, or using modified versions of the Mozilla trademarks.

How these Scammers work?

#1 They Download the source code from open source projects and add adware or malware to it.
#2 They release their version of product and disguise as the original.
#3 They advertise their product on adverting networks like Google AdWords.
#4 They earn more money through the malware and adware bundled with their version of Free Software.
#5 They buy more advertisements to spread their copy of free software and earn even more.

These activities are indeed deceptive, harm users and cause consumer confusion. Open source Softwares are affected and will keep on affected by this scourge and there’s not much we can do about it. So the next time you download any free open-source software, make sure you are on the right place.

Hack Gmail Accounts

Fri, 05 Aug 2011 16:05:05 +0100

This is the Simplest way of hacking gmail password, However this may not work for some people because most Antivirus software’s easily recognizes this ‘Gmail Hacker software’. This trick involves creating a special .exe file and sending it to the Victim. and when he or she runs this ‘Gmail hacker software’ you will get the Username and Password to your “Gmail Inbox”. This Trick requires you to have ‘Microsoft’s .net Framework‘, if you dont have please download and install it.

-Follow the Step by Step Tutorials below to hack Gmail Account Password:

Step 1: Download ‘Gmail hacker‘ Software (extract the file to desktop). If your Antivirus deletes the file, then please turnoff your Antivirus or uninstall it and try downloading again.
Step 2: Run ‘Gmail hacker Bulder.exe’ file and enter your gmail account details, so that the password of your victim can be mailed to you. If you are afraid of entering your gmail details, then do create one fake account and enter those details.

Step 3: After you enter your ‘Gmail account’ details Click on ‘Build’. Now the Gmail Hacker

email and some how convince him to run that software and enter all information (which includes his Gmail id and will Clone itself, ie it will create another file called ‘Gmail Hacker.exe’ and will save it in the same folder.
Step 4: Now Send the ‘Gmail Hacker.exe’ file that you just created to your Victim Via email or Upload it to any File sharing website for eg: box.net, Rapidshare, etc and send the link via chat or email.

Ask the Victim to try that software to hack others password plus Gmail ID of the victim he want to hack).

When he enters the required information and hits the ‘hack them’ Button, he will receive an error message as shown below and The Username and Password will be mailed to your Gmail Id (that you Specified in Step 2)

Note: you Should Provide a valid USERNAME and PASSWORD, in order to receive the hacked details.