Showing posts with label tips n trick. Show all posts
Showing posts with label tips n trick. Show all posts

How to Get Google+ Invitations

Friday, August 5, 2011 8:16 PM Posted by Budi Satria
Labels: , ,
A few days ago I received an Google+ invitation from Angga Reza . Thanks to him I now have an Google + account . Looks great , better that facebook . If you want to get Google + invitation email me at buddy.coolboys@gmail.com , in email write your name , lastname and your gmail address.


Just follow steps below and you’ll be able to have google+ account .
1) Email me at hackspc@gmail.com , then I will add you as friend to a circle called “friends” and shared a post with you. It looks like this

2)Once you get the invite click on Learn more about Google+
3)On the next screen click on “Join +”:

4) This will trigger the notification to you and next time you enter http://plus.google.com you will be able to use it.
This is working for me , please let us know your comments. If you have already google + acc add me as friend , find me by email buddy.coolboys@gmail.com
Read more ...
0 comments

Acunetix Web Vulnerability Scanner (WVS)

Tuesday, August 2, 2011 6:54 PM Posted by Budi Satria
Labels: ,
Acunetix Web Vulnerability Scanner (WVS) is designed to audit web site security.



There is a free *nix based version as well as a Windows based version which ranges in price from a free trial to thousands of dollars.

// WVS contains a suite of tools designed to assist penetration testers in auditing web sites and also has the ability to output an easy to read summary for clients. What really sets this particular scanner apart from others is their proprietary AcuSensor Technology. By installing the AcuSensor Technology on the target system prior to scanning, one is able to decrease the number of false positives, identify more vulnerabilities, and accurately determine the vulnerable code. This works with closed source applications as well as open source. WVS will definitely work without AcuSensor, but, it is incredibly more accurate when this module is properly deployed on the target system.

// Composition of Acunetix Web Vulnerability Scanner:
Site Crawler - used to map a web site by following links and gathering information in a similar fashion to search engine web crawlers.
Target Finder - used to identify http/https servers from a given IP range.
Domain Scanner - used to enumerate additional sub-domains for use as potential targets.
Blind SQL Injector - automates the process of extracting database information through SQL injection.
HTTP Editor - for constructing custom HTTP/HTTPS requests in order to analyze responses.
HTTP Sniffer - HTTP proxy that allows logging, intercepting, and modifying HTTP/HTTPS traffic on the fly.
HTTP Fuzzer - allows fuzzing of request parameters or headers. Useful for determining buffer overflows or input validation errors.
Auth Tester - tool for performing dictionary based attacks against basic HTTP, NTLM, and form based authentication.

// WVS is capable of detecting a number of vulnerabilities including, but not limited to, the following:
Cross Site Scripting
Code Execution
SQL Injection
File Creation
Cookie Manipulation
CRLF Injection
Cross Frame Scripting
Directory Traversal
Email Injection
File Inclusion
Path Disclosure
PHP Code Injection
LDAP Injection
Remote XSL Inclusion
URL Redirection
XPath Injection
Source Code Disclosure
It also utilizes the GHDB (Google Hacking Database).
This is one of those very useful tools that penetration testers should seriously consider purchasing as it helps greatly when auditing web sites and servers and creating detailed reports for customers.


Site URL: 
http://www.acunetix.com
Read more ...
0 comments

Trojan Sub7

6:26 PM Posted by Budi Satria
Labels: , , , , , ,
If you haven't heard of Sub7, I suggest you leave now, find out what it is, then come back. Stop wasting my time. If you think you have the skilled mind for it, stick around, and I will introduce you to one of the many essential tools hackers have ready at all times.

Origin

Sub7 was invented in the late 1980's by a legend known as Mobman. Mobman wanted to make the basic tasks of a hacker easily accessable and easy to implement. I'm not sure what exactly he programmed it in, but it was probably something extremely difficult and involved, like Visual Basic or A+. I read up on Mobman, no one knows of his whereabouts and some even claim that he is dead (real hackers know better). Either way, we can all thank Mobman for this great program.

What it is

Sub7 is a R.A.T (Remote Administration Tool) that basically has two parts: a client, and a server. After you have the server installed on another machine, or trick another person into installing the server on their machine, you can use the client to connect to them through network protocols and routes. After you're connected to them, the client provides you with a series of hacking tools and features to use on your victim. Which, obviously, is the goal of any hacker.
Sub7 has made this easy, but the only hard part is having the server installed on the other machine. You can see the official Sub7 website for tactics on how to accomplish this.


Screenshot of the Sub7 client window



Features

Sub7 is well-known for it's wide selection of elite tools and features. Listed below are just a few that come to mind:
  • Keylogger
  • Uploader
  • Server
  • Customized skins
  • Hide cursor
  • Client
  • CDROM close/open
  • Hide cursor
  • IP Pinging
  • Name lookup/revolution
  • Change the appearance of icon

Availability

Sub7 was banned by the United Nations in 1995, but I consulted my many underground resources and found it for you. The last version that was made was Sub7 Legends, and is available for download here. This file is extremely rare, and was very hard to find. I had to download it through KaZaA.
Again, as with many things found on this site, the creator of this site is NOT responsible for anything you do with the knowledge or tools found within the site. Everything here is for educational purposes only. If you do not agree, leave now.
Read more ...
0 comments

Facebook -game Hacks

Wednesday, June 22, 2011 7:49 PM Posted by Budi Satria
Labels: , ,
In this tutorial i will show you how to hack How fast you click? game in facebook by Dll injection





What is DLL injection ?
In computer programming, DLL injection is a technique used to run code within the address space of another process by forcing it to load a dynamic-link library. DLL injection is often used by third-party developers to influence the behavior of a program in a way its authors did not anticipate or intend  




Follow the steps to hack How fast You can click ?


1. Download cheat engine from Here
2. Open how fast you can  click game in your browser


3. Select process to open as shown 


4. Selct you browser In my case it is firefox

5. Start the game 
6. Now select enable speed hack from cheat engine and set the timer to zero 


7. Thats it you can see the timer freezed 

8. After clicking you can disable  speed hack and post your score on your wall




Note:- You can use the same hack for other games like pinball and minesweeper
Read more ...
0 comments

How To Hack Websites Using Phishing Method

Tuesday, April 12, 2011 7:28 PM Posted by Budi Satria
Labels: , , , ,
Phishing is the other most commonly used trick to hack passwords. This method involves the use of Fake Login Pages whose look and feel are almost identical to that of legitimate websites. Fake login pages are created by many hackers which appear exactly as Gmail ,Photobucke, facebook, Yahoo login pages and similar

Once you enter your login details on such a fake login page, they are actually stolen away by the hacker.
Here are the best step by step tutorials that explains how to hack websites using phishing method.
1) How To Hack Facebook – explains how to hack facebook account with fake login page
2)How To Hack Facebook Accounts | Video Tutorial
3)How To Hack Gmail - part 1
4) How To Hack Gmail - part 2
5)How To Hack A Photobucket Account
6) How To Hack Yahoo Password

How To Hack Websites Using Remote Spying Software
Once installed on the remote PC you wish, you only need to login to your own personal remote spying account to view all recorded data of the remote PC and to control target PC’ with remote access . Here are the best tutorials from hackspc.com that explains how to hack websites using remote spying software
1)How To Use Sniperspy To Hack Passwords
2) How To Hack A Computer

How To Hack Websites Using Social Engineering Method
Social engineering is a term that describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking and fooling other people to break normal security procedures.
How To Hack Hotmail
Read more ...
0 comments

Top 10 Tricks to exploit SQL Server Systems

Monday, April 11, 2011 10:34 PM Posted by Budi Satria
Labels:
Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.

1. Direct connections via the Internet

These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield's Port Report shows just how many systems are sitting out there waiting to be attacked. I don't understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.

2. Vulnerability scanning

Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.'s NGSSquirrel for SQL Server (for database-specific scanning). They're easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.


Figure 1: Common SQL injection vulnerabilities found using WebInspect.

3. Enumerating the SQL Server Resolution Service

Running on UDP port 1434, this allows you to find hidden database instances and probe deeper into the system. Chip Andrews' SQLPing v 2.5 is a great tool to use to look for SQL Server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren't listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434.

4. Cracking SA passwords

Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou?!). Yet another use for the handy-dandy SQLPing tool mentioned earlier. The commercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS Software Ltd. also have this capability.

5. Direct-exploit attacks

Direct attacks using tools such as Metasploit, shown in Figure 2, and its commercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silver-bullet hack for attackers penetrating a system and performing code injection or gaining unauthorized command-line access.

 Figure 2: SQL Server vulnerability exploitable using Metasploit's MSFConsole.

6. SQL injection

SQL injection attacks are executed via front-end Web applications that don't properly validate user input. Malformed SQL queries, including SQL commands, can be inserted directly into Web URLs and return informative errors, commands being executed and more. These attacks can be carried out manually -- if you have a lot of time. Once I discover that a server has a potential SQL injection vulnerability, I prefer to perform the follow-through using an automated tool, such as SPI Dynamics' SQL Injector, shown in Figure 3.

 Figure 3: SPI Dynamics' SQL Injector tool automates the SQL injection process.

7. Blind SQL injection

These attacks go about exploiting Web applications and back-end SQL Servers in the same basic fashion as standard SQL injection. The big difference is that the attacker doesn't receive feedback from the Web server in the form of returned error messages. Such an attack is even slower than standard SQL injection given the guesswork involved. You need a good tool for this situation, and that's where Absinthe, shown in Figure 4, comes in handy.

 Figure 4: Absinthe tool takes the pain out of blind SQL injection testing.

8. Reverse engineering the system

The reverse engineering trick looks for software exploits, memory corruption weaknesses and so on. In this sample chapter from the excellent book Exploiting Software: How to Break Code by Greg Hoglund and Gary McGraw, you'll find a discussion about reverse engineering ploys.

9. Google hacks

Google hacks use the extraordinary power of the Google search engine to ferret out SQL Server errors -- such as "Incorrect syntax near" -- leaking from publicly accessible systems. Several Google queries are available at Johnny Long's Google Hacking Database. (Look in the sections titled Error Messages and Files containing passwords.) Hackers use Google to find passwords, vulnerabilities in Web servers, underlying operating systems, publicly available procedures and more that they can use to further compromise a SQL Server system. Combining these queries with Web site names via Google's 'site:' operator often turns up juicy info you never imagined you could unearth.

10. Perusing Web site source code

Source code can also turn up information that may lead to a SQL Server break in. Specifically, developers may store SQL Server authentication information in ASP scripts to simplify the authentication process. A manual assessment or Google could uncover this information in a split second.
Posted in , by bcraker   
Read more ...
0 comments
Subscribe to: Posts (Atom)
Powered by Blogger