You are here: »
Home » All posts
What is Ddos?
A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.
In a typical DDoS attack, a hacker (or, if you prefer, cracker) begins by exploiting a vulnerability in one computer system and making it the DDoS master. It is from the master system that the intruder identifies and communicates with other systems that can be compromised. The intruder loads cracking tools available on the Internet on multiple -- sometimes thousands of -- compromised systems. With a single command, the intruder instructs the controlled machines to launch one of many flood attacks against a specified target. The inundation of packets to the target causes a denial of service.
Download here
his Ddos tool coded on visual basic 6 firstly you must send this ocx's to system32
comdlg32.ocx
msinet.ocx
mscomctl.ocx
mswinsck.ocx
this Tool will be detected supicious by Antiviruses because ddos tool works on port 80 & it is also a backdoor port soo it is a false positive detection dont worry this tool is clean.
Before i start my Article first i would like to tell if your a newbie or you r new to hacking then you can learn phishing here in my previous articles:
facebook phishing , How to perform phishing manually
Advantages over normal phishing:
In Normal phishing the victim will be given a link which is made by the hacker. A person with basic knowledge can recognize that it was a fake link.But in XSS the victim cannot suspect the link because it contains a trusted URL.
Now lets start , in this article i will be showing you that how you will craft your link into A Clint side script link of a XSS vulnerable website. which will confuse even a Smart victim to click on the link & enter private data like emails,password because the phisher link wiill be crafted in the original link of Xss vulnerable website.
What is Cross site Scripting(XSS)?
It is a vulnerability typically found in web applications.A hacker can use this vulnerability to inject client-side script into web pages viewed by other users.
A Web application vulnerable to XSS allows a user to inadvertently send malicious data to self through that application.
Attackers often perform XSS exploitation by crafting malicious URLs and tricking users into clicking on them.
These links cause client side scripting languages )VBScript, JavaScript etc,) of the attacker s choice to execute on the victim's browser.
XSS vulnerabilities are caused by a failure in the web application to properly validate user input.
What can an attacker do with this?
- Steal user cookies and can take complete account takeover
- Steal data on web pages viewed by victim
- Deface pages viewed by victim
- Use web pages for phishing
Lets Start Our Attack Demonstration:
1. The very firs thing you have to do is, find An Xss Vulnerable Website
This can be done using google. Go to google and search using the following Dork.
inurl: "search.php?q="
To test the vulnerability you can inject the following code in search fields,comment fields of your website.
<script>alert("hacker dev")</script>
If it returns an alert box showing “hacker dev”, That site is vulnerable to XSS.
2. this is a very main part , how to craft your link:
Your link will look like
http://site.com/search.php?q=<script>alert("you are hacked")</script>
You can use your specially crafted link to steal your victim’s information just as in phishing|
EXAMPLE:
You can replace “http://www.devzcyberarena.blogspot.com/” with your fake login page’s link.Then it takes the victim to your fake login page.
Step 3:Send the link to your victim
Now you can send your specially crafted link to the victim by any means as you do in normal phishing.
This is such a dangerous vulnerability in web applications. It got 2nd rank in OWASP top 10 vulnerabilities.If a hacker finds this vulnerability in any of the bank websites, he can attempt a malicious attack against the customers of the bank and steal lots of information like credit cards, account numbers, passwords etc by simply sending a group mail to the customers of the bank.
What Is Sandboxie and The Benefits Of The Isolated Sandbox
Best Way to Secure your Ass..:D!!!!!
Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.
What Is Sandboxie?
The red arrows indicate changes flowing from a running program into your computer. The box labeled Hard disk (no sandbox) shows changes by a program running normally. The box labeled Hard disk (with sandbox) shows changes by a program running under Sandboxie. The animation illustrates that Sandboxie is able to intercept the changes and isolate them within a sandbox, depicted as a yellow rectangle. It also illustrates that grouping the changes together makes it easy to delete all of them at once.
Benefits of the Isolated Sandbox
Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.
Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.
Secure E-mail: Viruses and other malicious software that might be hiding in your email can't break out of the sandbox and can't infect your real system.
Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.
Download: Sandboxie Installer 3.60 (Windows 2000 - Windows 7; 32-bit + 64-bit) (~2.0 MB) (md5/sha1)
Upgrade: If you have an earlier version of Sandboxie already installed, you can let the installer upgrade (overwrite) your existing installation.
hey guyzz today i will tell you a Trick How to increase Crack credits Of Sms Global,Worlds Best Sms spoofing Website :-)
SO just follow these intructions & you will GEt 125 Free Credits :D :-
You Can See my previous Post abou Sms spoofing here
1.)For this go to a website which help you click here
Register yourself on SMSglobal but before register, The Trick lies Here:
SMSglobal allow only 25 instant credits for free user means you only send 25 SMS but i will tell you a trick by which you will gain 125 credits means 125 free SMS for send globally.
When you fill the registration foam,you see a blank space for PROMO CODE here you write the" WPRESS " like given below...
you only fill the...
1: Username
2: Account type---> Personal
3: Complete Contact Information:: Please write right Mobile Number because Website send you password of the account.Do not add personal address.
4: Write Promo Code "WPRESS".Accept terms and condition and fill Verification Code.
You will get 125 free SMS for send Globally by any Number.
I think this is the best threads on SMS hacking.And it also works like charm :)!!!
HAve a happy SMS SPOOFING Njoy..:D!!!!
How to bypass Adf.ly Url shorten advertisements
There was very annoying when we want to download movies or games that owner set the download link with the adf.ly. Adf.ly was used to embed with the download link to earn money. But this adf.ly extension make our download process so slow and delay. This is one of my solution how to remove adf.ly link.
How to bypass Adf.ly Url shorten advertisements:
THIS IS A A MOZILLA BROWSER TRICK:
To bypass/hack Adf.ly, you need to have Firefox browser with Greasemonkey installed. You can installGreasemonkeyfirefox addon, if you haven't installed yet.
1. Go to Adf.ly Hacker script page to bypass Adf.ly advertisements.
2. Hit on Install and confirm the script installation in your Greasemonkey.
3. Now, whenever you'll click on any Adf.ly shortened link(eg: http://adf.ly/xyz) , you won't see any timer or counter of 5 seconds. The actual intended page will appear.
FOR GOOGLE CHROME INSTALL THIS EXTENSION:
https://chrome.google.com/webstore/detail/kfffmkcdjljajeggjoecedpnepochcfm?hc=search&hcp=main
Finish..that all.
Thanxx for reading.:)
Guyz Posting Some Anti hacking Article :D
These days Cyber crime has crossed its all limits. These days’ hackers are trying to find out the new ways to tease innocent people. One of those few ways which hackers had discovered is Keylogging. Keylogging is sometime also called Keystroke Logging.
keylogger is a hardware device or a software program that records the real time activity of a computer user including the keyboard keys they press.
Keylogging means hacking way in which the hacker sends a key logger in your computer and it activates itself as soon as it reaches your computer and works secretly. It sends your PC’s every key stroke or key stroke (key you press) to the hacker.
Detecting the presence of a keylogger on a computer can be difficult.So to defend people against keyloggers, ethical hackers have designed its contradictory part called anti-keyloggers. You need to install it on your computer and then it either finds all the keyloggers on your computer and delete them or encrypt your key strokes.
So Today I'm going to Discuss about Top Five Anti-Keylogging Softwares.
Zemana AntiLogger is one of the most famous,reliable and worth giving Anti-Keylogger in the market. Zemana Anti-KeyLogger will definitely remove all the keyloggers from your computer, this software also not costs you too much.This will also stop the hackers to monitor your screen.
DataGuard Anti-Keylogger is a anti-keylogger which detects and disables all types keylogger in your computer.It works on cutting-edge heuristics methods.DataGurad Anti-Keylogger is a user friendly anti-keylogger too.
GuardedID Premium is a great and a handy anti-keylogger which is very cheap and reliable. This software provides you the user friendly environment and this software encrypts all the things you type.
CoDefender was developed by an Sydney based company called Encassa.It is robustly trusted by the users.It encrypts all the words you type and hence no one come to know what you typed!
PrivacyKeyboard works really interestingly it don’t perform any type of scans which will detect Keyloggers on your computer ; it stops all the keystrokes to intercepted to the hacker. Privacy Keyboard is also a reliable Anti-Keylogger.
This is Very Easy Technique Of Exploiting A Wordpress Website by Uploading A Deface Page Or Shell..!!!
SO here is the Procedure how you Do it:
1- open Google.com and enter Dork:
inurl:admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html
inurl:Powered By OpenCart
http://www.schoolshopper.com.au/
You'll Got a lot of websites by google, select anyone .
you must have to search a lot to find good fresh vulnerable websites.:P
For Example i got this one
Then i'll will simply add the vuln URL after the website
http://www.schoolshopper.com.au/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html
(The path May be chnaged in other Website , Examplesite.com/abc/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html)
Now a Page will be open Like This
Now See The connector option which is on top left side on page, Change The Connector into PHP (see the Image below)
and Now see file upload option and upload your deface or shell
http://www.schoolshopper.com.au/Cyb3r_dev(1).htm
and for checking shell or deface check this url
www.site.com/deface.html
or
www.site.com/shell.php
How to use
----------
This tool is for exploiting SQL Injection bugs in web application.
For using this tool you should know a little about SQL Injections.
Enter target url and select http method then click Analyze.
Note: Try to url be valid input that returns a normal page not a 404 or error page.
What's New?
-----------
Version 1.15 2011/06/08-Webknight WAF bypass added.
-Bypassing mod_security made better
-Unicode support added
-A new method for tables/columns extraction in mssql
-Continuing previous tables/columns extraction made available
-Custom replacement added to the settings
-Default injection value added to the settings (when using %Inject_Here%)
-Table and column prefix added for blind injections
-Custom table and column list added.
-Custom time out added.
-A new md5 cracker site added
-bugfix: a bug releating to SELECT command
-bugfix: finding string column
-bugfix: getting multi column data in mssql
-bugfix: finding mysql column count
-bugfix: wrong syntax in injection string type in MsAccess
-bugfix: false positive results was removed
-bugfix: data extraction in url-encoded pages
-bugfix: loading saved projects
-bugfix: some errors in data extraction in mssql fixed.
-bugfix: a bug in MsAccess when guessing tables and columns
-bugfix: a bug when using proxy
-bugfix: enabling remote desktop bug in windows server 2008 (thanks to pegasus315)
-bugfix: false positive in finding columns count
-bugfix: when mssql error based method failed
-bugfix: a bug in saving data
-bugfix: Oracle and PostgreSQL detection
Instructions
1.Run Havij.exe
2. Once it opens you will see register..
3. Click Register
Make sure you are connected to the internet
4. Under Name:
You write: Cracked@By.Exidous
5. Under File:
You select the folder where you are currently running the Havij program from and select Havij Key
6. Done....
Download Here
Learn how to hack websites by Sql injections using havij here
Source:-HF
MD5 is not an encryption, and therefore cannot be decrypted, only cracked.
First off, download "Password Pro" from here.
It is a zip file, so I suggest downloading 7zip.
Extract all of the files to one folder.
It should look similar to this.
![[Image: 11987894.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tJdtWIbmqgModsrd_JFKH9AOnOO-wfgQBMOTVOyknFsyLfuRWr8l3Gsggg9wsePxnCy82RcUdT-y9lTDXN8uktw-CIdTguq4DEpD_MEXDVGDgiszc=s0-d)
For the purpose of this tutorial, I will be cracking this hash: "6dcd0f272fbb7f6f8ff3a8a5e96c45aa:Ws)", which is formatted as "Hash:Salt", and is from VBulletin 4.x.x.
Open up notepad, paste in the Hash and salt, and save it anywhere on your computer, preferably in the same folder as Password Pro.
![[Image: 56139940.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_swN_UZONqJuf380zfXPZ_0pqbunDjBNcWIJz8euCsDq0LGP5CoZxdz3kQ_YcDGGwnFCsS63abSC8bBYtrMhILSxCMYEI9QNCmqJgJV0Z_b5L0S5lp_u_4=s0-d)
Open up Password Pro and go to "File->Import"
![[Image: 84755402.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sjS7Z7hHpDrawUUNSxYX2cKKf_d9kD1kojX2V-qmXepW4c7fUiUfIAh_6nrI-S2Xaqh6mgL5PFfyviiwCe-8NHdq6xq04ohPh_FtuEfCDbh4A=s0-d)
Find the place where you saved the text file with the hash inside of it, and open it.
Fill in the boxes as such.
![[Image: 13377943.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v7hDFebXixQvpC8EPdFqgPPjOg3XJRMs6B-3suvYlv7IBmfG195aDPK4ooWCsASVFFeZw1Oub04bNoixkWxGGcGgbcyj9xjv7QKEz_HiRGx2DNdLgm=s0-d)
Note: The bottom is the formatting of the hash and salt in the text file, and the top is the algorithm for VBulletin 4.x
Now, go to "Audit->Preliminary Attack"
(For this hash, as it is simple, it should probably crack it with just this.)
![[Image: 63893726.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v4FCoN6XbQ5UpUcfStUuyJ9h9pdaFxp9i6Nqw3iVKy-BO24JEa_fjEtSmsTfXnktuFvZuI_D2AGGSDhGQdJumS83V7TO_fAvIkhWJu24rh-CXiqEqDZ5E=s0-d)
Hit the start button, and watch it go.
![[Image: 70193249.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tsDSDSoTEjPpWS5jyGa8aPXH5C44ZG2UGEeuzUDjSR9SV9omkEHFSCRh1TJZt1WmzwnPill2ap1epRK3xnnk_3T-0NSnxkf3SpyMBVEGoHm_zk5zji=s0-d)
If, in the case that a Preliminary Attack does not work, just repeat the previous steps with a Rainbow Attack (If you have a Rainbow Table), a Simple Dictionary Attack, or a Brute Force Attack.
Previous Article
