Widgets How To Find Vulnerability On A Website Web Vulnerability

As We All know website gets hacked due to vulnerabilities exist on that site so today i will be giving a brief article on finding Web Vulnerability

Now a days Hackers are concentrating a lot of their efforts to find holes in a web application,And This Is the major reason Reason Why Thousands Of Website Getting hacked.If you are a website owner and having a High Page rank and High Traffic then there is a chance that you might be a victim of these Hackers.

Few years back their existed no proper tools search for vulnerability, but now a days there are tons of tools available through which even a newbie can find a vulnerable site and start Hacking.

Common Methods used for Website Hacking

There are lots of methods that can be used to hack a website but most common ones are as follows:

1.SQL Injection
2.XSS(Cross Site Scripting)
3.Remote File Inclusion(RFI)
4.Remote File Upload Vulnerability (Exploits)
5.Local File inclusion(LFI)
6.DDOS attack
7.Google Dorks

And Many More See the Left side Category Box...

I Have Putted My Effort And Written All These types of Attack On my Site With Deatil Tutorial few with examples Please Go Through It If You want to Be A Real Hacker.

Now..
Some Of The Tools that are Mostly used By hacker to hack website Or find Vulnerability on A Website.

Tools Used To Find Website Vulnerability By Hacker.

Acunetix:

Acunetix is one of my favorite tool to find a venerability in any web application It automatically checks your web applications for SQL Injection, XSS & all other web vulnerabilities.

Download Acunetix For Our link

Nessus:

Nessus is the best unix venerability testing tool and among the best to run on windows. Key features of this software include Remote and local file securitychecks a client/server architecture with a GTK graphical interface etc.

Download Nessus

Retina
Retina is another Vulnerability assessment tool,It scans all the hosts on a network and report on any vulnerabilities found.

Download Retina


Metasploit Framework :

The Metasploit Framework is the open source penetration testing framework with the world's largest database of public and tested exploits.

Download Metasploit(For Windows users)

Thanks For Reading

Keep Visitng :- Indicyborg

Read More

How to Install and Configure Best Network Scanning Tool Nessus - Scan Network Vulnerabilities In Backtrack

Vulnerability scanning has always played a vital part to strengthen the security of the server at which your useful sites are hosted. It can also be used to scan the security of the computer which is connected to the internet. It basically scans the open ports and then checks for the vulnerabilities present in the services running on those ports.It is always useful for a server admin or else of any system to be aware of the weak points of the server security so that he may make it a hack proof system. That's why I decided to post a tutorial on this site to help you all scan for the weakness in accordance with the latest increasing available exploits.I suggest using backtrack as every thing is already cooked up there. In any other Linux you may have to install all the packages first.

Installing Nessus in Linux:-

Download the Nessus from the official site. Run the following commands under the terminal, If it's present in Downloads:-

cd /root/Downloads (replace root with the username using which you have logged in)dpkg -i Nessus-4.4.1-ubuntu1010_i386.deb
Note:- "Nessus-4.4.1-ubuntu1010_i386.deb" is the name of downloaded .deb file. It depends on your version and name of the downloaded nessus version.

Registering and Setting up Nessus:-

Lets start this part.
I am using "Backtrack 5 r1", So, here I shall go to (A little bit of further effort may tell you how to configure that in any other Linux, as its not much different. Except the menus might be different) Applications>Backtrack>Vulnerability Assessment>Vulnerability Scanners>Nessus>Nessus Register .



Browser will popup and there it will give you choice whether to use nessus at home or at commercial level. For commercial use you have to purchase a license. So, I am assuming you want to use it at home. Thus select "Using Nessus at home" and next click agree at next page.



There provide your email address and then login into your email account and there you have to verify it for nessus and get the activation code needed. Copy that code provided in email which is in the format of xxxx.xxxx.xxxx.xxxx.xxxx



Open up the terminal and there write following command:-
/opt/nessus/bin/nessus-fetch --register xxxx.xxxx.xxxx.xxxx.xxxx
So, press enter, wait for nessus to fetch newest plugins to scan vulnerabilities and after that your nessus is registered and is ready to be used. Close the terminal.



Now again to go the panel and Applications>Backtrack>Vulnerability Assessment>Vulnerability Scanners>Nessus>nessus user add. There terminal will popup and then write your username there (Any which you may like) and press enter and write down the password.(Password characters may not be shown not even dots. So, don't worry just write the password),If it asks to give admin privileges in terminal type "y" and press enter. If it asks for any rules then just press enter. And in end it will ask for confirmation type "y" and hit enter.



Now, lets start nessus. Applications>Backtrack>Vulnerability Assessment>Vulnerability Scanners>Nessus>Nessus Start and click it. Terminal will popup showing starting Nessus.



Open up Mozilla (In my case mozilla worked well than chrome. Flash plugin must be pre-installed in browser.). Navigate to :- https://127.0.0.1:8834 and if it asks for exeption just add one. And let the nessus load. After loading just put the username which you have selected in step number 5 earlier and also type the password chosen there. Hit login and you have a working nessus.

Thanks For Reading 

Keep Visting :- Indicyborg

Read More

Acunetix web vulnerability scanner Version 8 Full Version

Here is the Worlds best and most popular Vulnerability scanner...full version download

Steps to get full version of Acunetix web scanner v8 for free

At First got to this link and download acunetix scanner

http://www.acunetix.com/download/fullver8

ID: acunetixwvsfullv8
Password: nFu834!29bg_S2q


Then install it do not open it

If opened Closed it :P

Open patch and click on patch

Now open Acunetix you will be asked for some details

Enter below details
 
License Key: 2e3b81463d2s56ae60dwe77fd54f7d60
Name: Hmily/[LCG]
ComPany: Www.52PoJie.Cn
Email: Hmily@Acunetix.com
Telephone: 110

Thanks For Reading

Keep Visitng :- indicyborg

Read More

Penetration Tool : Maxsqli syntex maker tool MySQL injection

This tool helps hackers/pentesters to create sql syntax. Its also help in waf bypass sql injection method.

This is small program for those who hate typing :D.
it helps you build syntax for MySQL injection.
It supports basic MySQL injection and error based injection.
Just follow help inside the program and you won't have any problems.
If you find bugs then email on : maxonebt4@gmail.com.
Created By Danijel Maxa MaXoNe.Its a virus free program .Tool is compressed with free exe compressor and thats why it's detected as Pak_Generic.

Download : from here

Video Tutorial :

Thanks For Reading Keep Visting :- indicyborg

Read More

SQL Injection Tool Havij v1.15 Advanced SQL Injection

Today i am posting one of the best sql injection tool know as Havij...
Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.
The power of Havij that makes it different from similar tools is its injection methods.
The success rate is more than 95% at injectiong vulnerable targets using Havij.
The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.

Download It

To download
Cracked Versions :  Click Here

Steps to register

1.Run Havij.exe
2. Once it opens you will see register..
3. Click Register
Make sure you are connected to the internet
4. Under Name:
You write: Cracked@By.Exidous
5. Under File:
You select the folder where you are currently running the Havij program from and select Havij Key
6. Done....

Thanks For Reading.

Keep Visitng :- Indicyborg

Read More

Free download FBI Inspection Tool worlds most Wanted Software

This a pack of system tools which are used by FBI to analyse and inspect other computers. These must be used only educational purpose, please don't misuse the tools.
These tools are worlds most wanted software now its for free...
these tool is being used by FBI For performing computer forensics activity.

Tools that are included in this pack are:

ADS Locator (Alternate Data Streams)
 
Historian 1.4 (Browser Analyze)
 
Disc Investigator 1.4 (File-Slack-Analyze)
 
Live View 0.6 (System Analyze)
 
MUI Cacheview 1.00 (Registry Analyze)
 
Network miner 0.85 (Network Analyze)
 
Regripper 2.02 (Registry Analyze)
 
System report 2.54 (PC Analyze)
 
USB-History R1 (USB-Stick-Analyze)
 
Windows File Analyzer (File Analyze)
 
Winpcap 4.02 (Network)

Now comes the download link part download it from link below.

FBI Internet Tool

Torrent download link

Read More

Remote Administrator with ProRat v1.9

Prorat is one of RAT (Remote Administration Tools) are widely used to take over the computer system. Tool made by PRO Group, a group of Turkish hackers community, can be used as a tool Hacking computers in a network. Use of Prorat quite simple, you simply enter the IP (Internet Protocol) is the target computer and then go through one open port. The hardest part is finding where an open port. But you can use a variety of network analysis tools such as nmap, Ethercap, LookHost, etc.

Here are the features provided by PRORAT:

- Remote Control

- Viewing System Info, application running and the Task Manager

- Add process, file, or download files

- Admin FTP

- Format the HDD (hard disk damage)

- Remotely download

- Running MS-DOS, Batch Script, VBScript

- Adding a Registry Entry

- Keylogger: Password Recording

- Make Screnshoot, see your Windows desktop instantly

- Send messages and chat

- Shutdown, Restart, Control Panel, IExplorer, Registry, Printer and Online Controls

Download here

Read More

Top 15 Security/Hacking Tools & Utilities Tips, Hacks

1. Nmap
Nmap (“Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free and open source.
Can be used by beginners (-sT) or by pros alike (–packet_trace). A very versatile tool, once you fully understand the results.
Get Nmap Here

2. Nessus Remote Security Scanner
Recently went closed source, but is still essentially free. Works with a client-server framework.
Nessus is the world’s most popular vulnerability scanner used in over 75,000 organizations world-wide. Many of the world’s largest organizations are realizing significant cost savings by using Nessus to audit business-critical enterprise devices and applications.
Get Nessus Here

3. John the Ripper
Yes, JTR 1.7 was recently released!
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.
You can get JTR Here

4. Nikto
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).
Nikto is a good CGI scanner, there are some other tools that go well with Nikto (focus on http fingerprinting or Google hacking/info gathering etc, another article for just those).
Get Nikto Here 

5. SuperScan
Powerful TCP port scanner, pinger, resolver. SuperScan 4 is an update of the highly popular Windows port scanning tool, SuperScan.
If you need an alternative for nmap on Windows with a decent interface, then you check this out, it’s pretty nice.
Get SuperScan Here

6. p0f
P0f v2 is a versatile passive OS fingerprinting tool. P0f can identify the operating system on:
– machines that connect to your box (SYN mode),
– machines you connect to (SYN+ACK mode),
– machine you cannot connect to (RST+ mode),
– machines whose communications you can observe.
Basically it can fingerprint anything, just by listening, it doesn’t make ANY active connections to the target machine.
Get p0f Here

7. Wireshark (Formely Ethereal)
Wireshark is a GTK+-based network protocol analyzer, or sniffer, that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and to give Wireshark features that are missing from closed-source sniffers.
Works great on both Linux and Windows (with a GUI), easy to use and can reconstruct TCP/IP Streams! Will do a tutorial on Wireshark later.
Get Wireshark Here

8. Yersinia
Yersinia is a network tool designed to take advantage of some weakeness in different Layer 2 protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems. Currently, the following network protocols are implemented: Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), Dynamic Host Configuration Protocol (DHCP), Hot Standby Router Protocol (HSRP), IEEE 802.1q, Inter-Switch Link Protocol (ISL), VLAN Trunking Protocol (VTP).
The best Layer 2 kit there is.
Get Yersinia Here

9. Eraser
Eraser is an advanced security tool (for Windows), which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns. Works with Windows 95, 98, ME, NT, 2000, XP and DOS. Eraser is Free software and its source code is released under GNU General Public License.
An excellent tool for keeping your data really safe, if you’ve deleted it..make sure it’s really gone, you don’t want it hanging around to bite you in the ass.
Get Eraser Here.

10. PuTTY
PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator. A must have for any h4x0r wanting to telnet or SSH from Windows without having to use the crappy default MS command line clients.
Get PuTTY Here.

11. LCP
Main purpose of LCP program is user account passwords auditing and recovery in Windows NT/2000/XP/2003. Accounts information import, Passwords recovery, Brute force session distribution, Hashes computing.
A good free alternative to L0phtcrack.
LCP was briefly mentioned in our well read Rainbow Tables and RainbowCrack article.
Get LCP Here

12. Cain and Abel
My personal favourite for password cracking of any kind.
Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort.
Get Cain and Abel Here

13. Kismet
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic.
A good wireless tool as long as your card supports rfmon (look for an orinocco gold).
Get Kismet Here

14. NetStumbler
Yes a decent wireless tool for Windows! Sadly not as powerful as it’s Linux counterparts, but it’s easy to use and has a nice interface, good for the basics of war-driving.
NetStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g. It has many uses:

• Verify that your network is set up the way you intended.
• Find locations with poor coverage in your WLAN.
• Detect other networks that may be causing interference on your network.
• Detect unauthorized “rogue” access points in your workplace.
• Help aim directional antennas for long-haul WLAN links.
• Use it recreationally for WarDriving.

Get NetStumbler Here

15. hping
To finish off, something a little more advanced if you want to test your TCP/IP packet monkey skills.
hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.
Get hping Here

Read More

Hacking Software - oclHashcat-plus v0.08

What is oclHashcat-plus v0.08 ? oclHashcat-plus v0.08 worlds first ''GPU" based rule engine.It is also the worlds fastest phpass, mscash2,md5crypt and WPA/WPA2 cracker.

Description - oclHashcat-plus v0.08 ius an advanced password hacking software which is highly efficient and works faster than any other software of it's genre.There are a number of algorithms implemented in it and it has many features which make it the best software available for password cracker.

Some of it's Features 

1.Multi-GPU (up to 16 gpus)

2.Multi-Hash (up to 24 million hashes)

3.Multi-OS (Linux & Windows native binaries)

4.Multi-Platform (OpenCL & CUDA support)

5.Supports reading words from file.

6.Supports reading words from stdin

7.Integrated thermal watchdog And many more..

Algorithms implemented - 

1.Joomla.
2.MD5.
3.Oracle 11g.
4.MSSQL - 2000.
5.MSSQl -2005.
6.MySQl.
7.Phpass.
8.Oracle 7-10g.
9.SHA256.
10.NTLM.
11.MD4.
12.OSX10.7.
13.CISCO-PIX MD5.
14.Double MD5.
15.SSHA.
16.SHA-1(Base64), nsldap, Netscape LDAP SHA.
17.SSHA-1(Base64), nsldaps, Netscape LDAP.
18.DCC,mscash.
19.OSX v10.4, v10.5, v10.6.
20.SHA1.

Modes of Attack- 

1.Straight 
2.Combination
3.Brute-force
4.Permutation
5.Hybrid dict + mask
6.Hybrid mask + dict


Cracking a WPA handshake with OclHashcat-Plus(Video)

Read More