Reply to thread

Message: <blockquote data-quote="help4u" data-source="post: 11373198" data-attributes="member: 326991">ain kalooooooooo .......joke ekakne ... mawa hire danna epa...elakiri joke ne meka......<img src="/styles/default/xenforo/smilies/default/shocked.gif"  class="smilie" loading="lazy" alt=":shocked:" title="Shocked    :shocked:" data-shortname=":shocked:" /><img src="/styles/default/xenforo/smilies/default/shocked.gif"  class="smilie" loading="lazy" alt=":shocked:" title="Shocked    :shocked:" data-shortname=":shocked:" /><img src="/styles/default/xenforo/smilies/default/shocked.gif"  class="smilie" loading="lazy" alt=":shocked:" title="Shocked    :shocked:" data-shortname=":shocked:" /><img src="/styles/default/xenforo/smilies/default/shocked.gif"  class="smilie" loading="lazy" alt=":shocked:" title="Shocked    :shocked:" data-shortname=":shocked:" />WebHacking Basics For All Starters By NPJBy @P3X Pr34at0rHello, this is just a short article about webhacking and the basics (mostly tips).There’s not much to say, so here I’ll start…1. Check for robots.txtUsually the directory is hxxp://www.targetsite.com/robots.txtThis can contain plenty of information. Even though not all sites have it.robots.txt is used to restrict the Google bot’s access in certain parts of a forum or a website.It looks like this:User-agent: *Disallow: /forum/admin.phpDisallow: /forum/moderator.phpDisallow: /forum/include.phpetc.2. Check if site is vulnerable to SQL injectionsThis can be checked with a simple apostrophe at the end.For example, hxxp://www.targetsite.com/news.php?id=1′If the page displays an error, then the site is vulnerable.You may now proceed on injecting more queries and drawing various information.3. Check for common directoriesSometimes site administrators forget to rename the dirs and leave them as default.It’s good to check for these directories as they can contain version info and other stuff that helps you determine if the site is vulnerable.Common diretories are:adminadmincpmodmodcpmoderatorincludeincludeslogstmpinstall4. Port scanningGathering information about the server can also be useful.Ping the site in cmd (you MUST know how to do this, if you don’t, then just leave) and scan the IP (and no, don’t limit the scan to 6000 as usual, f.ex 8080 is a common web port).Don’t forget to check the site with nslookup, MaXe’s DNS guides cover this.With this information you can figure out if the site has vulnerabilities and stuff.Now you can connect with the open port threw telnet. The syntax is telnet IP(or hostname) port. For example, telnet google.com 25.For example, if the site has port 25 open, which is the SMTP (Simple mail transfer protocol) we can send emails threw the server.Or even better, imagine there’s port 3306 open. That’s the SQL port. Threw this you can access the site’s SQL database.Download MySQL or something and try to clear your way in. You can try various combinations, like:admin adminadmin rootroot rootroot adminAnd so on. Though it’s quite possible that you won’t get anywhere guessing, so your best bet would be bruteforcing, dictionary attacks, rainbow tables or whatever can you afford.5. Cookie poisoningEven though most sites nowadays filter this, it wouldn’t hurt to try.We will do this…with javascript.It’s quite simple. Try this in the address bar.javascript:alert(document.cookie);In some cases this may spit out your username and password.This is the part where you try the famous line…javascript:void(document.cookie=”username=’OR’1′=’ 1″); void(document.cookie=”password=’OR’1′=’1″);Similar to SQL injection, you guessed it.6. Check if site is vulnerable to XSSXSS and javascript together open up a huge horizon of possibilities and a whole lot of new places to discover.Check if the site is vulnerable by typing this in a webform or something.<script>alert(“NPJ Vulnerable”)</script>If site is vulnerable, then you will get a popup box saying awdwdadwd (yes this was random).</blockquote>

Verification: Hath warak paha keeyada? (hatha wadikireema paha)

Top Bottom