If you want to fool your friend or colleague, then you can use this simple java script to hack any web site.
Just copy and paste this JavaScript code in the address bar of your web browser and hit enter, and any web page/ web site will become editable just as a notepad/MS Word document.javascript: document.body.contentEditable = 'true';document.designMode = 'on'; void 0
Other than fooling your friends, this method is useful for you too: in case your mouse stops working, you can easily place the cursor on any web page and copy the text from it !
Showing posts with label Website Hack. Show all posts
Showing posts with label Website Hack. Show all posts
This tutorial is an overview of how javascript can be used to hack website and bypass simple/advanced html forms and how it can be used to override cookie/session authentication.
SIMPLE HTML FORMS
1. Bypassing Required Fields
Surely you have met a webpage that requires you to fill all fields in a form in order to submit it. It is possible to bypass these types of restrictions on any webpage. If you take a look at the webpage's source and follow it down to the form's code, you will notice the onsubmit form attribute. Hopefully by this time you have experienced the power of javascript and you know that javascript has control over every single element in a webpage, including forms.We can use javascript to our advantage in every page we view for we can modify, delete, or add any element to the webpage. In this case we wish to clear the form's onsubmit attribute in order for the form to be submitted successfully.
The onsubmit attribute generally points to a function that checks the form to have the correct format. A function that does this may look something like this:
function formSubmit(x)
{
if(x.email.value=="") return false;
return true;
}
...
form name="spamform" method="post" action="process.php" onsubmit="return formSubmit(this);"
...
/form
I will not go into great detail about how the formSubmit function works. You should know that if the (textfield/optionfield/option/..) field is left blank, the form will not be submitted to process.php. Now comes the moment of truth, how do we modify the form so that onsubmit returns true everytime? The way we can access the form with javascript and do this is:
document.forms[x].onsubmit="return true;";
or
document.spamform.onsubmit="return true;";
Both of these 'queries' will allow you to submit the form free of restrictions. The secret is how to execute this. I do this using my browser's Location bar. All you have to do is enter this text into the location bar and press enter:
javascript:document.spamform.onsubmit="return true;";
The above statement will not work because the 'query' will return a value javascript doesn't know what to do with it so it dumps the returned value on the screen. We need a way to use this value and escape it from passing on to javascript. I know the exact way to do this, with alert()!
javascript:alert(document.spamform.onsubmit="return true;");
You will see an alertbox with "return true;" instead of dumping this value out to the webbrowser. Once you have executed this query you will be able to enter whatever value into whatever field in spamform.
2. Changing Fields' Values
If you have managed to change a form's onsubmit attribute to let you do whatever the (filtered) you want, what are the limits? Of course now you know that you can modify the onsubmit attribute of a form from the location bar, same goes for any attributes of any object in the page. This is how you can do it:
javascript:alert(document.spamform.fieldname.value="Dr_aMado was here!");
or
javascript:alert(document.forms[x].fieldname.value="Dr_aMado was here!");
But of course, you already knew that. Didn't you? You can change the values of pretty much anything inside a form, including radios, checkboxes, selects, hidden values, buttons, anything!
Enjoy HaCkInG.....
Hacking website with Javascript.
0diggsdigg
This tutorial is an overview of how javascript can be used to hack website and bypass simple/advanced html forms and how it can be used to override cookie/session authentication.
SIMPLE HTML FORMS
1. Bypassing Required Fields
Surely you have met a webpage that requires you to fill all fields in a form in order to submit it. It is possible to bypass these types of restrictions on any webpage. If you take a look at the webpage's source and follow it down to the form's code, you will notice the onsubmit form attribute. Hopefully by this time you have experienced the power of javascript and you know that javascript has control over every single element in a webpage, including forms.We can use javascript to our advantage in every page we view for we can modify, delete, or add any element to the webpage. In this case we wish to clear the form's onsubmit attribute in order for the form to be submitted successfully.
The onsubmit attribute generally points to a function that checks the form to have the correct format. A function that does this may look something like this:
function formSubmit(x)
{
if(x.email.value=="") return false;
return true;
}
...
form name="spamform" method="post" action="process.php" onsubmit="return formSubmit(this);"
...
/form
I will not go into great detail about how the formSubmit function works. You should know that if the (textfield/optionfield/option/..) field is left blank, the form will not be submitted to process.php. Now comes the moment of truth, how do we modify the form so that onsubmit returns true everytime? The way we can access the form with javascript and do this is:
document.forms[x].onsubmit="return true;";
or
document.spamform.onsubmit="return true;";
Both of these 'queries' will allow you to submit the form free of restrictions. The secret is how to execute this. I do this using my browser's Location bar. All you have to do is enter this text into the location bar and press enter:
javascript:document.spamform.onsubmit="return true;";
The above statement will not work because the 'query' will return a value javascript doesn't know what to do with it so it dumps the returned value on the screen. We need a way to use this value and escape it from passing on to javascript. I know the exact way to do this, with alert()!
javascript:alert(document.spamform.onsubmit="return true;");
You will see an alertbox with "return true;" instead of dumping this value out to the webbrowser. Once you have executed this query you will be able to enter whatever value into whatever field in spamform.
2. Changing Fields' Values
If you have managed to change a form's onsubmit attribute to let you do whatever the (filtered) you want, what are the limits? Of course now you know that you can modify the onsubmit attribute of a form from the location bar, same goes for any attributes of any object in the page. This is how you can do it:
javascript:alert(document.spamform.fieldname.value="Dr_aMado was here!");
or
javascript:alert(document.forms[x].fieldname.value="Dr_aMado was here!");
But of course, you already knew that. Didn't you? You can change the values of pretty much anything inside a form, including radios, checkboxes, selects, hidden values, buttons, anything!
Enjoy HaCkInG.....
SQL injections to hack(access) website/database information
0diggsdigg
In my last post of Hacking with Javascript, i informed you about method to hack website using Javascript. Here, i have added SQL method to access database.
1. Using Forms to Your Advantage:
You probably already know about sql injection, my goal is to explain how vulnerable forms can be if not handled correctly. When targeting a system, most times you will start off with 0 code to exploit. The only thing you have is a constructed webpage to break to pieces and successfully find vulnerabilities to use to your advantage.
ACQUIRING DATABASE INFORMATION
A very logic way of acquiring system information from a website's database is by causing errors in the sql queries. These errors can be created through search forms, dynamic links, or session cookies. Most sql injection papers explain how dynamic links and text boxes can be used to execute sql queries but in my opinion, this vulnurability is more common in other input types (select boxes, hidden fields, checkboxes and radio buttons, and cookies!).
Mixing data types generally crashes a webpage if it's not well coded. Take for example a link to "memberinfo.php?o_id=1". If your goal is to crash that page it would be a good idea to stick in a " or a ' in the o_id variable. If you're lucky you will get a debug message containing the crippled sql query. After you have all the information you need and you know what you're going after you're ready to hack the hell out of every page that you have access to.
CHANGING FIELDS' VALUES
The first form you think of is the profile page. Most profile pages ignore a user's intellectuals and don't mask out,for example, select boxes. A way of exploiting this vulnerability is by injecting a sql query in the value property of the field.
javascript:alert(document.profileform.user_sex.value="gay\',user_pasword=\'HACKED\' WHERE user_id=1#");
If we assume that the server side sql query looks something like this:
"UPDATE user_data SET user_password='$user_password',user_email='$user_email',user_sex='$user_sex' WHERE user_id=$user_id";
Then the final query will look somewhat like this:
"UPDATE user_data SET user_password='mypassword',user_email='myemail',user_sex='gay',
user_password='HACKED' WHERE
user_id=1 #' WHERE user_id=7382";
# Is a sql comment operator.
2. Bypassing Session Cookies
OVERRIDING BASIC SESSION COOKIE AUTHENTICATION
Most of the time session handling is done with the use of cookies. The cookies tell the webpage who you are and what you have access to and what you don't have access to. If the page does not handle session cookies correctly a hacker might be able to change their identity to that of another user's. Cookies are stored in "window.document.cookie". With javascript we are able to erase,edit,create cookies for any website. This task is more complicated than regular types of attacks. I will not go into great detail about how it's done.
To View the Cookie:
javascript:alert(unescape(document.cookie));
To Change Cookie Data:
javascript:alert(window.c=function a(n,v,nv){c=document.cookie;c=c.substring(c.indexOf(n)+n.length,c.length);
c=c.substring(1,((c.indexOf(";")>-1) ? c.indexOf(";") : c.length));nc=unescape(c).replace(v,nv);document.cookie=n+"="+escape(nc);return unescape(document.cookie);});alert(c(prompt("cookie name:",""),prompt("replace this value:",""),prompt("with::","")));
So If You are logged in as "John Doe" in www.ima13370h4x0r.net and your session cookie reads:
SessionData=
a:3:{s:11:"SessionUser";s:5:"75959";s:9:"SessionID";i:70202768;s:9:"LastVisit";i:1078367189;}
The cookie is actually serialized but you should be able to recognize "75959" as your user_id. Some of the time you will find a website that stores data (like user_id) in cookies but does not typecast the data. This is a serious hole in the site's code because any user is able to change their user_id to any other user or administrator user_id.
Changing the cookie value is easy once you have declared the window.c function. First change s:5:"75959" to s:x:"ADMINID" where x is the length of the new value. So if you want to change 75959 to 1. You must change s:5:"75959" to s:1:"1" :-) Sometimes you will need to change 75959 to "13 or 1=1" in order to bypass any WHERE statements any sql session queries used to keep you logged in the website.
----------------------------------------------------------------------------------------
Notes:
In-line javascript statements can be added to your browser's favorites for easier access to your own functions.
It is possible to declare your own functions for use in extended hacks. Declare the function as a method of window. "alert(window.newfunction = function (){...})"
Enjoy HaCkInG.....
I was searching around the web the other day.. and i found this beautiful article informing about the method to take down a website. I found many of my visitors interested a lot in this topic of hacking a website. So, i decided to add this wonderful website hacking article. Here, method of DDOS attack is used. I have more information on hacking website in my posts Basic tutorial of Website Hacking for newbies/beginner and Hacking website with Javascript. Just check them out for more information.
So, lets start.
Hacking/Taking Down Websites:
In this tutorial, I will show you how to take down websites via DDoS. For this tutorial we will be using one of the most effective and one of the least known tools called "Low Orbit Ion Cannon", created by Anonymous members from 4chan.org, this program is one of the best for DDoS'ing, and I have successfully used it to DDoS websites. An internet connection as bad as mine (2,500 kb/s) was able to keep a site down for a day with this program running. Remember that this tool will work best with high internet speeds, and try not to go for impossible targets (like Google, Myspace,Yahoo). LOIC is used on a single computer, but with friends it's enough to give sites a great deal of downtime.
Prerequisites: Download LOIC (Low Orbit Ion Cannon). Open up LOIC.
Step 1: Type the target URL in the URL box.
Step 2: Click lock on.
Step 3: Change the threads to 9001 for maximum efficiency.
Step 4: Click the big button "IMMA FIRIN MAH LAZAR!"
Feel free to tweak around with these settings and play around with the program to get the best performance. Then minimize and go do whatever you need to do, the program will take care of the rest!
DOWNLOAD HERE: http://rapidshare.com/files/104926676/LOIC.exe
I would like to inform you that i have not yet tried this hack, so i cant tell you much about it...sorry for that. But, you can help me out by commenting your experience or even by mailing me.
Enjoy HaCkInG.....
