Hackers Cafe: Hacking Tricks

Showing posts with label Hacking Tricks. Show all posts

Wednesday, September 7, 2011

Huge Collection & Compilation of Internet Tutorials, Tips & Tricks!

Hello Everyone, I've got these massive collection of Internet Tutorials, Tips & Tricks!, and now, I've thought that it would be delightful if I'll share it with you.

All credits goes to the creator of the softwares used.

If you want your tutorials to be added, fillup the form below.

Code:
[color=lime][b]Tutorial Title:[/b][/color]
[color=lime][b]Tutorial Link:[/b][/color]
[color=lime][b]Username:[/b][/color]
[color=lime][b]Username Link:[/b][/color]

Saturday, March 12, 2011

Learn Basic JavaScript Hacking: How to Hack with Java Script

Basic JavaScript hacking

LEVEL 1
You must first obtain the "source code": Set the security of Internet Explorer to high, click on the link to level 1 at the very top of the menu bar, Internet Explorer, the File, Edit, View, etc. Press the "View", "Source".This will take it up a Notepad window. Look for:

passwort=prompt("Please enter password!","") passwort = prompt ( "Please enter password !","")

This ensures a prompt box you can write in, that you enter as a password is stored in the variable "passwort".

if (passwort=="easy") if (passwort == "easy")

This checks on "passwort" (what you type) is "easy", the password for level 1 is when the "easy".

Set back security to medium and click on the link to the Level 1and type "easy".

Use the same procedure to obtain the "source code".

LEVEL 2
Once you have retrieved the Notepad window, there will be a lot of code. Just scroll further down, find this:

var m1, i; was m1, i;
m1="JavaScript"; m1 = "JavaScript";
value=prompt("Please enter password!",""); value = prompt ( "Please enter password !","");
if (value==m1) { if (value == m1) (
window.location=value+".htm"; window.location = value + ". htm";
i=4; i = 4;

What you type being stored in the variable "value",

if (value==m1) if (value == m1)

"m1" is a variable that contains a value. See further up:

m1="JavaScript " m1 = "JavaScript"
The password is "JavaScript".

How to add 1-999 Fake Subscribers onto your Youtube Channel

What you need:

- A Youtube Account
- Inspect Element Option (Firebug [firefox] ect..)

Step 1.
Goto your Youtube Channel and find 'Themes and Colours'
Choose any colour and then select 'Show Advanced Options'

Step 2.
Right click on the Drop down box where the fonts are showing
and select Inspect Element (This is why you need firebug ect.)
You should then see something a little like this:

Step 3.
Right click on the (in blue) and press Edit at HTML. then change it to look just as:
Hackforums
Then go back on the Select font drop box and you should see a "Hackforums" like below:

Select this and press 'Save Changes'

Step 4.
You should now see all the text on your channel is bold
Now goto 'Modules' next to Themes and Colours and UN-TICK the "Subscribers" and "Subscriptions" box's
~Save changes

Step 5.
Scroll down until you see 'Profile' and press the Edit button.

I already done the subscriber thingy on this account thats why this shows 800 and odd subs
Now on edit you should see an option in the box called 'Channel Description:' Enable this if not already enabled and inside the box you MUST copy and paste the following:

Subscribers: 828
You can change the last 3 numbers but NOTHING else, as the spaces inbetween "Subscribers" and the Number "828" are not actual spaces.

Final time to press Save changes and you should have a good fake amount of subscribers.
.................................................................................................................................................................

Learn How to EXPLOIT : The Basics of EXPLOITING

NOTE: Some statements in here apply to beginners. If you read this and are an advanced user, you might say: "That is not true, I know a way....". Correct. But it is impossible to include every exception and technique without creating confusion. Read this essay as if you are a beginner....

NOTE 2: Some basic rules all good crackers and exploiters adhere to: Do not change, alter, or delete any info you may find on a site. This is just not done, and can actually
result in prosecution if you get caught.

On your exploiting journey, you may also come across confidential information from members, such as home addresses, credit card info etc. I know I have, many times over. I even found a hole where I could have the checks of site referrals sent to my account! Never use this information to your personal gain! This will be considered theft and misuse of personal information, and can get you into serious trouble...

OK, now with that out of the way, let's start the series on Exploiting...!

EXPLOITING - THE BASICS

OK, so you are tired of bruteforcing, have spoofed a couple of sites, and have seen posts with custom passes or complete member lists...and you wanna know how... If so, this essay is for you.

This basic exploiting essay assumes you understand or master the following techniques and skills with respect to website security:

- Basic HTML
- Brute forcing
- Proxy use
- Basic URL handling
- Basic website structures
- Basic Spoofing
- Good AD skills or similar

But most importantly, you need a good brain and have a sincere interest in website security. Exploiting takes a lot of time and requires research on a regular basis. On the other hand, the rewards are well worth the effort in my opinion!

When trying to test the security of websites, you can gain access in the following manners, listed in order of technical difficulty:

1. Guess passwords
2. Brute force attacks
3. Spoof the site
4. Get and decrypt passfiles or logs
5. Using scripts to add passes
6. Get admin access (via telnet or browser)
7. Hack the server via telnet

As you can see in the list above, exploiting is really nothing more than increasing your chances of getting access. Guessing passwords...to bruteforcing...to decrypting passfiles or logs...you increase your chances of getting a working pass with less effort!

HTACCESS and HTPASSWD

Since there are excellent tuts on this already, I am not going to spend a lot of time on this. One question I see a lot from newbies is that they "can not locate the htpasswd"....

A few notes on htaccess and htpasswd:

- htaccess only sometimes shows the dir to the htpasswd (or passwd or different name)
- the chances of getting this file are slim, as this vulnerability is well-known out there and most webmasters have denied you access, hidden the file, or placed the file on their home dir.

For the fans, here is some more detailed info on the subject I found:
In order to find the .htpasswd (or interpret the .htaccess) you need to understand the difference between the web root and the system root.

The AuthUserFile is specified in terms of the system root. That is, the directory structure you would see if you were actually logged into the computer through a terminal.

When a web browser accesses a machine, it is through a web server. The web server is configured so that the browser will start at some specific directory in the machine. I refer to that as the web root. It is specified in the web server configuration file, off in some directory you can't browse to.

So, lets say that the web root is set to /home/users/www.site.com/www. When you surf to http:/www.site.com/ you find yourself in the machine directory /home/users/www.site.com/www (but nothing really tells you that), and if there is an index.html there, you will display it.

So lets say that the web root is set as above, and that the .htaccess contains the line:

code:
--------------------------------------------------------------

AuthUserFile /home/users/www.site.com/www/hidden/.htpasswd

--------------------------------------------------------------
(or something similar)

Applying what I said above, you would find the .htpasswd at:

code:
--------------------------------------------------------

http://www.site.com/hidden/.htpasswd

--------------------------------------------------------

Since the web root is /home/users/www.site.com/www. You still may not be able to read it because it might be forbidden through some other method, say only accessible from certain IP addresses, or . files are not accessible through their web server.

Now, lets say the .htaccess said:

code:
--------------------------------------------------------------

AuthUserFile /home/users/abc.com/hidden/.htpasswd

--------------------------------------------------------------

Now, there is no way we can get to it since the web root puts us in home/users/www.site.com/hidden/www and we are well past the days when you could back up above a web root in an Apache web server.

If ../ worked, we would be in luck, since we could specifyhttp://www.site.com/../hidden/.htpasswd. This used to work, or the unicoded version worked, or the double unicoded version worked, or quotes worked, or unicoded quotes, etc., etc. Not so anymore....

Our only hope, when the .htpasswd is not on the web root, is to find another exploit that will allow us to access files. Such things exist but are hard to find, so read on....

SO NOW WHAT?
Well, as you tried to get the passfile looking for it in the obvious locations, and failed...maybe there are other ways of obtaining it....

Using AD or another security scanner, you can start looking for so-called vulnerabilities. This means testing the website for security, and trying to find ways into the site. How does this work, you ask? We need a tool to test the security...

For these essays, I will be talking about a tool called WebSiteFinder, or WSF in short. Written by Wolfman, this is a great tool, in my opinion. AD or Passcraft can do the same, so use whatever you feel comfortable with. If you start out, use AD.

To make these tools really effective, you need an exploit list. This is a list of basic paths that will be tested for possible vulnerabilities or access against the website. AD offers a basic exploit list, at least the older versions did. Exploit lists can be found all over the web, but please realise these are very basic, and some of the holes (=vulnerabilities) they have in it, are old and will not work anymore on most sites.

HOW TO MAKE YOUR OWN EXPLOIT LIST
Really good exploiters or crackers will not share their lists with you. The reason: Once some exploits are made public, chances are the holes will be discovered quickly and thus closed! And that is a bummer.

So you have to build your own list. How, you ask? Here are a few tips.

1. ANALYZE, THINK, STUDY, BE CREATIVE
First place to start, is to analyze your current exploit list. What makes sense, and what does not. What paths do you understand? Why do you think that particular path is a vulnerability, and if you came accross it, how would you use it? If you don't know, ask on a forum via PM, there are many people around that can and will help you. Moreover, read up on security sites (better get used to it), such as packetstorm, securiteam, etc.

NOTE: It is no use to just try exploits on sites if you don't understand what you are doing. The results can be very bad. You could, unwillingly, do damage to the site!

2. KEEP YOUR EYES ON THE SCREEN
Look at directory trees of sites you visit. Try to go up and down in levels in the dir to possibly find more holes...copy these to your exploit list.

3. STATS and LOGS
These are KING in my book. Why? Stats show the requests made to a website, and some stats list all the requests....including those of someone trying to exploit the site. The paths that this person tried may not have worked on the site, but heh, copy them to your exploit list, they may come in handy for other sites! Access logs show the same thing...moreover, they might tell you alot about the server, home server (FTP logs), usernames, and the basic website structure.

INTERMEZZO: "What to do with the usernames?"
This is a question I get a lot. Someone has seen the stats, and now has a list of usernames. Now what? Well, half the battle is won! Remember the statement I made about increasing your chances in getting access? This is it! Proceed in two ways:
1. Use the usernames and one of your wordlists to do a BF attack
2. Match the usernames to working combos you have. There are tools for this, and try to see if the combos work. Many users use the same password for different sites...see where I am getting at?

4. GOOGLE, GOOGLE, GOOGLE!
I love google. I embrace googling. You should too. Make googling your hobby! Type in a path or exploit, and see what you get, you will be surprised! It will lead you to access logs, vulnerability reports, cool sites, etc. Whatever you find and think is useful, copy to your exploit list...

.....................................................................................................................................................................................................................

..............................................................................................................................

Monday, February 21, 2011

Sharecash Direct download.

How to use it:

This is coded in VB.NET so it requires .NET Framework to run. It also requires Internet Explorer installed.

First, open the $harecash Downloader and then type the mirror link in the textbox.

Then press "Navigate" and wait for 10-15 seconds.

Then press "Download" and your file should be download.

Screenshot:

Download link:

Code:

http://uppit.com/5r6q0j3nvgr0/Downloader.rar

Code:

or
http://uploading.com/files/dc94m59f/Downloader.rar/

Monday, November 22, 2010

WINDOWS SHORTCUTS

Here are some windoes shortcut keys
Windows Shortcuts keys
Alt + E — Opens the Edit menu
Alt + Enter — Opens the Properties window
Alt + F — Opens the File menu
Alt + F4 — Closes the current program
Alt + Print — Screen Takes a screen shot of the current window or program
Alt + Tab — Switches between the programs currently in use
CTRL+TAB — SWITCHES BETWEEN TAB IN DIALOG BOX,I.E 7
Ctrl + A — Selects all text
Ctrl + C — Copies the selected object
Ctrl + End — Jumps to the end of the current document
Ctrl + Esc — Opens the Start menu
Ctrl + F4 — Closes the current program
Ctrl + Home — Jumps to the beginning of the current document
Ctrl + Insert — Copies the selected object

Ctrl + left arrow — Moves to the left one word
Ctrl + right arrow — Moves to the right one word
Ctrl + V — Pastes the selected object
Ctrl + X — Cuts the selected object
Ctrl + the “+”key — Perfectly resizes the width of Explorer columns
End — Jumps to the end of the current line
F1 — Opens the Help menu
F2 — Renames the selected icon
F3 — Launches the Search Companion in a folder or on the
desktop

F4 — Accesses the Address Bar in a folder or window
F5 — Refreshes the contents of a folder or window
Home — Jumps to the beginning of the current line
Shift + Delete — Permanently deletes files (bypasses the Recycle Bin)
Shift + End — Highlights text from the current position to the end of
the line
Shift + F10 — Substitutes for a right-click
Shift + Home — Highlights text from the current position to the
beginning of the line
Shift + Insert — Pastes the selected object
Shift while inserting — Prevents the CD player from playing an audio CD

Shortcuts for Keyboards with a “Windows”Key (Resembling a Flag)

Windows Key + E — Opens Windows Explorer
Windows Key + F — Launches the Windows Search Companion
Windows Key + F1 — Opens the Help and Support Center
Windows Key + L — Locks down Windows
Windows Key + M — Minimizes all windows and shows the desktop
Windows Key + M + Shift — Undoes the minimize
Windows Key + Opens — the System Properties window
Pause/Break key
Windows Key + R — Opens the Run window
Windows Key + U — Launches the Utility Manager
WINDOWS KEY+U — MINIMIZES ALL WINDOWS AND GOES TO DESKTOP

Hackers Cafe

Infolink

Wednesday, September 7, 2011

Huge Collection & Compilation of Internet Tutorials, Tips & Tricks!

Saturday, March 12, 2011

Learn Basic JavaScript Hacking: How to Hack with Java Script

How to add 1-999 Fake Subscribers onto your Youtube Channel

Learn How to EXPLOIT : The Basics of EXPLOITING

Monday, February 21, 2011

Sharecash Direct download.

Monday, November 22, 2010

WINDOWS SHORTCUTS

WINDOWS SHORTCUTS

Links