XPath injection

The XPath attack
Generally, most Web applications use relational databases to store and retrieve information. For example, if you have a Web site that requires authentication, you might have a table called users with a unique ID, a login name, a password, and perhaps some other sort of information like a role. A SQL query to retrieve a user from a users table might look like Listing 1.

Read more…

Blind & Classic SQL Injection

In this tutorial i will describe how sql injection works and how to use it to get some useful information.
First of all: What is SQL injection? It's one of the most common vulnerability in web applications today. It allows attacker to execute database query in url and gain access to some confidential information etc...(in shortly).
1.SQL Injection (classic or error based or whatever you call it)
2.Blind SQL Injection (the harder part) So let's start with some action
1). Check for vulnerability Let's say that we have some site like this

Read more…

How to Hack Wireless Router Passwords & Networks Using Hydra

Step 1 Download & Install Hydra
First we need to go to the Hydra website, download Hyrda, and get everything configured. In this article, a "cmd" refers to a command that has to be entered into a terminal emulator.

1. Download Hydra from THC's website.
2. Extract Hydra in a nice location.
   

Read more…

How To Symlink a Server

1 .we have a shell in a linux server and is Safe Mode OFF , if its not off Off put the file php.ini , and Disable Functions : None

Code:

http://www.website.com/shell.php
 
and directory :

/home/ueb/public_html/

Read more…

DNS Hijacking

This is an introduction to DNS poisoning which also includes an example of quite a nifty application of it using the IP Experiment. It’s purely educational, so I’m not responsible for how you use the information in it.
To start, you’ll need
• A computer running Linux (Ubuntu in my case)

Read more…