[WarFarMa]

Learn the vulnerability xss & sqli & rfi & lfi basing vuln

[WarFarMa]

Learn the vulnerability xss & sqli & rfi & lfi basing vuln

[WarFarMa]

Learn the vulnerability xss & sqli & rfi & lfi basing vuln

[shirofuji]

get access to the ftp server of the website, edit the files inside the folder that contains, php and html files. Its not easy to do it on a real website. but if you have your own website you can try scanning it with nmap, brute-force the ftp login. and then once you get the login credentials you have access to the php and html files. this is much useful because you can also execute php codes that could harm the system.

you would need the ff to to what i said above:
nmap
thc-hydra
a good list of possible passwords written in a textfile
a lot of time
a lot of effort

[Snow_mybb_import12418]

hmm you can use exploit 'upload shell' it's verry easy for you

[ART33R]

Remember that not all sites that allow you to upload shell text files with php-format, only image formats such as JPEG, GIF, so you must therefore utilize the upload page to allow you to upload php shell / php files with Tamper Data or HTTP Live Headers,That are Firefox Addons
(You can choose which one you will use, it doesn't matter) which means you must have Firefox as the browser for you to install these addons and take into use. If you are wondering how to upload shell using Tamper Data / Live HTTP Headers.
Here are some tutorials:
http://www.breakthesecurity.com/2012/11/...-hack.html
http://exploiterz.blogspot.no/2013/07/ho...-adon.html
~ Regards ART33R

[shirofuji]

Here's what I do when I want to deface a site.

1. scan for open ports on the website. small sites have port 21 (ftp) or port 22 (ssh) or port 3306 (mysql) open.
2. if i see those port open i try to bruteforce passwords for root.
3. while waiting for brute force results or if ports are not open then i try sql injection
4. if sql injection fails i try to find other vulnerabilities on the server.
5. worst case scenario would be no vulnerabilities are exploitable on the server, in that case I would create a virus and wait for it to reach the server.

[Royal_Tr1ck]

there are so many post online to learn. manual sqli is incredibly fun. its like a chess game, but you can always start with havij just torrent it and try it out. Good Luck

[rahulyhg]

check havij tutorial here.

[mothered]

check havij tutorial here.

A friendly heads-up on what this board considers grave digging.