+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Im not a newbie, but i have a newbie question (/showthread.php?tid=591272)
Im not a newbie, but i have a newbie question - stahl - Aug 5, 2010
Im curious to know if there is a way to get into a web.de account without
using a rat/stealer.
Ive tried going threw the password retrieval process on the site, no go.
I guess i need to be educated as to getting into a email account without those two items.
* - Sudo - Aug 5, 2010
I don't have time to right now, but you can try to get the Admin login via SQLi or XSS or RFI/LFI and get all of the logs there.
* - Scotty™ - Aug 5, 2010
If you're not a noob you should know that something named "SQL injection" excist. Noob
* - stahl - Aug 5, 2010
(Aug 5, 2010 10:23 AM)Scotty™ Wrote: If you're not a noob you should know that something named "SQL injection" excist. Noob
SQLI a ISP is like trying to SQLI facebook...Noob
* - i2x - Aug 5, 2010
Check out the Social Engineering section, I think that may be one of the few options you have got.
* - h4kk - Aug 5, 2010
what about bruteforcing? Or does it has protection?
* - curewins - Aug 5, 2010
So, you're basically trying to get someones login here, am I mistaken? If so, I would just use a credential harvester.. you could use an attached PDF or a number of exploits depending on the OS they're using.. A better way may be to use something like SSLStrip if you have access to the network, and it wouldnt be too hard to grab the login so long as they hit it while you're sniffing..
* - `P R O D I G Y™ - Aug 5, 2010
(Aug 5, 2010 11:25 AM)curewins Wrote: So, you're basically trying to get someones login here, am I mistaken? If so, I would just use a credential harvester.. you could use an attached PDF or a number of exploits depending on the OS they're using.. A better way may be to use something like SSLStrip if you have access to the network, and it wouldnt be too hard to grab the login so long as they hit it while you're sniffing..
Most likely linux (If this is a website).
SQLi is your best bet.
* - curewins - Aug 5, 2010
(Aug 5, 2010 11:32 AM)`P R O D I G Y™ Wrote: Most likely linux (If this is a website).
SQLi is your best bet.
SQLi would be a good choice, but if you cant find a vuln in there, then the only way would be to rob the mother.. Is the user out of your reach or do you have access to the local net?
* - CATMAN - Aug 5, 2010
Try hacking it with exploits or SQLi,XSS,etc.
* - stahl - Aug 5, 2010
(Aug 5, 2010 11:35 AM)curewins Wrote: SQLi would be a good choice, but if you cant find a vuln in there, then the only way would be to rob the mother.. Is the user out of your reach or do you have access to the local net?
Im a CEH.
The website is a German hosted company. I live in the US.
I understand what SQLI is, but lack the syntax knowledge.
I understand Rows and columns and things like that.
My target is an admin login, if i can get that then i can get to the email account i want.
I realize Stealers/Rats are the easiest thing to do, but honestly i would much rather use something more stealthy.
I have many stealers and rats i could use. The servers they make are FUD after i crypt/xeno them.
The website does use apache, and apparently is vulnerable. How do i find a good vulnerable link to exploit.
And what is the best way to grab the admin:password hash? Both manually and with SQLI helper.
The account im looking for is a [email protected] email account.
Shameless Bump, BTW im thinking about VIP its only 15 bucks~ This website is awesome