+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Databases for cracking accounts. (/showthread.php?tid=5988656)
Databases for cracking accounts. - Se7eNSiNs - Jul 11, 2019
I'm just wondering how i would go about hitting databases of websites to pull user:pass information to make a combo list use for cracking accounts of various of websites, I've bought combo lists in the past to use with Sentry however i dont want to buy lists i would much prefer to make my own.
RE: Databases for cracking accounts. - Zeda - Jul 12, 2019
Many different ways. From SQLi to RATs. Just google it.
RE: Databases for cracking accounts. - Se7eNSiNs - Jul 12, 2019
(Jul 12, 2019 06:51 AM)Zeda Wrote: Many different ways. From SQLi to RATs. Just google it.
Is SQLi a plausable way? i thought that was patched up years ago/
RE: Databases for cracking accounts. - BITCOIN CALIBRA - Jul 12, 2019
I'm just wondering how i would go about hitting databases of websites to pull user:pass information to make a combo list use for cracking accounts of various of websites, I've bought combo lists in the past to use with Sentry however i dont want to buy lists i would much prefer to make my own.
RE: Databases for cracking accounts. - Zeda - Jul 13, 2019
(Jul 12, 2019 08:28 AM)Se7eNSiNs Wrote: Is SQLi a plausable way? i thought that was patched up years ago/
Its kinda super rare. But still some sites run it.
RE: Databases for cracking accounts. - Empire Network - Jul 13, 2019
(Jul 13, 2019 02:19 AM)Zeda Wrote: Its kinda super rare. But still some sites run it.
Hey guys! This guy's a scammer. Just scammed me out of $165 in BTC by this guy. I'm new, didn't understand contracts, trusted someone on the internet. Be sure to avoid him, contract or not. Clearly doesn't value his word :)
RE: Databases for cracking accounts. - Se7eNSiNs - Jul 14, 2019
(Jul 13, 2019 12:56 PM)Empire Network Wrote: Hey guys! This guy's a scammer. Just scammed me out of $165 in BTC by this guy. I'm new, didn't understand contracts, trusted someone on the internet. Be sure to avoid him, contract or not. Clearly doesn't value his word :)
Nobody is buying anything here stop shitposting
RE: Databases for cracking accounts. - Condasoft - Jul 14, 2019
(Jul 12, 2019 08:28 AM)Se7eNSiNs Wrote: Is SQLi a plausable way? i thought that was patched up years ago/
You would be surprised a lot of the people implementing databases don't cover their arses with an injection cheat sheet.
RE: Databases for cracking accounts. - Central Sky - Jul 14, 2019
Don't deal with scammer asshole, use always contract system on HF
RE: Databases for cracking accounts. - Se7eNSiNs - Jul 15, 2019
(Jul 14, 2019 03:42 AM)Condasoft Wrote: You would be surprised a lot of the people implementing databases don't cover their arses with an injection cheat sheet.
Yeah I've just recently noticed the tonns of websites without any HTTPS but left them selfs vuln with the members.php?id= ... I've hit like 4 databases since i posed.
RE: Databases for cracking accounts. - Sophoclito - Jul 15, 2019
(Jul 12, 2019 08:28 AM)Se7eNSiNs Wrote: Is SQLi a plausable way? i thought that was patched up years ago/
Of course lol it's the main channel to acquire combos
RE: Databases for cracking accounts. - bravetoaster - Jul 17, 2019
ppl not in infosec seem to think sqli is far more prevalent than it is. They see it on OWASP top 10 and say "Oh look how prevalent it is" not knowing they're ranked by severity and not frequency of occurrence. How many sites does WP brag they shittly uphold? Well that right there is some-odd million(s) that using MariaDB - and most idiots (aka graphic designers that think bc they can drag a mouse around in PS they can fucking code) leave the generic db logins on (even though newest MariaDB - on debian and ubuntu mirrors at least - refute root login at all.) I mean quick and easy way to determine if it's vulnerable is add a " ' ' at the end of the URL (thats a single quotation without the spacing nonsense I just did for clarity.) If you get a page refresh - not vulnerable, well at least it's about 80% guaranteed it's not. If it is, it's likely a blind sqli. I personally find more template injections than SQLis anymore. MEAN ( and well just Node really) have become so prevalent and appealing that sometimes you find more non-relational DBs. NoSQL DBs consist of data that doesn't follow standard tabular model as SQL (data keys aren't related in a hard or static fashion.) But NoSQL has it's vulnerabilities too. [{"$gt":""}] is the equivalent of 1' or '1 = 1'; Developers are lazy, and don't typically posess a 'security-first' mindset. You fashion your queries right and do some google dorking and promise you'll find plenty of DBs to query around with.
RE: Databases for cracking accounts. - boy rteis - Jul 21, 2019
(Jul 13, 2019 02:19 AM)Zeda Wrote: Its kinda super rare. But still some sites run it.
I need your help, PM me, because I am a new member, can not reply to you, please leave your contact information
(Jul 14, 2019 03:42 AM)Condasoft Wrote: You would be surprised a lot of the people implementing databases don't cover their arses with an injection cheat sheet.
我需要你的帮助，PM我,因为我是新成员，不能回复你，请留下你的联系方式
RE: Databases for cracking accounts. - verox - Sep 27, 2019
bro wtf, nobody can help u with that, try to do a social engineer and recover password