[Crystallize.]

We are only as strong as we are united, as weak as we are divided.

Hello!
I have decided to release  mega hacking tutorials.Starting from protecting yourself to shelling a website.These are all written by myself.

In this tutorial we will cover:

• Setting up VPN to protect yourself.
  


• Finding vulnerable websites
  


• Exploiting the websites
  


• Shelling A.K.A uploading your shell to modify files.
  


• Monetizing
  

Setting up a VPN to protect yourself

-What is a VPN?

A VPN (Virtual Private Network) is a method used to add security and privacy to private and public networks, like WiFi Hotspots and the Internet.

-Why to use a VPN?

Because governments have tracked people down by their IP address, with the help of the person's Internet Service Provider.

Also, online businesses of all kinds monitor activity coming from IP addresses. They may not know your name, but they know you like their website.

This is a MUST before starting the other steps, some webmasters are douchebags and will report your IP to authorities and you will get in trouble.

-Which VPN do you use?

I normally use my private VPN but you can use my VPN - HarborVPN or you can find yourself a FREE one (Not suggested at ALL.)

-What should I do after I connect to a VPN?

First use a website which tells you your IP to see if you actually connected: WhatIsMyIp this one should work fine.
You also might want to check if your browser is affected by WEBRTC IP LEAK.To do that visit ExpressVPN WebRTC Leak Test or any other website which tells you if your browser leaks it.



If everything is green you are ready to start.If not look below and I will explain how to prevent the IP leak.


-Preventing WebRTC IP leak.

If you are a firefox user head over to about:config in the search bar.And search for

Code

media.peerconnection.enabled

and set the value to false.




If you are a google chrome user you can just install "WebRTC Network Limiter"  and configure it.
Download the addon by clicking this link

Now visit the webrtc ip leak site and see if your IP leaks if not then you're all setup to move on with the next step.

[Crystallize.]

Finding Vulnerable Sites.

SQLi vulnerable pages

-How do we find sites that are vulnerable?

Normally you can use google dorks or you can find your own sites manually.I suggest to use dorks because you can find thousands of vulnerable websites.

-What are dorks?


Dorks are google search strings that reveal login portals and other data.An example how dorks can be used:
inurl:article.php?ID=


This dork will search for sites with /article.php?ID= in the end which you can use to exploit with SQLi.You can make your own dorks easy.By just searching for specific articles,products etc.
Example:
inurl:blablbla.php?ID=

This will list all the websites with blablabla.php?ID= in google.



Some dorks you can use:
inurl:clanek.php4?id=inurl:announce.php?id=inurl:chappies.php?id=inurl:read.php?id=


-How to exploit them?


Normally not every website listed there is vulnerable.If you really have time of the world in hands then you can check them one by one with the ' syntax to see if they throw an error.But if you really like to do things automated, I suggest you use Havij.

-What is Havij?


Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.


-How to use Havij?

Insert the vulnerable website in the target and click Analyze.
After the process is done click get DBs/Tables/Columns.



After that Havij will sort all gathered tables, you will have to click "Get Columns" this will show all usernames,passwords and other data saved in the table.



In this case we will use only the id,username,password  as columns.



After you sort the columns out, login information should show up, most of the times password is encrypted with MD5 which is easy to decrypt.Sometimes password can be in plaintext too or heavy encrypted.Now if we are lucky we will hit MD5/plaintext.I will use MD5 as an example.



You can use the MD5 button in the havij to decrypt the password or you can use an online MD5 decrypter.It's the same!
Now if you know the admin panel you can proceed to login but if you don't then use an online admin panel scanner or the Havij's implemented admin panel scanner.
Done! You now have access to the site's panel! Most of the times they have an upload button so from there you can upload your shell.

[Crystallize.]

Exploiting WordPress websites

-Finding Vulnerable WordPress websites.
For that we will use SE HTML5 Album Audio Player <= 1.1.0 - Local File Include or you can use your own vulns.

You can check if the website is vulnerable to the bug with this code.
site.com/wp-content/plugins/se-html5-album-audio-player/

If the website allows plugins listing it will show files like this:



But if it doesn't list the files you will have to use a tool to scan installed plugins.You can use ScanWp.net or HacketTarget.com/wordpress-security-scan/

The site I am using is vulnerable to the exploit so we will carry on.
I will use the payload:

Code

https://site.com/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../wp-config.php

This will download the wp-config.php file where the DB information is saved.
After downloading the wp-config.php , open it with notepad or notepad++ and you should see DB infos.



Now I will take the password and login via site.com/wp-admin/.
Usually the username is "admin".

VOILA!! IM IN.


Uploading Shells in WordPress.

There are many ways to upload shells in wordpress but I will explain my method which is the easiest.
Head over to Plugins>Editor



Pick one of the plugins listed, paste your own upload code and click save.



So we go to the plugin page wp-content/plugins/pluginname/xxx.php
in my case its(I only put a simple uploader in the code but you can put a shell script or anything)

Code

xxx/wp-content/plugins/woocommerce/i18n/locale-info.php

[*]

You've uploaded your shell in less than 2 minutes.  👍

As a bonus I will add my half-ass working python scanner to identify if website is wordpress.S/O Elitas.

Code

import requestswith open("websitelist.txt") as f:    for url in f:        try:            r = requests.get(url)            if "wp-content" in r.text:                print("Wordpress detected: " + url)            else:                continue        except:            continue

You will need a websitelist.txt in the same folder as the python script.

[Crystallize.]

Shelling Joomla websites


In this step I will not explain how to find Joomla websites but instead only the shelling part, sorry.
After you have found your target most of the times the admin panel is /administrator/ and  the user/admin are "admin|123456" or "admin|password" etc.You can use a bruteforcer to find the username and password.

After logging in the admin panel head over to "Media" the website I am using is in Italian sorry 😏





Head over to options to see if PHP uploading is allowed:



Now if it allowed it will be shown under there but if not then just add 'php' under there.



Now you can upload your shell directly or use an uploader, the directory where the file are being uploaded in this case is site/images/ so the shell would be like /site/images/shellname.php



This was all folks, in the next days I will add more methods to exploit vulnerable sites.
Enjoy.  🤝

Source/s:

Code

Wiki
Images of Havij are borrowed from another tutorial (only the images nothing else).

[Crystallize.]

-How to monetize?

First you would have to register at CoinHive



Coinhive is a Crypto Miner for websites.It mines XMR via the traffic.

After signing up head over to copy the javascript code at "Documentations".




Replace the site key with yours.You can get your API key from "Settings".

Now you can put it in index.php of the shelled websites.

Or you can sell the shells!

Enjoy! 🤝

[Elitas]

Looks really nice! Good job Cryst.

[2Chode2Furious]

I read the whole thing and its pretty damn solid. Quality tutorial.

+1

[Elitas]

EDIT: For the wordpress one, you dump the database information, but then assume the password is the same?

I think you should try directly connecting to their database (there are sites to try and remotely login to a site's MySQL), from there you can dump the database and crack the hashes.
BTW, don't say 'decrypt MD5', as that's obviously not possible, you need to CRACK an MD5 hash! Really great tutorial though for those of you looking to immediately get into a hands on experience of web exploitation. Wish I saw this type of stuff when I was a newbie, so I could practice. Remember though, practicing on other people's sites are illegal, and you are fully responsible for that yourself. We would recommend you do this WITH WEBSITE OWNER'S PERMISSION, but personally we don't give a shit what you do in your spare time, so have fun.

[Exodus]

Damn high quality tutorial, would +1 rep but i'm not upgraded.

[SIM-1589588]

Great tutorial, need to be sticked in this forum :)

[Crystallize.]

Thank you everyone.I hope you learn something from one of these!

[Condescend]

Very good post. Will definitely help those in need of quick insight into WebApp pentesting.

[Crystallize.]

Very good post. Will definitely help those in need of quick insight into WebApp pentesting.

Indeed and thanks!
I am planning to make #2 version sometime soon with more exploits/informations etc.

[Condescend]

Indeed and thanks!
I am planning to make #2 version sometime soon with more exploits/informations etc.

That's a really good idea. I know Mr. Robot was doing a massive mega tutorial or something similar to this, but it went unfinished.

I feel like you could make a lot of threads on this topic, since Web pentesting is so attractive to some.

[Crystallize.]

That's a really good idea. I know Mr. Robot was doing a massive mega tutorial or something similar to this, but it went unfinished.

I feel like you could make a lot of threads on this topic, since Web pentesting is so attractive to some.

I could ask Robot to do it together if he wants.But not many people are getting interested in hacking nowadays. :(