[xdlwilliamz]

Hi everyone, am looking for effective methods for hacking websites;
Purpose : 1) to utilize them for malware drive-by downloads,
2) to harvest database information

[mothered]

Moved from The Lounge forum, accordingly to Website & Server Hacking.

am looking for effective methods for hacking websites

It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.

[xdlwilliamz]

Moved from The Lounge forum, accordingly to Website & Server Hacking.

am looking for effective methods for hacking websites

It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.

ok i get it, so it all depends on the vulnerabilities detected for each site ...

[mothered]

Moved from The Lounge forum, accordingly to Website & Server Hacking.

am looking for effective methods for hacking websites

It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.

ok i get it, so it all depends on the vulnerabilities detected for each site ...

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

[xdlwilliamz]

Moved from The Lounge forum, accordingly to Website & Server Hacking.

It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.

ok i get it, so it all depends on the vulnerabilities detected for each site ...

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

wow that's cool, i see the dedication
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

[mothered]

ok i get it, so it all depends on the vulnerabilities detected for each site ...

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

wow that's cool, i see the dedication
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.

[xdlwilliamz]

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

wow that's cool, i see the dedication :)
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi  (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.

good to hear it's full privileges 😎
Most tools i have for these attacks are in Linux,
what os do you use, Linux or Windows ? am following your guide now ...

[mothered]

wow that's cool, i see the dedication
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi  (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.

good to hear it's full privileges 😎
Most tools i have for these attacks are in Linux,
what os do you use, Linux or Windows ? am following your guide now ...

For general navigation, I use windows.

In terms of exploitation, a combination of Windows and Linux on a VM.

[sybylroot]

Well you can even combine certain attack vectors to gain access and more stuff i depends of what you want to do, i usually use Linux with a VM of Windows (for studying the site) and Linux as my toolset, i use the distro BlackArch is like Kali but based on Arch distro it comes with a literally lot of tools..

[mothered]

i usually use Linux with a VM of Windows (for studying the site) and Linux as my toolset, i use the distro BlackArch is like Kali but based on Arch distro it comes with a literally lot of tools..

Nice approach.

It's also beneficial to manually exploit every now and then, without the aid of (automated) tools. This will significantly Improve your skill set over time.