Effective means of hacking websites

Effective means of hacking websites - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Effective means of hacking websites (/Thread-Effective-means-of-hacking-websites)

Pages: 1 2

Effective means of hacking websites - xdlwilliamz - 02-24-2020

Hi everyone, am looking for effective methods for hacking websites;
Purpose : 1) to utilize them for malware drive-by downloads,
2) to harvest database information

RE: Effective means of hacking websites - mothered - 02-25-2020

Moved from The Lounge forum, accordingly to Website & Server Hacking.

Quote:am looking for effective methods for hacking websites

It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.

RE: Effective means of hacking websites - xdlwilliamz - 02-25-2020

(02-25-2020, 09:32 AM)mothered Wrote: Moved from The Lounge forum, accordingly to Website & Server Hacking.

Quote:am looking for effective methods for hacking websites
It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.

ok i get it, so it all depends on the vulnerabilities detected for each site ...

RE: Effective means of hacking websites - mothered - 02-25-2020

(02-25-2020, 11:41 AM)xdlwilliamz Wrote:
(02-25-2020, 09:32 AM)mothered Wrote: Moved from The Lounge forum, accordingly to Website & Server Hacking.

Quote:am looking for effective methods for hacking websites
It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.
ok i get it, so it all depends on the vulnerabilities detected for each site ...

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

RE: Effective means of hacking websites - xdlwilliamz - 02-25-2020

(02-25-2020, 02:28 PM)mothered Wrote:
(02-25-2020, 11:41 AM)xdlwilliamz Wrote:
(02-25-2020, 09:32 AM)mothered Wrote: Moved from The Lounge forum, accordingly to Website & Server Hacking.

It's not possible to generalize attack vectors, without assessing and researching the security and vulnerabilities (If any) of the website(s) In question.
ok i get it, so it all depends on the vulnerabilities detected for each site ...

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.

wow that's cool, i see the dedication Smile

So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

RE: Effective means of hacking websites - mothered - 02-26-2020

(02-25-2020, 05:18 PM)xdlwilliamz Wrote:
(02-25-2020, 02:28 PM)mothered Wrote:
(02-25-2020, 11:41 AM)xdlwilliamz Wrote: ok i get it, so it all depends on the vulnerabilities detected for each site ...

Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.
wow that's cool, i see the dedication
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.

RE: Effective means of hacking websites - xdlwilliamz - 02-26-2020

(02-26-2020, 03:07 AM)mothered Wrote:
(02-25-2020, 05:18 PM)xdlwilliamz Wrote:
(02-25-2020, 02:28 PM)mothered Wrote: Correct.

There must be a flaw, some sort of weakness/vulnerability to allow exploitation and access the back-end thereafter. It's just a matter of Identifying their security loopholes. I've spent as long as two weeks on one site, and finally gained access.
wow that's cool, i see the dedication :)
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.

good to hear it's full privileges 😎
Most tools i have for these attacks are in Linux,
what os do you use, Linux or Windows ? am following your guide now ...

RE: Effective means of hacking websites - mothered - 02-26-2020

(02-26-2020, 05:18 PM)xdlwilliamz Wrote:
(02-26-2020, 03:07 AM)mothered Wrote:
(02-25-2020, 05:18 PM)xdlwilliamz Wrote: wow that's cool, i see the dedication
So aside from scanners like nmap and the rest, what other means can one detect vulnerabilities in a site ?
and what level of access could one get with SQL injection ?

Depending on the site Itself, I use a number of SQL Injection attack vectors.

Content-Based/Boolean-Based, In-Band SQLi (Union & Error-Based being the most common) and Time-Based/Blind SQLi. The level of access Is full elevated (admin) privileges. You can edit, update, modify and delete data, and manipulate the database to obtain the Table & Column names, thereby grab sensitive details thereafter.
good to hear it's full privileges 😎
Most tools i have for these attacks are in Linux,
what os do you use, Linux or Windows ? am following your guide now ...

For general navigation, I use windows.

In terms of exploitation, a combination of Windows and Linux on a VM.

RE: Effective means of hacking websites - sybylroot - 02-27-2020

Well you can even combine certain attack vectors to gain access and more stuff i depends of what you want to do, i usually use Linux with a VM of Windows (for studying the site) and Linux as my toolset, i use the distro BlackArch is like Kali but based on Arch distro it comes with a literally lot of tools..

RE: Effective means of hacking websites - mothered - 02-28-2020

(02-27-2020, 09:51 PM)sybylroot Wrote: i usually use Linux with a VM of Windows (for studying the site) and Linux as my toolset, i use the distro BlackArch is like Kali but based on Arch distro it comes with a literally lot of tools..

Nice approach.

It's also beneficial to manually exploit every now and then, without the aid of (automated) tools. This will significantly Improve your skill set over time.