How to hack any website? : Bug Bounty Tips

Hi there, my fellow noob! Are you a bug hunter, pentester, pornstar or a semi-friendly hacker? If yes, then this guide is for you. In this guide you will learn how to test for security flaws or the more attractive phrase. How to hack any website?

Information Gathering & Enumeration
Bypass Cloudflare : 

First thing you should do is to check if the website is using cloudflare or not, and if does then bypass it. Finding the real IP address is necessary and will help us in further exploitation.

Recommended Tools: CloudFail

Find Subdomains :

Finding subdomains of the target website is crucial. What if there a sudomain dev.example.com which is being used by the developers of the website to test new features? Maybe you can find a command injection vulnerability there can and pawn the whole server.

Recommended Tools: Sublist3r

DNS, Whois & Reverse IP Lookup : 

The next step should be dumping the DNS related data like name servers and mail servers. You can also try zone transfer if you see port 53 on a server.

Whois info can also reveal a lot about the target, especially information that can help us in the social engineering phase.

You should also do reverse IP lookup which will give you the list of websites hosted on the same server so if you fail to hack the target website, then you can hack any other websites hosted on that server and then gain access to the server.

Recommended Tools: dnsdumpster.com, dnsenum, YouGetSignal, whois.net

Information Gathering about the Organization : 

Find as much as information you can about the organization who owns the website. Ranging from their partners in business to the email addresses of their employees. Linkedin is a great resource to find and learn about the employees. The more information you have about the organization, the better your social engineering approaches will be.

Recommended Tools: theHarvester, Maltego, Google

Port Scanning : 

Do a port scan to have an idea about what services are running on the server, save the results for reference in further exploitation.

Recommended Tools: NMap

Web Technology Detection :

Modern websites are very complex and they use a lot of web technologies like various JavaScript libraries, plugins, content management systems, frameworks and what not. For a hacker, it is very important to know what kind of web technologies are in use for further exploitation.

Recommended Tools: builtwith.com, wpscan, whatcms.org

WAF/IPS Detection :

Its advised to detect if a WAF/IPS is in place in the early stage because don’t want to wonder why your payloads aren’t working. The common method is to inject a noisy payload in some input box or parameter and watch the result, the access denied message often reveals the underlying WAF.

Recommended Tools: wafw00f

Robots.txt & Hidden Directories :

Robots.txt is a file which contains the list of paths that the web developers don’t want the crawlers to find. In simple words, the contain that stuff which should not be found through search engines.
Brute forcing for common paths is also a good idea as you might get some hidden directories. Finding admin panels may also come handy for testing of login related issues or in case you get the credentials via social engineering.

Recommended Tools: dirsearch, Breacher

Hidden HTTP Parameters : 

What if the webpage you are testing has a hidden parameter debug=true which displays juicy info or format=xml which converts the response to xml. Looking for hidden parameters is very useful at times.

Recommended Tool: Arjun

API Endpoints : 

Does the webapp have a official API documentation? If yes, go through it.

If no, fire up BurpSuite and identify as many as endpoints possible by making different requests.

APIs are often vulnerable to IDOR and authentication related attacks.

Using Exploits :

What are the web technologies in use? What plugins are being used? What CMS is being used? Are they outdated? If yes, use vulnerability databases and google to find an exploit.

Recommended Tools: Google, exploit-db

HTTP Headers :

Do you know if x-frame–options header is missing we can do click jacking on the website? Similarly, there are other security vulnerabilities related on the HTTP headers and they can cause a lot of damage when chained with another severe vulnerabilities. Some headers misconfiguration can help you to bypass security restrictions.

Recommended Tools: None

Errors & Information Disclosure : 

Errors can give a lot of information about the configuration of the back end like what database management system is in use. It is also common for web apps to throw full path of the file in the error messages which can come in handy in further exploitation.

Recommended Tools: None

Exploiting Parameters & Forms :

How do a website gets input from the users? Websites use mainly use GET & POST method to get input from user. Take a look at this  GET request:

https://example.com/gallery.php?this-is-a-parameter=and-this-is-its-value

As parameters are a way of submitting a data, there are a lot of attack vectors related to them. Website may also use forms run by JavaScript or JQuery and in that case you won’t be able to see the parameters but of course you are sending the data to the backend.

XSS & HTML Injection : 

XSS is one of the most common vulnerabilities. It doesn’t have a high risk factor but its impacts can be hazardous depending on the configuration of the webapp. XSS & HTML injection are very popular among bug hunters.

Recommended Tools: XSStrike (Prefer manual injection)

Database Injection :

Database injection vulnerabilities are like a treasure for a hacker. You should have knowledge of how different databases and DBMS work in order to exploit them.

Recommended Tools: Prefer manual injection, SQLmap.

Command Injection :

Why check for other vulnerabilities if you can run system commands on the web server? Common sense and knowledge of command line is all you need to exploit command injection vulnerabilities.

Recommended Tools: Commix

Open Redirection & Server Side Request Forgery (SSRF) :

If a parameter or input form takes a URL as input, you must check for SSRF and open redirect vulnerability.

Recommended Tools: None

Application Specific Attakcs :

There are some attacks which are application/technology specific like LDAP injection, SSI injection, XML injection, XPath injection etc. Perform tests for them whenever possible.

Recommend Tools: None

Logic Based Attacks :

What do I mean by logic based attacks? Well these are those attacks or techniques which can’t be automated and need to be done by a human. There are no tools for that.

Cross Site Request Forgery (CSRF) :

CSRF is something which is found in many variations. Always check if the CSRF token can be removed or altered without breaking the functionality of web app. Missing security policies and XSS can be used to bypass CSRF protection.

Insecure Direct Object Reference (IDOR) vulnerabilities :

How these complex web apps distinguish between users, products etc.? They assign a value to it and if the HTTP request contains that value then its possible for an attacker to modify it.

Other Stuff :

Files?

LFI & RFI attacks:
If the HTTP request includes a file path/name either from remote address or the web server itself then you must test for RFI and RFI. You can get a web shell with RFI easily. On the other hand, LFI can be used to view files on the web server and you can run system conditions if proper security measures are not in place.

Recommended Tools: LFISuite

Unrestricted File Upload :

Does the website have a file upload form? Great. You can check if the website checks the extension of the file properly or not. For example, if a website lets the users upload a profile picture for their account, the attacker will try to upload a web shell spoofed as an image and if proper checking mechanism is not in place, the website will get compromised through that web shell.

Recommended Tools: Iron Man Suit

Other Stuff :

There are many attacks and vulnerabilities related with file uploads like persistence of metadata, XXE attack, XSS through file upload etc. Its up to you to check for them. Good luck.

Recommended Tools: None

Authorization Issues
Can you bypass the login panel with malicious strings?

Are you able to access web pages you should not be allowed to view without authorization?

Do the session id has a weak value? Like a user name or small number which can be bruteforced?

Is there any rate limiting on the login page to stop bruteforcing?

Do the cookies expire when the user logs out?

Other Web App Attacks :

There are a lot of other attacks like HTTP response splitting, header injection, subdomain takeover, page takeover, path transversal, SMTP Injection etc.

Social Engineering Based Attacks :

If you did proper information gathering, you can target employees of the organization and pivot your way or can hack the administrator of the website himself. Phishing, vishing, water hole attack, malicious email attachments…..possibilities are endless.

Rest of The Attack Surface :

So you failed to hack the website? Don’t worry. Pick one website hosted on the same server and try to gain access to it so you can further exploit your way till you get root access on the server. As the whole server is under your control, you can play with the target website too.

Open your port scan results and see if you can exploit the services running on the service.

Apart from these you can do a lot of things like this one. And don’t forget to test all the subdomains, you never know when you hit the G-spot *coughs* I mean the right spot.


Thanks for reading. Keep Learning! Keep Hacking! Keep Bug Hunting!

How to delete your facebook search history?

1. Go to Your Profile

Head to your Facebook profile and click the "Activity log" option at the bottom right of your cover photo.

2. Activity Log

Your activity log is a list of your posts and all Facebook activity, including your search history.

3. More Options

Next, click on the "More" option on the left-hand menu, under "Photos," "Likes" and "Comments."

4. Search Activity

Scroll down the expanded list until you see "Search."

5. Your Search History

You can now view your Facebook search history, in date order. To get rid of it, simply click "Clear Searches..."

6. Clear Your History

And then okay the pop-up message that appears.

7. A Clean Search Slate

Your Facebook search history is now a clean slate!

How to Troubleshoot Networks

There are different reasons why things go wrong on our networks, humans make errors in their configurations, hardware can fail, software updates may include bugs and changing traffic patterns might cause congestion on our networks. To troubleshoot these errors there are different approaches and some are more effective than others.

Troubleshooting consists of 3 steps:

It all starts when someone or something reports a problem. Often this will be a user that calls the helpdesk because something is not working as expected but it’s also possible that you find issues because of network monitoring (you do monitor your network right? J). The next step is to diagnose the problem and it’s important to find the root of the problem. Once you have found out the problem you will implement a (temporary) solution.

Diagnosing the problem is one of the most important steps to do because we need to find the root cause of the problem, here’s what we do to diagnose the problem:

• Collect information: Most of the time a problem report doesn’t give us enough information. Users are very good at reporting “network is down” or “my computer doesn’t work” but this doesn’t tell us anything. We need to collect information by asking our users detailed questions or we use network tools to gather information.
• Analyze information: Once we have gathered all information we will analyze it so see what is wrong. We can compare our information to previously collected information or other devices with similar configurations.
• Eliminate possible causes: We need to think about the possible causes and eliminate the potential causes for the problem. This requires thorough knowledge of the network and all the protocols that are involved.
• Hypothesize: After eliminating possible causes you will end up with a couple of possible causes that could be the problem. We will select the most likely cause for the problem.
• Verify hypothesis: We will test our hypothesis to see if we are right or wrong. If we are right we have a victory…if we are wrong we test our other possible causes.

If you don’t use a structured approach for troubleshooting you might just “follow your gut feeling” and get confused because you forget what you already tried or not. It’s also easier if you work together with other network engineers because you can share the steps you already went through.

Here are the steps in a nice flowchart:

We call this the structured troubleshooting approach. However if you have a lot of experience with the network you are working on and as you become better at troubleshooting this approach might be too time-consuming.

Instead of walking through all the different steps in the structured troubleshooting approach we can also jump from the “collect information” step directly to the “hypothesize” step and skip the “analyze information” and “eliminate possible causes” steps  If you are inexperienced with troubleshooting it’s best to use the structured troubleshooting approach. As you become better at troubleshooting you might want to skip some of the steps…we call this the shoot from the hip approach:

Here’s the shoot from the hip model. The steps that we skip are in blue. If your instincts are wrong you won’t lose your life but you will lose valuable time. If you are right however you’ll save a lot of time (or become the new sheriff in town).

Eliminating possible causes is an important step in the troubleshooting process and there are a couple of approaches how you can do this, here they are:

• Top-down.
• Bottom-up.
• Divide and conquer.
• Follow the traffic path.
• Spot the difference.
• Replace components.

Let’s walk through the different approaches one-by-one!

Top-down means we start at the top of the OSI model (application layer) and work our way further down to the bottom. The idea is that we will check the application to see if it’s working and assume that if a certain layer is working that all the layers below are also working. If you send a ping from one computer to another (ICMP) you can assume that layer 1,2 and 3 are operational.  The downside of this approach is that you need access to the application that you are troubleshooting.

Bottom-up means we start at the bottom of the OSI model and we’ll work our way up. We will start with the physical layer which means we check our cables and connectors, move up to the data link layer to see if Ethernet is working, Spanning-tree is working ok, port security is not causing issue, VLANs are configured properly and then move onto the network layer. Here we will check our IP addresses, access-lists, routing protocols and so on. This approach is very thorough but also time-consuming. If you are new to troubleshooting I would recommend to use this method because you will eliminate all the possible causes for problems.

Divide and conquer means we start in the middle of the OSI-model. You can use this model if you are not sure if top-down or bottom-up are more effective. The idea is that you’ll try to send a ping from one device to another. If the ping works you know that layer 1-3 are operational and you can work your way up in the OSI model. If the ping fails you know something is not right and you’ll work your way to the bottom of the OSI model.

The follow the traffic path is very useful. First we’ll try to send a ping from HostA to HostB. If it fails we’ll check all the devices in its path. First we’ll verify if SwitchA is configured correctly, it it’s looking good we’ll move onto SwitchB, verify it and then move onto RouterA.

You’ve probably done one of these before. Spotting the difference in configurations or the output of show commands can be useful but it’s very easy to miss something. If you have a number of branch routers with a similar configuration and only one is not working you can see if there’s a difference in the configuration. Network engineers that don’t have a lot of experience usually use this approach. You might be able to solve the problem but there’s a risk that you don’t really know what you are doing.

The last approach to solve our problem is to replace components. Let’s say we have a scenario where a computer is unable to access the network. In the example above I could replace the computer to eliminate any chance of the computer being the problem. We could replace the cable and if we suspect the switch we can replace it with a new one and copy the old configuration to see if there are any hardware problems.

This is all the theory I have to share with you about network maintenance and troubleshooting.

We can talk all day long about different methods and such but the key to becoming an expert with troubleshooting consists of two things:

• Truly understand all the different networking protocols like OSPF, EIGRP, BGP, spanning-tree and everything else you have running on your network. You can’t fix something if you have no idea how it works.
• Gain experience by doing labs and troubleshoot broken networks!

You can read all the books about driving a car, how an engine works, what a clutch is or how to use your mirrors but at the end of the day…you have to sit in a car and start driving to learn how to drive a car.

When you are new to troubleshooting it might be a good idea to create a list for yourself with all the different layers and the things you should check, something like this:

This mindmap created with Xmind is far from complete but it should give you an idea how to create one yourself. When you are troubleshooting and discover new things, add them to your mindmap for the future. When you get stuck you’ll have a nice overview of things to look for per layer. Once you spend more time troubleshooting the list with things to look for will be hardcoded in your brain and you’ll troubleshoot on auto-pilot.

Download android apk files directly on computer from playstore

Hello friend, Today I am going to show you how to download android application games directly on your computer from Google android play store without actually having android device with you.

This trick has lot of importance if you are not an android user but still want to enjoy apps or game using emulators such as BlueStacks, Youwave. Moreover you can't download android files from play store without linking an android device with account! 

Steps you have to perform :

1. Copy the URL of application or game page available on android store.

2. Click here to visit android apk downloading website.

3. Paste the copied URL in text-box and click on "Generate Download Link".

4. They will fetch the file on their server. Delay will be dependent upon how big the target file is.

5. After getting package name and size of the package, click on download file.

6. Done, now enjoy the application or game on PC using emulators or keep as backup of application!

7. You can also install their extension on Google Chrome browsers for quick access!

How to install WhatsApp on Windows Or Mac Operating System

Whatsapp becomes one the foremost fashionable Mobile Apps messenger for android, iOS, Nokia and Blackberry or different Mobile Phones. Whatsapp is generally famed for his or her options like unlimited Chatting with friends, causation pictures, Audios, Videos and the other file at freed from value. currently in lately several peoples begin mistreatment Whatsapp rather than mistreatment different chat messengers simply because of higher expertise in chat and conjointly having numbers of chat emotions and plenty of different vital options.

Major downside is Whatsapp messenger is simply for Mobile and Apple iPhone or Tablets. Whatsapp does not publish any version for victimization it on laptop or Laptops. therefore a way to use it on your laptop or portable computer. currently in these there are several software's out there that convert humanoid apps into laptop version. therefore currently i plan to write however you'll use Whatsapp on your Windows OS and mackintosh OS. one among the foremost in style software package Bluestacks that convert Apps in laptop version. therefore by victimization Bluestacks can learn the way you'll use Whatsapp on laptop. straightforward follow my all steps fastidiously with some wisdom additionally.

How to install WhatsApp on Windows/Mac Operating System ??

Requirements :


1. BlueStack Android Emulator: (Download For Windows/Mac OS)

The minimum requirement of hardware to run this application smoothly on machine is having Windows XP or higher versions of windows operation system and recommended to have some graphic memory (Graphic Card).

Installation  :

1. Download and install BlueStack on your PC/Laptop. (It may take time during installation depending upon hardware configuration)
2. Open the application after completing installation.
3. Search for the application "Whatsapp" or just click on Messaging as shown below and click on "Whatsapp".
4. It will search on various android stores integrated into Bluestack application itself, Select any from these stores and install it.
5. If you already have Whatsapp .apk file then just double click to install it on Bluestack software, No need to download as specified in above steps.

How to Block Unwanted Emails

Unsolicited emails or spam emails are big annoyances to email users in the world. In case if your email address falls into the wrong hands, it can be sold and resold to many marketers in the world who tend to flood email addresses with various different kinds of ads, irrelevant requests for money, product review and other types of spam. It can be vary irritating for email users. Most E-mail accounts come with an automatic junk mail filter, but even these don't catch all kinds of unsolicited emails. Thats why you need to manually block unwanted emails.

How to Block Unwanted Emails:

Do you want to block unwanted emails which came everyday in your inbox? Do you want to block newsletters or offers that reach your inbox everyday? Well, here is the solution for it, In this post, I will show you a trick or way using which you can block individual email address.

Steps to Block Unwanted Emails :

Here is a list of steps that you need to follow to block unwanted emails. Every email account have different different type of setting so bellow I have written steps for each individual service provider:

Steps to Block Unwanted Emails In Gmail :

Step 1: First log in to your Gmail account.

Step 2: After login, goto inbox and at the top-right corner, click on Setting.

Step 3: Under Setting click on Filters Tab.

Step 4: Now click on "Create a new filter" option.

Step 5: Now in the From field, enter the email address from which you do not want to receive the emails.

For example : you may enter abc@gmail.com in the “From:” field to block all incoming emails from this address.

Note : However, if you want to block the whole domain, then use the following syntax: *@gmail.com. Now, all the incoming emails from the domain “gmail.com” will be blocked.

Step 6: Click on Next Step, select the action you’d like to take on the blocked emails. You may select the option Delete it so that the blocked email is moved to trash. In case if you would like to unblock those emails, all you need to do is just delete the filter that you’ve created.

Steps to Block Unwanted Email in Yahoo :

Step 1: First log in to your yahoo account.

Step 2: After login, goto inbox and at the top-right corner, click on Options, After that drop down menu will get appears, now click on More options.

Step 3: Now in the left panel select the option Filters and click on create or edit filters.

Step 4: Now click on Add option.

Step 5: In the next screen, give a name to your filter and in the From header field enter the email address that you want to block.

Fox example : abc@yahoo.com or if you want to block an entire domain then just enter @yahoo.com. Don’t enter *@yahoo.com. Select the option Move the message to: Trash and click on Save Changes.

Steps to Block Unwanted Emails in Hotmail :

Step 1: First log in to your hotmail account.

Step 2: After login, goto inbox and at the top-right corner, click on Option.

Step 3: After clicked on Option, a drop down menu will get appears, now click on More options.

Step 4: Now click on Safe and blocked senders link under Junk e-mail.

Step 5: Now click on Blocked senders and type in the email address that you want to block under blocked e-mail address or domain field.

For example : Enter abc@hotmail.com to block the individual email address or just enter hotmail.com to block the entire domain.

That’s it.

Now you no longer receive those such annoying and irritating emails in your account inbox. I hope this post will helps to block unwanted emails.

Recovering data from the iPhone corrupted backups

At times when iTunes couldn’t finish the backup process (USB cable disconnect during backup/iOS upgrade, Power failure during backup), the backup gets corrupted and remains unreadable. As the corrupted backup does not contain meta files like Manifest.plist & Manifest.mbdb, it is not possible to restore the backup onto the iPhone and it is also not possible to read the backup using backup reader software like iPhone backup browser & iPhone backup extractor. So I wrote a python script iOS-corrupted-backup-reader.py that can read & recover data from the corrupted backups. Usage of the script is listed below.

Steps to use iOS-corrupted-backup-reader.py (Windows):

1. On windows, install Python 2.6.
2. Download iOS-Corrupted-Backup-Reader.py and place it in C:\ drive.
3. Create two folders backup & output in C drive.
4. From the iOS backup directory C:\Users\[user-name]\AppData\Roaming\Apple Computer\MobileSync\Backup\[iPhone-UDID]\,  copy all the files and place them in C:\backup directory.
5. Open  the command prompt, navigate to C:\ drive and type the below command.
\Python26\python.exe iOS-Corrupted-Backup-Reader.py c:\backup c:\output

6. It converts the backup files into readable format and places them in C:\output directory.

Steps to use iOS-corrupted-backup-reader.py (Mac OS X):

1. Create two folders backup & output on Desktop.
2. Download iOS-Corrupted-Backup-Reader.py and place it on Desktop.
3. From the iOS backup directory ~/Library/Application Support/MobileSync/Backup/[UDID], copy all the files and place them in backup directory.
4. Open the terminal and run the below command.
Python iOS-Corrupted-Backup-Reader.py ~/Desktop/backup/ ~/Desktop/output/

5. It converts the backup files into readable format and places them in output directory.

The script extracts and structures all the default files like Contacts, SMS, Calendar, etc. into directories with actual file names. Other third party application files are converted into readable format and gets stored in other-data folder in output directory without actual file names. Manifest.mbdb file maps the actual filenames to backup filenames and the mbdb file is not available in the case of corrupted backups. So it is not possible to get the exact file names. In general, most of the iOS applications store the data in plist, sqlite and Jpeg format. You can use plist editor , sqlite spy and image viewers to open the files and read the data manually.

Note: Data recovery is only possible in the case of normal backups. If the backup is encrypted (encrypt backup option is checked in iTunes), it is not possible to read & recover the data from the corrupted backups.