-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label Ethical Hacking Course. Show all posts
Showing posts with label Ethical Hacking Course. Show all posts
  • TryHackMe Advent of cyber Day 9 Task 14 walkthrough



    TryHackMe Advent of cyber Day 9 Task 14 walkthrough



    The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

    TryHackMe Advent of cyber Day 9 Task 14 walkthrough


    While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.






     tryhackme rp nmap






    TryHackMe :- Click Here




    Day Nine — Requests



    Day 9 brings us our first scripting challenge. We’re given access to a public IP VM (on the THM network, so remember to use OpenVPN!) located at 10.10.241.214 or 10.10.112.87 and are told that it runs a webserver on Port 3000. We’re also told that the root directory of the webpage serves a file containing the JSON object: {"value":"s","next":"f"} , which gives us a value and the location of the next value. The support material for today’s challenge is once again a Google Doc. I’ve provided a step-by-step tutorial for building today’s script, and there’s a screenshot of the finished program at the end of the Day 9 write-up.
    TryHackMe Advent of cyber Day 9 Task 14



    Despite being told that the file just contains a single JSON object, I think it’s worth just checking for ourselves.



      curl http://10.10.169.100:3000 


    But if using a web browser is preferable then that works too (note that the browser is displaying the data as a table — switch to the Raw Data tab to see what the website will actually send if request data from it):






    TryHackMe Advent of cyber Day 9 Task 14 walkthrough






    As I understand it, a lot of people just did this challenge manually; however, it’s a lot more fun (not to mention quicker and more reliable) to do it with a simple script, so that’s what we’re doing.


    Get your favourite text editor up and make a new Python ( .py ) file. If you don’t have Python installed then download it from here if you’re running Windows or Mac. Most flavours of Linux already have Python installed, but if you prefer using an IDE to code then it’s worth downloading IDLE or Visual Studio code.


    We’ll go through this line by line, and I’ll post a screenshot of the finished file when we get to the end.





    The first thing we need to do is import the requests library:


    import requests


    The requests library is used to send HTTP requests and receive responses. For this program that’s all we need it to do: send and receive.


    The next thing we’re going to do is setup global variables for the host and path of the domain:


    path = "/"
    host = "http://10.10.169.100:3000"

    These will be used during the actual requests stage — for the time being our path is just the root directory because we know that’s where the first JSON object is.

    We also want to make an (empty) global array to store our answers in:



    values = []


    We know from the challenge description that we’re being asked to keep following the trail of JSON objects until we reach one that is {"value":"end","next":"end"} — in other words, we want to keep going until the next path in the list is /end .


    Let’s set up a while loop to do this:



    while path != "/end":


    From this point on indentation is extremely important as the Python interpreter uses it to determine which lines are part of which statement. Everything inside the while loop has to have a single tab before it.

    The next thing we need to do is request some information from the server:



    response = requests.get(host+path)


    This makes a GET request to the website and stores the response in a variable called response.

    The next line we need is:


    json_response = response.json()



    Without going into too much detail, this line analyses the response for JSON data and sets it (as a dictionary) to a variable called json_response.

    We now have our JSON object saved as a Python dictionary with key-value pairs. Right now our dictionary looks like this:






    TryHackMe Advent of cyber Day 9 Task 14 walkthrough




    So, we have our data in a readable format. What are we going to do with it now?

    The first thing we need to do is update our path variable so that the program knows where to look next:


    path = "/" + json_response["next"]

    This is setting the path variable equal to a forward slash, followed by the value stored with the “next” key from the dictionary we requested. After the first iteration of our loop, the path variable would look like this:



    /f


    because “f” was the letter stored in the first dictionary “next” key.

    We also want to add the value to our list of values — but only if the value isn’t end :


     

    if path != "/end":
            values.append(json_response["value"])




    We already decoded the “next” value and set it to the path, so if we test path to be equal to /end we know that the next value was “end”. In the above statement, if the path is anything other than /end the value in the “value” key of the dictionary will get added to our list of values.


    Finally (outside the while loop), we use:


    print("".join(values))


    which outputs the values array (joined together as a string) to give us our answer to the only question for Day9. The final program should look like this:



    Full Program



    #!/usr/bin/python3

    import requests
    path = "/"
    host = "http://10.10.169.100:3000"
    values = []

    while path != "/end":
       response = requests.get(host+path)
       json_response = response.json()
       path = "/" + json_response["next"]
       if path != "/end":
            values.append(json_response["value"])
    print("".join(values))




    When we run the program, we should be given our sole answer for the day:







    TryHackMe Advent of cyber Day 9 Task 14 walkthrough



    python request.py





      Program returns the flag




    Video Tutorial :-



       


    Disclaimer



    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)







  • tryhackme rp nmap



    tryhackme rp nmap



    The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

    tryhackme rp nmap


    While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.




    tryhackme rp nmap




    Script Categories :- Click Here

    TryHackMe :- Click Here


    TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time.






    tryhackme rp nmap






    Question:


    1) First, how do you access the help menu?


             -h           



    2) Often referred to as a stealth scan, what is the first switch listed for a ‘Syn Scan’?



            --sS         



    3) Not quite as useful but how about a ‘UDP Scan’?


            --sU         




    4) What about operating system detection?



            --O         



    5) How about service version detection?
       


             --sV       



    6) Most people like to see some output to know that their scan is actually doing things, what is the verbosity flag?
     


            --v           






    7) What about ‘very verbose’? (A personal favorite)



           --vv        




    8)  Sometimes saving output in a common document format can be really handy for reporting, how do we save output in xml format?   -oX



          --oX       



    9) Aggressive scans can be nice when other scans just aren’t getting the output that you want and you really don’t care how ‘loud’ you are, what is the switch for enabling this?



            -A        




    10) How do I set the timing to the max level, sometimes called ‘Insane’?
       


          -T5        



    11) What about if I want to scan a specific port?
       







           -P            




    12 )How about if I want to scan every port?


            -p-        



    13) What if I want to enable using a script from the nmap scripting engine? For this, just include the first part of the switch without the specification of what script to run.



       --script      






    14) What if I want to run all scripts out of the vulnerability category?


        --script  vuln    



    15) What switch should I include if I don’t want to ping the host?



             -Pn         

    Nmap Scanning



    1) Let’s go ahead and start with the basics and perform a syn scan on the box provided. What will this command be without the host IP address?





          nmap  -sS        





    tryhackme rp nmap




    2) After scanning this, how many ports do we find open under 1000?






           ANS : 2       



    3) What communication protocol is given for these ports following the port number?



          ANS : tcp       





    4) Perform a service version detection scan, what is the version of the software running on port 22?



       nmap -sV <ip>   




    tryhackme rp nmap




       ANS : 6.6.1p1   




    5) Perform an aggressive scan, what flag isn’t set under the results for port 80?




       nmap -A <ip>  




    tryhackme rp nmap






     ANS: httponly 






    6) Perform a script scan of vulnerabilities associated with this box, what denial of service (DOS) attack is this box susceptible to? Answer with the name for the vulnerability that is given as the section title in the scan output. A vuln scan can take a while to complete. In case you get stuck, the answer for this question has been provided in the hint, however, it’s good to still run this scan and get used to using it as it can be invaluable.




     nmap --script vuln <ip> 



    tryhackme rp nmap





     ANS: http-slowloris-check 







    Disclaimer

    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :-  


           



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)

     



  • The completer beginner to advance level of ethical hacking course


    The Complete Ethical Hacking Course!

    Learn how to get started as a professional hacker with this complete course!


    Would you like to get started as an ethical hacker? Do you want to become a professional penetration tester? Enroll now in The Complete Ethical Hacking Course and learn how to think like a hacker, and become familiar with the toolkit of a professional pentester. This course covers a wide range of topics relating to network security: The Complete Ethical Hacking Course!



    •     Introduction to ethical hacking
    •     Reconnaissance
    •     Scanning and enumeration
    •     Network presence
    •     Attacking systems
    •     Web hacking
    •     Social engineering





    When you enroll in the course you will immediately receive access to 19+ hours of HD video tutorials, as well as additional supplemental resources for developing the necessary skills to succeed in the field. Learn by doing with demonstrations using popular pentesting tools such as Maltego, FOCA, Recon-ng, Nmap, masscan, tcpdump, Wireshark, Ettercap, Burp Suite, Scapy, Mimikatz, Hashcat, Konboot, Hydra, OWASP, SQLmap, mitmproxy, Skipfish and more! The completer beginner to advance level of ethical hacking course

    Who this course is for:
     


    This course was deigned for beginners and moves on to more advanced applications.

    Requirements


    •     A basic understanding of computer systems.
    •     Various open source pentesting applications.

    What you'll learn


    •     Think like a hacker.
    •     Perform effective reconnaissance.
    •     Thoroughly scan public networks.
    •     Monitor and intercept network traffic.
    •     Attack Windows and Linux systems.
    •     Penetrate web security.
    •     Hack humans using social engineering attacks.



     This course includes


    •     19.5 hours on-demand video
    •     7 downloadable resources
    •     Full lifetime access
    •     Access on mobile and TV
    •     Certificate of Completion






    Coupan Code  F4C430726B40111F9F9A

    NOTE :- Any coupon code for free courses is valid for a few days, so keep this in mind. )

    Stay Connected 



    website
    🌐https://www.hackingtruth.in
    🌐https://www.kumaratuljaiswal.in
    🌐https://iam.kumaratuljaiswal.in
    🌐https://academy.hackingtruth.in
    🌐https://hackingtruth.teachable.com
    🌐www.kumaratuljaiswal.wordpress.com
    ➖➖➖➖➖➖➖

    🔥 YT Channel 🔥

    https://youtube.com/c/whoiskumaratul

    ➖➖➖➖➖➖➖

    🔥 Stay Connected 🔥

    https://instagram.com/h4cking_truth.in_
    https://instagram.com/hackingtruthin
    https://fb.com/hackingtruthin
    https://twitter.co/hackingtruthin
    https://www.linkedin.com/company/hackingtruthin

    💥💥💥💥💥💥

    https://instagram.com/whoiskumaratul
    https://fb.com/whoiskumaratul
    https://twitter.com/whoiskumaratul
    https://linkedIn.con/whoiskumaratul



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)



  • Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?





    A word that is embeded in the mind of every youth in this modern period, and this words attracts these  youths so much that they cannot stop themselves and that is the word that and perhaps you will be the people from me who will get pleasure from inside by hearing the name hacking word and there will be many of you who want to become hackers, so in this modern era it it hacking. The word is very exciting.

    so, in via this article website we will know about ethical hacking, I think currently version of Ethical Hacking is in 10 ( CEHv10 ) trend and since many people are involved in preparing for the exam, we want that through this article too you can increase your knowledge in many places and share your knowledge.
    Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?




    About Hacking

    Hacking — Hacking is identifying weakness in computer systems or network to exploit its weakness gain access. Example of hacking :- using password cracking algorithm to gain access to a system.




    In mid 80s & 90s, The media termed hacking related to cyber crime as false. Some peacocks then started using the very beautiful word - before moral hacking and it has become ethical hacking. Just ridiculous.



    Media falsely related hacking to cyber crime. Some moron then started using a much pretty word — ethical to precede hacking and it’s become Ethical Hacking. Simply ridiculous.



    Cyber security training has developed a mushroom over the years. Most of them are just fake. And innocent youth who consider cyber security to be a demanding field of computer science are keen to become a hacker.



    No person can become a hacker from a street course like CEH. Nor can one become a successful hacker (LOL) by two or three years of undergraduate or diploma courses. Studying to become a successful security specialist requires a lot of sweaty hours of study and many nights of sleep with many systems.


    Those who cannot cope with the CLI should simply move away from the information security field. Also system scripting languages ​​such as bash, csh, sh, perl, python are required to write their own code to deal with the system and talk with the network. By using just the tools available in Kali Linux or using Metasploit etc., it does not mean that you are a good security expert or so-called hacker.


    Cyber security is a matter of own experience in dealing with vulnerabilities and threats. I saw many students who successfully completed a hacking course like CEH and still struggle to avoid getting stuck in simple Linux gotchas.







    Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?




    No, 10th and 12th class marks are not important in hacking career and not only 10th and 12th even graduation/post graduation marks also not important in hacking career. Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?



    You can excel in a cyber security career even without a degree, but you have the passion and determination to break into the system with your skilled mind (unlike the years of skill and patience that you have in films overnight Or do not become hackers in short time.)


    If you have a good knowledge on any one of the below

    • Network Security
    • web applications Security
    • Exploit writing
    • Reverse engineering
    • Wireless Security
    • IOT Security then no need of even degrees.

    For private companies: Your sound knowledge on concepts is irrespective of the certificate and marks you have obtained after graduation / post graduation. I know that some members (from hacking groups) excel in their hacking careers without a degree.



    For government companies : There is a systematic approach so here certificates and marks ( above 60%) matters.


    If you are passionate and enthusiastic about security try to learn above any one of concepts deeply then jobs will come after you.





    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • The concept of session hijacking and how to hijack a session IDs



    The concept of session hijacking and how to hijack a session IDs




    What is Session IDs ?

    A session ID is a unique number that a Web site's server assigns a specific user for the duration of that user's visit (session). The session ID can be stored as a cookie, form field, or URL (Uniform Resource Locator). Some Web servers generate session IDs by simply incrementing static numbers.


    For example, when you login to a website, the server assigns you a session Id and sends it to your browser wrapped in a cookie. The browser automatically sends the cookie back in the subsequent requests so the server knows who is making the request.

    Example

    https://www.hackingtruth.in/view/JBEX25022014152820
    https://www.kumaratuljaiswal.in/view/JBEX25022014153020
    https://academy.hackingtruth.in/view/JBEX25022014160020
    https://iam.kumaratuljaiswal.in/view/JBEX25022014164020


    ( NOTE :- If seen, the session ID is not visible in the URL of the HTTPS website, because HTTPS is secure and you can see in HTTP website.)



    As mentioned above, a session ID parameter appears in URL when a WCP application is first accessed. After the user logs in, WebLogic Server (WLS) generates an entirely new session, with a new session ID. If cookies are enabled in the browser, the new session ID will not appear as a URL parameter.




    Concept

    Session hijacking is a very interesting topic if we talk about the previous topic. In session hijacking, communication is happening between any two people, ie Attaker, between the client and the host, steals the session id of the client. The concept of session hijacking and how to hijack a session IDs

    The attacker usually intercept the communication to obtain the roles of authenticated user or for the intention of Man-in-the-Middle attack.

    Session Hijacking


    • Session hijacking refers to an attack where an attacker takes over a valid TCP communication session between two computers.
    • Since most authentication only occurs at the start of a TCP session, this allows the attacker to gain access to a machine.
    • Attackers can sniff all the traffic from the established TCP sessions and perform identity theft, information theft, fraud, etc.
    • The attacker steals a valid session ID and use it to authenticate himself with the server.





    Session Hijacking Techniques

    Session Hijacking process is categorized into the following three techniques :


    Stealing

    The attacker uses different techniques to steal session IDs.
    Some of the techniques used to steal session IDs:

    • Using the HTTP referrer header.
    • Sniffing the network traffic.
    • Using the cross-site-scripting attacks.
    • Sending Trojans on client machines.



    Guessing

    The attacker tries to guess the session IDs by observing variable parts of the session IDs.

    • http://www.hackingtruth.in/view/VW48266762824302
    • http://www.kumaratuljaiswal.in/view/VW48266762826502
    • http://academy.hackingtruth.in/view/VW48266762828902


    Brute-Forcing

    The attacker attempts different IDs until he succeeds.

    • Using brute force attacks, an attacker tries to guess a session ID until he finds the correct session ID.

    Other :

    Stealing Session IDs

    • Using a "referrer attack," an attacker tries to lure a user to click on a link to malicious site (say www.hackingtruth.in)

    Sniffing

    Attacker attempt to plcae himself in between vivtim and target in order to sniff the packet.


    Monitoring

    Monitor the traffic flow between victim and target.


    Types of Session Hijacking


    Active Attack: In an active attack, an attacker finds an acctive session and takes over.

    An attacker may send packets to the host in the active attack. In an active attack, the atttacker is manipulating the legitimate users of the connection. As the result of an active attack, the legitimate user is disconneted from the attacker.



    Passive Attack: With a passive attack, an attacker hijacks a session but sits back and watches and records all the traffic that is being sent forth.


    The essential difference between an active and passive hijacking is that while an active attack takes over an existing session, a passive hijack monitors an ongoing session.


    How to Hijack a Session ID ?

    We start with jumping into kali Linux"s Terminal and using the most widely used tool such as Ettercap, Hemster, Ferret. we will discuss about how to hijack a session. we will start session hijacking with man-in-the-middle attack and start capturing packets. Here is our attacker machine is kali linux and the victim is our local machine ( own network ).


    From Wikipedia

    Session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called session key—to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim’s computer. session hijacking using ettercap hemster ferret


    we will  use three types tools here such as :-
    Ettercap
    Hemster
    Ferret








    Hijack Session ID :- Click Here



         






    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)



  • How SQL Query works in database and how to hack database


    How SQL Query works in database and how to hack database


    SQL Injection


    SQL injection attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries. This malicious code is drafted with the intention of revealing or manipulating data that is stored in the tables within the database. SQL injection

    SQL Injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application. The fundamental concept of SQL injection is to impact commands to reveal sensitive information from the database. Hence, it can result to a high profile attack. How SQL Query works in database and how to hack database


    Attack Surface of SQL Injection


    Bypassing the authentication
    Revealing Sensitive Information
    Compromised Data Integrity
    Erasing The Database
    Remote Code Execution




    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w



    How SQL Query Works ?

    Injection of SQL query will be executed on the server and replied by the response. For example, following SQL Query is requester to the server.



    • SELECT  *  FROM  [ Orders ]
    • SELECT column1, column2, ....  FROM table_name;


    These commands will reveal all information stored in the databse "Oredrs" table. If an organization maintains records of their orders into a database, all information kept in this database table will be extracted by the command.






    Learn and understand CEH from scratch. A complete beginner's guide to learn CEH.

    Try it :- It's a Free 





    Otherwise let's understand with another Example



    In the following example, an attacker with the username link inserts their name after the = sign following the WHERE owner, which used to include the string 'name'; DELETE FROM items; -- for itemName , into an existing SQL command, and the query becomes the following two queries:



    • SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; DELETE FROM items;--






    Many of the common database products such as Microsoft’s SQL Server and Oracle’s Siebel allow several SQL statements separated by semicolons to be executed at once. This technique, known as batch execution, allows an attacker to execute multiple arbitrary
    commands against a database. In other databases, this technique will generate an error and fail, so knowing the database you are attacking is essential.



    If an attacker enters the string 'name'; DELETE FROM items; SELECT * FROM items WHERE   'a' = 'a' ,   the following three valid statements will be created:





    • SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; 

    • DELETE FROM items; SELECT * FROM items WHERE 'a' = 'a';



    A good way to prevent SQL injection attacks is to use input validation, which ensures that only approved characters are accepted. Use whitelists, which dictate safe characters, and blacklists, which dictate unsafe characters.


    Database





    SQL Delete Query

    The DELETE statement is used to delete existing records in a table. To understand, consider a table "Customers" in a database. The following information is the table "Customers" is containing.






    Execution of  "delete" command will eraase the record.


    • DELETE FROM Customers WHERE CustomerName='Alfreds Futterkiste';


    Now the database table will be like this :-






    There are lots of SQL query commands that can be used. Above are some of the most common and effective commands that are being used for injection.
    for example :-


    • UPDATE Customers SET ContactName = 'KumarAtulJaiswal', city= 'Delhi' WHERE CustomerID = 56;
    • INSERT INTO Customers (column1, column2, column3, ...)
      VALUES (value1, value2, value3, ...); 

    • Customers is a Table Name.


    SQL Injection Tools

    There are several tools available for SQL injection such as :-

    • BSQL Hacker
    • Marathon Tool
    • SQL Power Injecto
    • Havij


     Server Side Technologies

    Server-side technologies come in many varieties and types, each of which offers
    something specific to the user. Generally, each of the technologies allows the creation of dynamic and data-driven web applications. You can use a wide range of server-side technologies to create these types of web applications; among them are the following:

    • ASP
    • ASP.NET
    • Oracle
    • PHP
    • JSP
    • SQL Server
    • IBM DB2
    • MySQL
    • Ruby on Rails

    All of these technologies are powerful and offer the ability to generate web applications that are extremely versatile. Each also has vulnerabilities that can lead to it being compromised, but this chapter is not about those.



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • Learn and understand CEH from scratch. A complete beginner's guide to learn CEH

     


    Learn and understand CEH from scratch. A complete beginner's guide to learn CEH.



    You've likely heard about hacking—perhaps in movies or on the news—and you've certainly taken steps to protect your online identity from hackers. But what is hacking, who does it, and why? In this comprehensive course on the fundamentals of web hacking, answer these questions and more. Begin by reviewing the hacker methodology, types of hack attacks, and learn to configure test servers to hack yourself! Finally, review network mapping, and think through potential careers in cyber security. Learn and understand CEH from scratch. A complete beginner's guide to learn CEH


    Who this course is for:

    •     People who interested in hacking





    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w



    Course content


    Certified Ethical Hacking(CEH) Course [May 2020 Edition]


    • CEH Tutorial - Lecture 1
    • CEH Tutorial - Lecture 2
    • CEH Tutorial - Lecture 3
    • CEH Tutorial - Lecture 4
    • CEH Tutorial - Lecture 5
    • CEH Tutorial - Lecture 6
    • CEH Tutorial - Lecture 7

     This course includes


    • 43 mins on-demand video
    • Full lifetime access
    • Access on mobile and TV
    • Certificate of Completion

     




    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.