A word that is embeded in the mind of every youth in this modern period, and this words attracts these  youths so much that they cannot stop themselves and that is the word that and perhaps you will be the people from me who will get pleasure from inside by hearing the name hacking word and there will be many of you who want to become hackers, so in this modern era it it hacking. The word is very exciting.

so, in via this article website we will know about ethical hacking, I think currently version of Ethical Hacking is in 10 ( CEHv10 ) trend and since many people are involved in preparing for the exam, we want that through this article too you can increase your knowledge in many places and share your knowledge.
Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?

About Hacking

Hacking — Hacking is identifying weakness in computer systems or network to exploit its weakness gain access. Example of hacking :- using password cracking algorithm to gain access to a system.




In mid 80s & 90s, The media termed hacking related to cyber crime as false. Some peacocks then started using the very beautiful word - before moral hacking and it has become ethical hacking. Just ridiculous.



Media falsely related hacking to cyber crime. Some moron then started using a much pretty word — ethical to precede hacking and it’s become Ethical Hacking. Simply ridiculous.



Cyber security training has developed a mushroom over the years. Most of them are just fake. And innocent youth who consider cyber security to be a demanding field of computer science are keen to become a hacker.



No person can become a hacker from a street course like CEH. Nor can one become a successful hacker (LOL) by two or three years of undergraduate or diploma courses. Studying to become a successful security specialist requires a lot of sweaty hours of study and many nights of sleep with many systems.


Those who cannot cope with the CLI should simply move away from the information security field. Also system scripting languages ​​such as bash, csh, sh, perl, python are required to write their own code to deal with the system and talk with the network. By using just the tools available in Kali Linux or using Metasploit etc., it does not mean that you are a good security expert or so-called hacker.


Cyber security is a matter of own experience in dealing with vulnerabilities and threats. I saw many students who successfully completed a hacking course like CEH and still struggle to avoid getting stuck in simple Linux gotchas.

Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?

No, 10th and 12th class marks are not important in hacking career and not only 10th and 12th even graduation/post graduation marks also not important in hacking career. Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?



You can excel in a cyber security career even without a degree, but you have the passion and determination to break into the system with your skilled mind (unlike the years of skill and patience that you have in films overnight Or do not become hackers in short time.)


If you have a good knowledge on any one of the below

• Network Security
• web applications Security
• Exploit writing
• Reverse engineering
• Wireless Security
• IOT Security then no need of even degrees.

For private companies: Your sound knowledge on concepts is irrespective of the certificate and marks you have obtained after graduation / post graduation. I know that some members (from hacking groups) excel in their hacking careers without a degree.



For government companies : There is a systematic approach so here certificates and marks ( above 60%) matters.


If you are passionate and enthusiastic about security try to learn above any one of concepts deeply then jobs will come after you.





I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

A better Blogger experience on the web

Stats

Posts

Editor

Reading List

Settings

SQL Injection

SQL injection attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries. This malicious code is drafted with the intention of revealing or manipulating data that is stored in the tables within the database. SQL injection

SQL Injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application. The fundamental concept of SQL injection is to impact commands to reveal sensitive information from the database. Hence, it can result to a high profile attack. How SQL Query works in database and how to hack database

Attack Surface of SQL Injection

Bypassing the authentication
Revealing Sensitive Information
Compromised Data Integrity
Erasing The Database
Remote Code Execution

How SQL Query Works ?

Injection of SQL query will be executed on the server and replied by the response. For example, following SQL Query is requester to the server.

• SELECT  *  FROM  [ Orders ]
• SELECT column1, column2, ....  FROM table_name;

These commands will reveal all information stored in the databse "Oredrs" table. If an organization maintains records of their orders into a database, all information kept in this database table will be extracted by the command.







Try it :- It's a Free 





Otherwise let's understand with another Example



In the following example, an attacker with the username link inserts their name after the = sign following the WHERE owner, which used to include the string 'name'; DELETE FROM items; -- for itemName , into an existing SQL command, and the query becomes the following two queries:

• SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; DELETE FROM items;--

Many of the common database products such as Microsoft’s SQL Server and Oracle’s Siebel allow several SQL statements separated by semicolons to be executed at once. This technique, known as batch execution, allows an attacker to execute multiple arbitrary
commands against a database. In other databases, this technique will generate an error and fail, so knowing the database you are attacking is essential.



If an attacker enters the string 'name'; DELETE FROM items; SELECT * FROM items WHERE   'a' = 'a' ,   the following three valid statements will be created:

• SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; 

• DELETE FROM items; SELECT * FROM items WHERE 'a' = 'a';

A good way to prevent SQL injection attacks is to use input validation, which ensures that only approved characters are accepted. Use whitelists, which dictate safe characters, and blacklists, which dictate unsafe characters.

Database

SQL Delete Query

The DELETE statement is used to delete existing records in a table. To understand, consider a table "Customers" in a database. The following information is the table "Customers" is containing.






Execution of  "delete" command will eraase the record.

• DELETE FROM Customers WHERE CustomerName='Alfreds Futterkiste';

Now the database table will be like this :-






There are lots of SQL query commands that can be used. Above are some of the most common and effective commands that are being used for injection.
for example :-

• UPDATE Customers SET ContactName = 'KumarAtulJaiswal', city= 'Delhi' WHERE CustomerID = 56;
• INSERT INTO Customers (column1, column2, column3, ...)
  VALUES (value1, value2, value3, ...); 

• Customers is a Table Name.

SQL Injection Tools

There are several tools available for SQL injection such as :-

• BSQL Hacker
• Marathon Tool
• SQL Power Injecto
• Havij

 Server Side Technologies

Server-side technologies come in many varieties and types, each of which offers
something specific to the user. Generally, each of the technologies allows the creation of dynamic and data-driven web applications. You can use a wide range of server-side technologies to create these types of web applications; among them are the following:

• ASP
• ASP.NET
• Oracle
• PHP
• JSP
• SQL Server
• IBM DB2
• MySQL
• Ruby on Rails

All of these technologies are powerful and offer the ability to generate web applications that are extremely versatile. Each also has vulnerabilities that can lead to it being compromised, but this chapter is not about those.



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

Whats app Web How to Enable Dark Mode in a Simple Trick

WhatsApp is a very popular messenger app that is used all over the world and this application exists with a very beautiful web interface.  After accessing it all people can send messages to each other, irrespective of the place of the world.

Recently, WhatsApp had provided a dark mode future to all the users inside its application and all the users are waiting for them to use WhatsApp Dark mode in their browser and according to a report, the dark mod features in the browser of WhatsApp is going to come very soon.  It is currently under development and very soon the users may get to see these features.

That is why, before coming to this features, we are telling you a very good way, with the help of which you can run WhatsApp web in dark mode in your browser.

How To enable This Feature ?

Dark mode features have already been given to many users in WhatsApp applications.  But if you want.  Running WhatsApp in dark mode inside your browser.  For this, there is a very simple way that you have to activate.



#First of all, open the official website of your https://web.whatsapp.com/


#Open WhatsApp Web from the official page web.whatsapp.com.


#Log-in to the web interface: You need to open WhatsApp on your phone > tap on three-dot icons on the top right corner > tap on ‘WhatsApp Web’. Now scan the QR Code on the computer screen with your phone.


#Once you are logged in, right-click on the blank area outside the chat and select ‘Inspect’.


#The browser shows the inspector or console and the code of the page. Now you need to scroll to find the string— body class=“web”






#WABetaInfo said that “web” is the class of the original theme, the one we are currently using. To enable dark mode, we need to replace it with “web dark”.


#Once you replace the string, WhatsApp Web will turn to Dark Mode.



We tried the method and it worked fine for us. However, since changing the string using Inspect on a web page is only for preview purpose, WhatsApp Web will turn to normal mode once you refresh the page or close it.

The WhatsApp tracker also confirmed that the Dark Theme is not yet available and the platform is testing the feature in order to ensure a bug-free experience. Since the feature is under development, it is currently not available in the WhatsApp Web or the WhatsApp Desktop app.



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

Video Tutorial :- SooN

Top 9 phishing Tool for hack a social site, website etc

Today's youth was interested and more is being seen on hacking tomorrow, due to which if no one has technical knowledge.  He can also do hacking using a hacking tool and is a very well-known tool.  Which is called a fishing tool and this tool helps in many different types of fishing attacks. Top 9 Advance phishing Tool for hack a social site, website etc


Here you will be told about different types of fishing attack tools and the first tool is our Evilginx2.

1) EVILGINX2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.






EVILGINX2 is a  man-in-the-middle attack framework used for fixing login credentials along with session cookies, which in turns allows bypassing two factor authentication production


Github :- https://github.com/kgretzky/evilginx2

2) HIDDEN EYE

Modern Phishing Tool With Advanced Functionality And Multiple Tunnelling Services [ Android-Support-Available ]





Github :- https://www.cyberpunk.rs/hidden-eye-modern-phishing-tool

3) KING PHISHER

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness training to more complicated scenarios in which user aware content is served for harvesting credentials. Top 9 Advance phishing Tool for hack a social site, website etc










King Phisher is only to be used for legal applications when the explicit permission of the targeted organization has been obtained.


Github :- https://github.com/rsmusllp/king-phisher

See Also :- 

• How To Change MAC Address :- Click Here 

• Find Leaked Email and Password via onion service :- Click Here

4) GOPHISH

Gophish is open source facing toolkit design for business and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagement and security awareness training.






Website :- https://getgophish.com/

5) WIFIPHISHER

Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be further used to mount victim-customized web phishing attacks against the connected clients in order to capture credentials (e.g. from third party login pages or WPA/WPA2 Pre-Shared Keys) or infect the victim stations with malwares.






Github :-  https://github.com/wifiphisher/wifiphisher

6) BLACK EYE

The most complete phishing tool, with 32 templates+1 customizable.




Github :-  https://github.com/thelinuxchoice/blackeye

7) EDUCATION PHISHING TOOL

Educational Phishing Tool & Information Collector.




Github :- https://github.com/UndeadSec/SocialFish

8) SOCIAL MEDIA PHISHING PAGES

The way phishing works is that an attacker clones a trusted website or spoofs an email of a known target which leads the person to believe that he is visiting a trusted website like social media sites, e.g.,  shellphish github termux Facebook, SnapChat, Instagram, Google, Netflix, and so on. The target will then put his/her username and password on the malicious website (cloned website) and then the username and password will be sent to the attacker instead of the real website, and the target will be redirected to the real website. Let’s do a demo of phishing using shellphish. shellphish github download





Website :- https://www.hackingtruth.in/2019/10/the-linux-choice-shell-phish.html

9) ZPHISHER

Zphisher is an upgraded form of Shellphish. The main source code is from Shellphish. But I have not fully copied it. I have upgraded it & cleared the Unnecessary Files. It has 37 Phishing Page Templates ; including Facebook , Twitter & Paypal. It also has 4 Port Forwarding Tools .







Github :- https://github.com/htr-tech/zphisher






I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

The health and privacy of the Arogya Setu app is causing a lot of controversy. On Tuesday, Elliot Alderson, a French hacker and cyber security expert, claimed that there were flaws in the security of the sanatorium bridge app, while now Elliot Alderson claimed to have hacked the sanatorium bridge app. Alderson claimed in a tweet that the health of five people in the Prime Minister's Office is not well. Aarogya Setu app hacked, hacker Elliot Alderson said - five people are ill in PMO

 

What did Elliot Alderson claim?

Elliott Alderson has tweeted that the Arogya Setu app is an open source app. He has also claimed that the health of five people in the PMO office is bad and they got this information from the Arogya Setu app. Alderson has also claimed that 2 people are unwell at the headquarters of the Indian Army, one man in
Parliament is infected with Corona and three people in the Interior Ministry.

This is the issues. I will give a technical explanation later today in an article

— Elliot Alderson (@fs0c131y) May 6, 2020

Explain that Union Minister Ravi Shankar Prasad has termed the opposition's questions and allegations on the Arogya Setu App as baseless. Union IT Minister Prasad said that this app is very strong in terms of data and privacy protection. Prasad said, 'This is India's technological innovation and is effective in fighting Covid-19.





Congress MP Rahul Gandhi also alleged a few days ago that the 'Arogya Setu' app is a state-of-the-art surveillance system, which is causing serious concerns about privacy and data security. Rahul gandhi said in the tweet that the Arogya Setu is a state-of-the-art monitoring system that has been outsourced to a private operator and has no institutional investigation.

And yes, yesterday:
- 5 people felt unwell at the PMO office
- 2 unwell at the Indian Army Headquarters
- 1 infected people at the Indian parliament
- 3 infected at the Home Office

Should I continue?

— Elliot Alderson (@fs0c131y) May 6, 2020

He said that this is causing serious concerns about data security and privacy. Technology can help us stay safe but we should not be afraid to monitor them without the consent of the citizens.


I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

how to change MAC address with mac changer

MAC (Media Access Control) address spoofing can come useful in many situations. By changing MAC address, one can protect his/her system from system identification bots which look for MAC address to exploit network administrative privileges, fool freely available internet service in order to bypass network access and bandwidth usage restrictions, make system more secure by disguising MAC address or by replacing it with other NICs randomly generated MAC address for security purposes. how to change MAC address with mac changer 


Sadly, basic network tools are only for changing DHCP settings, switching between different network profiles, ping DNS servers, etc., therefore, you need to use a dedicated tool to change your Network Interface MAC address. Tecnitium MAC address Changer is developed to change your Network Interface Card (NIC) MAC address. You can choose NIC from the given list whose MAC address will replace your original MAC address.




Technitium MAC Address Changer allows you to change (spoof) Media Access Control (MAC) Address of your Network Interface Card (NIC) instantly. It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has a MAC address hard coded in its circuit by the manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Network (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address. Technitium MAC Address Changer is a must tool in every security professionals tool box.

Features

• Works on Windows 10, 8 & 7 for both 32-bit and 64-bit.
• Enhanced network configuration presets with IPv6 support allow you to quickly switch between network configurations.
• Allows complete configuration of any network adapter.
• Command line options with entire software functionality available. You can select a preset from specified preset file to apply directly.
• Update network card vendors list feature allows you to download latest vendor data (OUI) from IEEE.org.

How To Change MAC Address

1. Starting MAC address changer will list all available network adapters.
2. Select the adapter you want to change the MAC address. You will get the details of your selection below.
3. In the Information tab, find the Change MAC Address frame. Enter new MAC address in the field and click Change Now! button. You may even click Random MAC Address button to fill up a randomly selected MAC address from the vendor list available.
4. To restore the original MAC address of the network adapter, select the adapter, click Restore Original button in the Change MAC Address frame.

NOTE: This tool cannot change MAC address of Microsoft Network Bridge. Network Bridge will automatically use the original MAC address of the first NIC added into bridge with the first octet of MAC address set to 0x02.




     

Find Leaked Email and Password via onion service

Leaked Email and Password

Billions of email addresses and plain text passwords have been leaked online by an unknown party, leaving countless Internet users at risk from credential stuffing and other attacks. Search for leaked email and password using the onion service

Security researcher Bob Diachenko discovered the unsafe elastics search database on 4 December, although it was first indexed by the BinaryAidz search engine and therefore has been publicly available since the beginning of the month.

Access to the database was disabled on 9 December when it reported to the US-based ISP hosting the IP address, giving potential hackers more than enough time to scrape the logged-in data.

In total, the database contained 2.7 billion email addresses and plain text passwords for more than a billion of them - providing a true starting point for a credential stuffing campaign.

How To Find Leaked Email and Passwords

We will use pwndb tool to find the password email leaked here...pwndb.py is a python command-line tool for searching leaked credentials using the Onion service with the same name. Search for leaked email and password using the onion service

Installation

git clone https://github.com/davidtavarez/pwndb




cd

ls





pip3 install -r requirements.txt  OR  pip install -r requirements.txt





Then, type "  virtualenv venv   " without quotes and hit enter...





source venv/bin/activate








Full Post :-  Click Here

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

Video Tutorial :- 

          

 

Two new features coming in WhatsApp, will be beneficial in lockdown

The video conferencing platform Zoom is becoming increasingly popular worldwide. In view of this, other companies are also constantly changing their video calling software and expanding its scope. Two new features coming in WhatsApp, will be beneficial in lockdown

Instant messaging app WhatsApp is also working on adding more people to group video calls. Currently, only four people can do video calling simultaneously in WhatsApp.




The hint has been found from the WhatsApp beta released for Android that the company can increase the limit of group video calls. Since dozens of people can video chat simultaneously on other video calling platforms such as Zoom and Google Duo, and now it is becoming a necessity for social distancing.

According to a report by WhatsApp's website, WABetainfo, which keeps track of the features of WhatsApp, an extended group limit has been given in WhatsApp v2.20.128 beta released for Android. However, it has not yet been enabled by the company for the public.







At the moment, it is not clear how much will be done by increasing the limit for group calls in WhatsApp. But soon the company can announce this, because recently WhatsApp had made some changes in group calling.

Significantly, WhatsApp has made some changes in the group calling interface. A dedicated button has been provided for group video calling so that you can directly tighten the call to all group members. For this, everyone has an updated WhatsApp version.






Talking about another new feature of WhatsApp regarding calling, a new call header has come in Android v2.20.129 version. Actually, in this call header, it will be mentions that the call and touch is encrypted.

This end to end encryption means that neither WhatsApp nor any agency will be able to decode the data of conversations between two people.




I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

critical bug in VMware opens up corporate Treasure to hackers

A critical information-disclosure bug in VMware’s Directory Service (vmdir) could lay bare the contents of entire corporate virtual infrastructures, if exploited by cyberattackers. critical bug in VMware opens up corporate Treasure to hackers
The vmdir is part of VMware’s vCenter Server product, which provides centralized management of virtualized hosts and virtual machines (VMs) from a single console. According to the product description, “a single administrator can manage hundreds of workloads.”



These workloads are governed by a single sign-on (SSO) mechanism to make things easier for administrators; rather than having to sign into each host or VM with separate credentials in order to gain visibility to it, one authentication mechanism works across the entire management console.

The vmdir in turn is a central component to the vCenter SSO (along with the Security Token Service, an administration server and vCenter Lookup Service). Also, vmdir is used for certificate management for the workloads governed by vCenter, according to VMware.






The critical flaw (CVE-2020-3952) was disclosed and patched on Thursday; it rates 10 out of 10 on the CVSS v.3 vulnerability severity scale. At issue is a poorly implemented access control, according to the bug advisory, which could allow a malicious actor to bypass authentication mechanisms.



“Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls,” the description explained.







As for the attack vector, “a malicious actor with network access to an affected vmdir deployment may be able to extract highly sensitive information,” VMware noted. In turn, this information could be used to compromise the vCenter Server itself “or other services which are dependent upon vmdir for authentication.”

There are no workarounds, but administrators are encouraged to apply the patches as soon as possible.

vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected, according to the company. To help administrators find out if their vmdir deployments are affected by CVE-2020-3952, the vendor has published a how-to knowledge base document.






“VMware, one of, if not the most, popular virtualization software companies in the world, recently patched an extremely critical information disclosure vulnerability…one of the most severe vulnerabilities that has affected VMware software,” Chris Hass, director of information security and research at Automox, told Threatpost. “vCenter Server provides a centralized platform for controlling VMware vSphere environments, it helps manage virtual infrastructure in a tremendous number of hybrid clouds, so the scope and impact of this vulnerability is quite large. Organizations using vCenter need to check their vmdir logs for affected versions, ACL MODE: legacy, and patch immediately.”

No specific acknowledgments were given for the bug discovery – VMware noted only that it was “disclosed privately.”

Multi device and auto delete message support coming in WhatsApp

Instant messaging app WhatsApp has been working on multi-device support for some time. Now you can run WhatsApp on only one smartphone from a mobile number. But under this feature, you will be able to run a mobile account on different devices.


Instant messaging app WhatsApp has been working on multi-device support for some time. Now you can run WhatsApp on only one smartphone from a mobile number. But under this feature, you will be able to run a mobile account on different devices.






Instant messaging app WhatsApp has been working on multi-device support for some time. Now you can run WhatsApp on only one smartphone from a mobile number. But under this feature, you will be able to run a mobile account on different devices. Multi device and auto delete message support coming in WhatsApp


WhatsApp's multi-device support when the public will roll out after the final build, it is not known at the moment. So far, the company has not officially said anything about this feature.







WhatsApp's multi-device support when the public will roll out after the final build, it is not known at the moment. So far, the company has not officially said anything about this feature.



WhatsApp's multi-device support when the public will roll out after the final build, it is not known at the moment. So far, the company has not officially said anything about this feature.

5 popular ways to earn from internet, Rs 1000 in just one hour sitting at home. Earn up to

 

 

1. Virtual Call Center Agent

What to do

2. Swagbucks.com (http://www.swagbucks.com)

3. Online Work

The number of fraudsters is increasing due to online work. These fraudsters promise to give money and get the work done online, but do not pay. Giving you the advice to be careful with such fraudsters, you are telling you to earn by working online. Sites like www.odesk.com and www.elance.com are also among the famous sites worldwide in terms of online earning. In both these sites, first you have to prove yourself useful for the site by giving a test. Once registered, the site hires members as contractual and freelancers for different purposes. On completion of work, he pays by the hour or by other means. Many websites around the world do this.

4. Self Publish Book

5. Paid Review

Writing reviews for software or other products. If your ability in writing is tremendous, you can earn through it. Apart from this, Infolink is also a medium. For this, many websites give you work like paid review. Among these, Vindale Research and ExpoTV.com (ExpoTv.com) are the major websites which pay good money for this.