-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label hacking. Show all posts
Showing posts with label hacking. Show all posts
  • TorghostNG - How to anonymize your internet traffic






    So today we will know about the open source tool that helps in keep anonymous, TorghostNG - Make all your internet traffic anonymized with Tor network. This tool is scripted in python language as you can tell -_- you can help us by subscribing to our youtube channel :. Kumar Atul Jaiswal .: before using the too.


    About TorghostNG


    TorghostNG is a tool that make all your internet traffic anonymized through Tor network.

    Rewritten from TorGhost with Python 3.

    TorghostNG was tested on:


    •     Kali Linux
    •     Manjaro
    •     ...
      
      
    Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. Privoxy has a flexible configuration and can be customized to suit individual needs and tastes. It has application for both stand-alone systems and multi-user networks.
    TorghostNG - Make all your internet traffic anonymized with Tor network.

    Before you use TorghostNG


    • For the goodness of Tor network, BitTorrent traffic will be blocked by iptables. Although you can bypass it with some tweaks with your torrent client disappointed_relieved. It's difficult to completely block all torrent traffic.
    • For security reason, TorghostNG is gonna disable IPv6 to prevent IPv6 leaks (it happened to me lmao or whatismyip.live). tor network TorghostNG  - How to anonymize your internet traffic


    Installing TorghostNG


    TorghostNG currently supports:
    •     GNU/Linux distros that based on Arch Linux
    •     GNU/Linux distros that based on Debian/Ubuntu
    •     GNU/Linux distros that based on Fedora, CentOS, RHEL, openSUSE
    •     Solus OS
    •     Void Linux
    •     Anh the elder guy: Slackware
    •     (Too much package managers for one day :v) torghostng

    How To Install ?

    1) git clone https://github.com/githacktools/TorghostNG




    2) ls

    cd TorghostNG

    ls






    3) sudo python3 install.py






    4) sudo python3 torghostng.py







    5) sudo python3 torghostng.py -s -c -id it











    https://www.hackingtruth.in/2020/06/xss-vulnerability-find-in-any-website.html





    Disclaimer

    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :- 

     

  • XSS vulnerability search in any website within minutes





    So today we will know about the open source tool that helps in finding XSS cross site scripting attack for any website. This tool is scripted in go language as you can tell -_- you can help us by subscribing to our youtube channel :. Kumar Atul Jaiswal .: before using the too.



    XSS Vulnerability


    Cross-site scripting ( XSS )is a type of computer security vulnerability typically found in web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.  XSS Vulnerability find in any website within minutes
    XSS vulnerability search in any website within minutes



    Dalfox


    Just, XSS Scanning and Parameter Analysis tool. I previously developed XSpear, a ruby-based XSS tool, and this time, a full change occurred during the process of porting with golang!!! and created it as a new project. The basic concept is to analyze parameters, find XSS, and verify them based on DOM Parser.

    I talk about naming. Dal(달) is the Korean pronunciation of moon and fox was made into Fox(Find Of XSS). XSS Vulnerability find in any website within minutes

    Key features



    • Paramter Analysis (find reflected parameter, find free/bad characters, Identification of injection point)
    • Static Analysis (Check Bad-header like CSP, X-Frame-optiopns, etc.. with base request/response base)
    • Optimization query of payloads
    •         Check the injection point through abstraction and generated the fit  payload.
    •         Eliminate unnecessary payloads based on badchar

    • XSS Scanning(Reflected + Stored) and DOM Base Verifying
    • All test payloads(build-in, your custom/blind) are tested in parallel with the encoder.
    •         Support to Double URL Encoder
    •         Support to HTML Hex Encoder


    • Friendly Pipeline (single url, from file, from IO)
    • And the various options required for the testing :D
    •         built-in / custom grepping for find other vulnerability
    •         if you found, after action
    •         etc..


    How To Install ?


    There are a total of three ways to Personally, I recommend go install.


    1) clone this repository

    git clone https://github.com/hahwul/dalfox



    XSS vulnerability search in any website within minutes



    ls

    cd dalfox 

    ls




    https://www.hackingtruth.in/2020/06/xss-vulnerability-find-in-any-website.html





    Disclaimer


    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :- 

     

     

             





  • send a unlimited SMS via sms bombing and call bomber in any number



    SMS Bombing & Call bomber in any number


    So today we will know about the special technique of unlimited sending sms, which is named SMS bombing so, we will covered in this article about SMS Bombing and How to use ?  so, you can use this tool in kali linux, windows and MacOS also. so, lets get started!


    SMS Bombing & Call bomber


    Due misusing of TBomb, several API's died. Don't be afraid if you don't see all send messages. call bomber


    • The script requires working network connection to work.
    • No balance will be deducted for using this script to send SMS/calls.
    • While doing infinite bombing use 2-3 seconds delay and 10 to 20 threads for maximum performance.
    • Don't put spaces in between phone number (Ex- 99999 99999)
    • Make sure you are using the latest version of TBomb
    • Make sure you are using Python3. SMS Bombing & Call bomber in any number  custom sms bomber



    Here's how you can check it. Type this command in your terminal.


    python -V



    Features:


    • Lots of integrated SMS/call APIs
    • Unlimited (Limited against abusing) and super-fast bombing
    • International bombing available (APIS Dead. Try Your Luck.)
    • Call bombing
    • Frequent updates
    • Automatic updating mechanism
    • Easy to use and embed in code




    How To Use ? ( LInux )


    step 1 :- First we need to install sms bombing tool so,

    git clone https://github.com/TheSpeedX/TBomb





    ls

    cd







    Run


    bash TBomb.sh










    Press 1 To  Start SMS Bomber
    Press 2 To  Start Call Bomber
    Press 3 To  Update (Works On Linux And Linux Emulators)
    Press 4 To  View Features
    Press 5 To  Exit



    I will choose option 1 so, press 1 and hit enter







    Enter Your Country Code ( without + ) : 91
    Enter Target Number : +91 7979*********
    Enter Number of Messages To Send ( 0 For Unlimited ) : 0
    Enter Delay Time ( in Seconds ) [Recommended 2 sec ] : 2
    Number Of Threads(10 to 20) : 19

    and then hit enter











    call bomber
    custom sms bomber
    sms bomber script
    sms bomber protection
    sms bomber
    android missing tricks
    sms bomber telegram
    sms bomber
    turbo bomber
    sms app
    Kali linux

    For Termux:


    Notice:

    git installation methods are not universal and do differ between distributions, so, installing git as per instructions below may not work. Please check out how to install git for your Linux distribution. Commands below provide instructions for Debian-based systems.

    To use the bomber type the following commands in Termux:

    pkg install git
    pkg install python
    git clone https://github.com/TheSpeedX/TBomb.git
    cd TBomb
    chmod +x TBomb.sh
    ./TBomb.sh




    For macOS:


    To use the bomber type the following commands in macOS terminal:

    # Install Brew:

    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

    # Install dependencys:

    brew install git
    brew install python3
    sudo easy_install pip
    sudo pip install --upgrade pip
    git clone https://github.com/TheSpeedX/TBomb.git
    cd TBomb
    chmod +x TBomb.sh

    # Missing Tools on MacOS

    Toilet cannot be installed yet. But TBomb does still work.

    # Run TBomb:

    sudo bash TBomb.sh







    Disclaimer

    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :- SOON



  • How to hack instagram password 2020 methods


    How to hack instagram password 2020 methods



    Today's youth focus less on ethical hacking and more in hacking, how to steal the password of people's social media accounts and hack their account.


    After Facebook, Instagram is one of the most popular social media platforms, especially among teenagers and early adults who have made it a profession. For some reason, like if you forgot your login password, you want to see what your child has done on Instagram, or see if your partner cheated on you, etc., you need to give yourself or someone else's May need to hack Instagram account. To cater to your needs, here, I will present 4 simple and reliable ways for you.


    And even if you are an ethical hacker or a programmer, some people will still tell you that please hack the password of an Instagram, my girlfriend cheats on me or my husband / wife is chatting with someone else to find me. Is in this way. It has become a very normal thing, every one of them gives excuse only which seems to lie clearsfaly.   How to hack instagram password 2020 method



    The Solution to Your Problem – How to Hack Instagram Account


    Fortunately, there are talented software developers out there that have spent their valuable time creating products that help you get around the security protocols of an Instagram account. We’re going to look at four different ways to hack your Instagram profile and gain access to your images and stories.
    ftk imager


    Method 1 : Hack an Instagram Account Password with a Keylogger



    Keylogger software applications are increasing in popularity as a means to circumvent Instagram security and break into a password-protected account. Here is a brief review of pout top 2 favorite keyloggers for 2020.
    mSpy
    mSpy is perhaps the most successful spying tool available online. You’ll need to pay a subscription fee to access most of the features that let you hack an Instagram account, but the free demo trial allows you to;
    website hacking


    • View general information on the profile.
    • Check activity on any cell phone.
    • See the last location known and ten most frequently called contacts.


    When you pay your subscription fee, the service gives you access to the follo0wing features;  exploit db


    • Ability to view all media files and direct links sent from the target account.
    • Ability to see all of the DM’s from the target account.
    • Ability to hack Instagram password and username.
    • Complete control over the target Instagram account.

    Get mSpy by clicking the button below.


    How to hack instagram password




    mSpy is an app built with stealth in mind, making it one of the most popular choices for a Keylogger on practically any platform., The program works equally well on WhatsApp, Facebook, Snapchat, and Twitter accounts as well.

    After installing the app on a device, you can remove any trace of it, hiding it from the view of the device user. The app continues to work in the background and sending you the requested data. To access the premium features of the app, you’ll need to purchase the premium package as well as root your iOS or Android phone.

    How to hack Instagram account and password with the mSpy Software Tool
    We prefer using these Keylogger tools over the traditional brute-force of phishing methods. Developers spent hours creating these efficient tools to reduce the time you spend on hacking an account. Therefore, it’s so much easier to use a pre-built product, than trying to create a phishing page or guessing passwords. nexpose



    Here is a step-by-step guide to using mSpy for hacking an Instagram password.

    Step 1 – Root your Android or iOS device – this function only works with rooted devices.

    Step 2 – Purchase the premium version of the mSpy software tool.

    Step 3 – Purchase the family package to track or crack up to 3 devices.

    Step 4 – Click the mSpy link and choose iOS or Android configuration.

    Step 5 – Visit the control panel, select “Keylogger,” or “Instagram tracker.”

    Step 6 – Execute the program and wait for results.


    It’s important to understand the difference between the Keylogger and Instagram tracker functions. Keylogging allows you to record and access all of the keys pressed on the device’s keypad. The program sifts through this information and deciphers the password to the Instagram account your targeting.

    The Instagram tracking feature on mSpy gives you access to all of the messages exchanged between the target profile and their audience.

    We like mSpy for its user-friendly interface and efficiency at cracking Instagram passwords. However, we think that the premium subscription fee might be a little expensive for this product when there are others out there offering the same functionality at a better price. instagram password hack
    XNSPY   web application penetration testing



    We like this app for its efficient operation and snappy response time. XNSPY assists with all of the functions you would expect from a premium Instagram hacking tool. XNSPY allows users to hack private accounts as well, allowing you to see all of their posts and stories – without their knowledge or consent.



    XNSPY keeps a backup of all of the images on the target accounts, and operates as a stealth app, running in the background of other people’s mobile devices. The only thing we don’t like about XNSPY is that you need to install it on the phone of the target account physically. The user won’t be able to see that the apps are running, and it won’t show up in their app tray.

    Here is a brief guide to using XNSPY to view another person’s Instagram.

    Accessing an Instagram Account Using XNSPY


    Step 1 – Subscribe to Xnspy and install it on your device and the target device.

    Step 2 – Apple users can configure an iCloud backup.

    Step 3 – Wait for 48-hours for the app to transfer data from the target account to your XNSPY dashboard.

    Step 4 – Log into cp.xnspy.com and enter your login information.

    Step 5 – Navigate to the dashboard.

    Step 6 – Visit “Photos.”

    Step 7 – Click “search.”

    Step 8 – Select “Instagram”

    Step 9 – Select timeframe – ‘Today,’ ‘This Month,’ ‘This year’ or ‘All.’

    Step 10 – Click “search.”


    XNSPY is not a full-suite app like mSpy, but its effectiveness at helping concerned parents keep an eye on their kid’s social life. To pain control of an account, you’ll need to invest in the premium version of mSpy.

     

    Method 2 : Password Guessing

    Password guesssing is the process of attempting to gain access to a  system through the systematic guessing of passwords in an attempt to gain a login to a target instagram account.



    We’ve all heard the warnings about the need to change our passwords every time( monthly ), and always use a random-generated password ( like Sasw@12.in#23, heih##123.in2, 123firo.3in3 etc ) for the best security option. Given this fact, it’s surprising how many people still refuse to adopt this basic internet security protocol.



    There are many software security forms that releasae the list top 25 most common passwords every year, like Splash Data Firm etc.


    SplashData estimates that over 70 percent of all online users have used one of these 25-passwords at some point in their online experience.



    Top 25 Most Common Passwords according to SplashData


    1.     123456
    2.     Password
    3.     12345678
    4.     qwerty
    5.     12345
    6.     123456789
    7.     letmein
    8.     1234567
    9.     football
    10.     iloveyou
    11.     admin
    12.     welcome
    13.     monkey
    14.     login
    15.     abc123
    16.     starwars
    17.     123123
    18.     dragon
    19.     passw0rd
    20.     master
    21.     hello
    22.     freedom
    23.     whatever
    24.     qazwsx
    25.     trustno1




    How to hack instagram password




    If you’re trying to hack an Instagram account, and you know the person well, try using their birthday or the names of their family members for the password. These options are also commonplace among over 60-percent of all online users.




    Method 3 : Phishing Method

    Phishing method attempt to gain sensitive, confidential information such as usernames, passwords, credit card information, network credentials and more.

    Every single person searches the Internet.  How to get the password of instagram ,facebook, twitter because actions also believe that the easiest method is a phishing attack.



    When people search online for information regarding hacking an account, they often come across phishing because of its success rate and the social proof surrounding the reliability of the method.



    Hackers simply create a fake Instagram login page and wait for the user to enter their account information and password. The phony page records the details and sends them to the hacker in a text file for easy access. The hacker now has the password for the account and can log on to the profile whenever they please.



    Hackers build this fake login page through specialized apps designed to help Instagram users manage their accounts more efficiently. In reality, it’s a back-door system intended to help you circumvent Instagram’s security features. Another strategy involves emailing the link to the fake login page directly to the user, hoping they will enter their details.

    Once a hacker has access to your Instagram password, its reasonably easy for them to gain access to all of your other social media accounts, including Twitter and Facebook. Facebook links to Instagram, and many people use the same password for all of their social platforms.

    Hackers monetize this data and sell it on the dark web for a tidy profit. In some cases, the victim of the hack won’t even know a hacker has compromised their account because the spoofed login page leads them directly to their profile as if nothing is out of the ordinary.

    How Do Instagram Phishers Control Accounts?
    Hackers use two different methods to control the victims profile when gaining access to an Instagram account – Stealth mode, and Owners mode.




    How to Create an Instagram Phishing Page from Scratch

    Since phishing is such a popular topic for hacking any kind of online account password, we thought we would give you everything you need to know about this method, in one post. To complete the phishing page, you’ll need;

    • An internet connection.
    • Web Hosting account.
    • ig_login_page.rar file. Download it on your desktop. You’ll need it later.
     To open this “.rar” archived file use WinRar sofware. You can download it here (official website).– Password to open this file is “securityequifax” (Without quotes).

    Once you’ve assembled all of this, it’s time to get to work. Follow this step-by-step guide to setting up a fake Instagram login page.


    Step 1 – Register a free hosting account at www.000webhost.com. You can also use some paid hosting if you want – even better, because free ones can get banned if their system detects you’re using them for phishing, which is against their Terms of Service policies.
    Important: When you choose website name while registering, choose smart. This will later be your website link you’re going to send to potential victims.
    I’ve chosen “myigpage” for this demonstrative purpose.

    Step 2 – Confirm your email address. Be patient as their email might come with delay. I’ve waited mine around 8 minutes.

    Step 3 – You’re ready to start building page. Go inside your account and choose “Upload Own Website”.


    Step 4 – Now extract your “ig-login-page.rar” file you’ve previously downloaded in a new empty folder. You should have 11 new files extracted from it.

    Step 5 – Upload these 11 files into your new website. Choose “Upload Files” option from a upper right corner.

    Step 6 – Your phishing page should be ready now and working. Check it by visiting your link you’ve created at beginning (your-username.000webhostapp.com) in a new tab of your internet browser.

    When you open your link, Instagram fake login page should be shown. If you can’t see it, means you made something wrong.

    Step 7 – Now you need to use your imagination to fool your victims to login trough your link. Tricks which hackers often use is they send fake emails to their victims saying something like “Someone tried to hack your account. Login trough this link with valid password to confirm it’s yours.” And by this link you put your phishing one.
    There are so many techniques how you can trick your victims. Just be creative.

     Step 8 – After someone entered their username and password into your fake IG login page, you can see their login information by typing /password.html at the end of your link in a URL browser, and hit enter.




    Method 4. Use Instagram Password Hacking Tool

    Instahack not only allows you to recover the password but also snoop around in the account. It is one of the fastest methods and is entirely free of cost. It works on both Android and iOS phones and tablets. Here are the steps to hack Instagram account:

    Step 1. Visit the website and tap on the Start Hacking button.

    Step 2. Enter the username of the account you want to hack. Click Hack and let the magic unroll in front of you.

    Step 3. Once the status confirms that the website has found the password. Click on Continue.

    Step 4. A pop-up box will appear on your screen. Write down the password and use it to unlock the victim’s account.

    Tool (website) :- https://instahacking.com




    Method 5. Use Instaleak for Instant Password Recovery


    Instaleak is another simple way to hack Instagram password and account. The software uses an in-built IP spoofer to cover your IP, so you can’t be tracked back. It has an easy to use interface, so you won’t have any difficulty in navigating your way around. Let’s check how to use Instaleak:
    Step 1. Open the official website and enter the username you want to hack. You don’t need to login to use the feature.

    Step 2. Tap on the verify button. In only a few seconds, a message will pop-up on your screen informing you that the password has been recovered.

    Step 3. Write down the password on a piece of paper or in your mobile phone.

    Step 4. Download Instagram on your phone or login into the account using the user ID and password.


    How to hack instagram password





    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)

    Disclaimer


    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.




  • The concept of session hijacking and how to hijack a session IDs



    The concept of session hijacking and how to hijack a session IDs




    What is Session IDs ?

    A session ID is a unique number that a Web site's server assigns a specific user for the duration of that user's visit (session). The session ID can be stored as a cookie, form field, or URL (Uniform Resource Locator). Some Web servers generate session IDs by simply incrementing static numbers.


    For example, when you login to a website, the server assigns you a session Id and sends it to your browser wrapped in a cookie. The browser automatically sends the cookie back in the subsequent requests so the server knows who is making the request.

    Example

    https://www.hackingtruth.in/view/JBEX25022014152820
    https://www.kumaratuljaiswal.in/view/JBEX25022014153020
    https://academy.hackingtruth.in/view/JBEX25022014160020
    https://iam.kumaratuljaiswal.in/view/JBEX25022014164020


    ( NOTE :- If seen, the session ID is not visible in the URL of the HTTPS website, because HTTPS is secure and you can see in HTTP website.)



    As mentioned above, a session ID parameter appears in URL when a WCP application is first accessed. After the user logs in, WebLogic Server (WLS) generates an entirely new session, with a new session ID. If cookies are enabled in the browser, the new session ID will not appear as a URL parameter.




    Concept

    Session hijacking is a very interesting topic if we talk about the previous topic. In session hijacking, communication is happening between any two people, ie Attaker, between the client and the host, steals the session id of the client. The concept of session hijacking and how to hijack a session IDs

    The attacker usually intercept the communication to obtain the roles of authenticated user or for the intention of Man-in-the-Middle attack.

    Session Hijacking


    • Session hijacking refers to an attack where an attacker takes over a valid TCP communication session between two computers.
    • Since most authentication only occurs at the start of a TCP session, this allows the attacker to gain access to a machine.
    • Attackers can sniff all the traffic from the established TCP sessions and perform identity theft, information theft, fraud, etc.
    • The attacker steals a valid session ID and use it to authenticate himself with the server.





    Session Hijacking Techniques

    Session Hijacking process is categorized into the following three techniques :


    Stealing

    The attacker uses different techniques to steal session IDs.
    Some of the techniques used to steal session IDs:

    • Using the HTTP referrer header.
    • Sniffing the network traffic.
    • Using the cross-site-scripting attacks.
    • Sending Trojans on client machines.



    Guessing

    The attacker tries to guess the session IDs by observing variable parts of the session IDs.

    • http://www.hackingtruth.in/view/VW48266762824302
    • http://www.kumaratuljaiswal.in/view/VW48266762826502
    • http://academy.hackingtruth.in/view/VW48266762828902


    Brute-Forcing

    The attacker attempts different IDs until he succeeds.

    • Using brute force attacks, an attacker tries to guess a session ID until he finds the correct session ID.

    Other :

    Stealing Session IDs

    • Using a "referrer attack," an attacker tries to lure a user to click on a link to malicious site (say www.hackingtruth.in)

    Sniffing

    Attacker attempt to plcae himself in between vivtim and target in order to sniff the packet.


    Monitoring

    Monitor the traffic flow between victim and target.


    Types of Session Hijacking


    Active Attack: In an active attack, an attacker finds an acctive session and takes over.

    An attacker may send packets to the host in the active attack. In an active attack, the atttacker is manipulating the legitimate users of the connection. As the result of an active attack, the legitimate user is disconneted from the attacker.



    Passive Attack: With a passive attack, an attacker hijacks a session but sits back and watches and records all the traffic that is being sent forth.


    The essential difference between an active and passive hijacking is that while an active attack takes over an existing session, a passive hijack monitors an ongoing session.


    How to Hijack a Session ID ?

    We start with jumping into kali Linux"s Terminal and using the most widely used tool such as Ettercap, Hemster, Ferret. we will discuss about how to hijack a session. we will start session hijacking with man-in-the-middle attack and start capturing packets. Here is our attacker machine is kali linux and the victim is our local machine ( own network ).


    From Wikipedia

    Session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called session key—to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim’s computer. session hijacking using ettercap hemster ferret


    we will  use three types tools here such as :-
    Ettercap
    Hemster
    Ferret








    Hijack Session ID :- Click Here



         






    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)



  • How SQL Query works in database and how to hack database


    How SQL Query works in database and how to hack database


    SQL Injection


    SQL injection attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries. This malicious code is drafted with the intention of revealing or manipulating data that is stored in the tables within the database. SQL injection

    SQL Injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application. The fundamental concept of SQL injection is to impact commands to reveal sensitive information from the database. Hence, it can result to a high profile attack. How SQL Query works in database and how to hack database


    Attack Surface of SQL Injection


    Bypassing the authentication
    Revealing Sensitive Information
    Compromised Data Integrity
    Erasing The Database
    Remote Code Execution




    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w



    How SQL Query Works ?

    Injection of SQL query will be executed on the server and replied by the response. For example, following SQL Query is requester to the server.



    • SELECT  *  FROM  [ Orders ]
    • SELECT column1, column2, ....  FROM table_name;


    These commands will reveal all information stored in the databse "Oredrs" table. If an organization maintains records of their orders into a database, all information kept in this database table will be extracted by the command.






    Learn and understand CEH from scratch. A complete beginner's guide to learn CEH.

    Try it :- It's a Free 





    Otherwise let's understand with another Example



    In the following example, an attacker with the username link inserts their name after the = sign following the WHERE owner, which used to include the string 'name'; DELETE FROM items; -- for itemName , into an existing SQL command, and the query becomes the following two queries:



    • SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; DELETE FROM items;--






    Many of the common database products such as Microsoft’s SQL Server and Oracle’s Siebel allow several SQL statements separated by semicolons to be executed at once. This technique, known as batch execution, allows an attacker to execute multiple arbitrary
    commands against a database. In other databases, this technique will generate an error and fail, so knowing the database you are attacking is essential.



    If an attacker enters the string 'name'; DELETE FROM items; SELECT * FROM items WHERE   'a' = 'a' ,   the following three valid statements will be created:





    • SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; 

    • DELETE FROM items; SELECT * FROM items WHERE 'a' = 'a';



    A good way to prevent SQL injection attacks is to use input validation, which ensures that only approved characters are accepted. Use whitelists, which dictate safe characters, and blacklists, which dictate unsafe characters.


    Database





    SQL Delete Query

    The DELETE statement is used to delete existing records in a table. To understand, consider a table "Customers" in a database. The following information is the table "Customers" is containing.






    Execution of  "delete" command will eraase the record.


    • DELETE FROM Customers WHERE CustomerName='Alfreds Futterkiste';


    Now the database table will be like this :-






    There are lots of SQL query commands that can be used. Above are some of the most common and effective commands that are being used for injection.
    for example :-


    • UPDATE Customers SET ContactName = 'KumarAtulJaiswal', city= 'Delhi' WHERE CustomerID = 56;
    • INSERT INTO Customers (column1, column2, column3, ...)
      VALUES (value1, value2, value3, ...); 

    • Customers is a Table Name.


    SQL Injection Tools

    There are several tools available for SQL injection such as :-

    • BSQL Hacker
    • Marathon Tool
    • SQL Power Injecto
    • Havij


     Server Side Technologies

    Server-side technologies come in many varieties and types, each of which offers
    something specific to the user. Generally, each of the technologies allows the creation of dynamic and data-driven web applications. You can use a wide range of server-side technologies to create these types of web applications; among them are the following:

    • ASP
    • ASP.NET
    • Oracle
    • PHP
    • JSP
    • SQL Server
    • IBM DB2
    • MySQL
    • Ruby on Rails

    All of these technologies are powerful and offer the ability to generate web applications that are extremely versatile. Each also has vulnerabilities that can lead to it being compromised, but this chapter is not about those.



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • Top 9 Advance phishing Tool for hack a social site, website etc



    Top 9 Advance phishing Tool for hack a social site, website etc



    Top 9 phishing Tool for hack a social site, website etc


    Today's youth was interested and more is being seen on hacking tomorrow, due to which if no one has technical knowledge.  He can also do hacking using a hacking tool and is a very well-known tool.  Which is called a fishing tool and this tool helps in many different types of fishing attacks. Top 9 Advance phishing Tool for hack a social site, website etc


    Here you will be told about different types of fishing attack tools and the first tool is our Evilginx2.



    1) EVILGINX2

    Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.



    Top 9 Advance phishing Tool for hack a social site, website etc



    EVILGINX2 is a  man-in-the-middle attack framework used for fixing login credentials along with session cookies, which in turns allows bypassing two factor authentication production


    Github :- https://github.com/kgretzky/evilginx2




    2) HIDDEN EYE


    Modern Phishing Tool With Advanced Functionality And Multiple Tunnelling Services [ Android-Support-Available ]


    Top 9 Advance phishing Tool for hack a social site, website etc



    Github :- https://www.cyberpunk.rs/hidden-eye-modern-phishing-tool








    3) KING PHISHER


    King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness training to more complicated scenarios in which user aware content is served for harvesting credentials. Top 9 Advance phishing Tool for hack a social site, website etc







    Top 9 Advance phishing Tool for hack a social site, website etc



    King Phisher is only to be used for legal applications when the explicit permission of the targeted organization has been obtained.


    Github :- https://github.com/rsmusllp/king-phisher



    See Also :- 


    How To Change MAC Address



    • Find Leaked Email and Password via onion service :- Click Here



    Find Leaked Email and Password via onion service



    4) GOPHISH


    Gophish is open source facing toolkit design for business and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagement and security awareness training.



    Top 9 Advance phishing Tool for hack a social site, website etc



    Website :- https://getgophish.com/





    5) WIFIPHISHER


    Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be further used to mount victim-customized web phishing attacks against the connected clients in order to capture credentials (e.g. from third party login pages or WPA/WPA2 Pre-Shared Keys) or infect the victim stations with malwares.



    Top 9 Advance phishing Tool for hack a social site, website etc



    Github :-  https://github.com/wifiphisher/wifiphisher




    https://www.youtube.com/channel/UCa2s3RmE4B-hRsgKSjJLx_w






    6) BLACK EYE



    The most complete phishing tool, with 32 templates+1 customizable.


    Top 9 Advance phishing Tool for hack a social site, website etc


    Github :-  https://github.com/thelinuxchoice/blackeye




    7) EDUCATION PHISHING TOOL


    Educational Phishing Tool & Information Collector.


    Top 9 Advance phishing Tool for hack a social site, website etc


    Github :- https://github.com/UndeadSec/SocialFish





    8) SOCIAL MEDIA PHISHING PAGES



    The way phishing works is that an attacker clones a trusted website or spoofs an email of a known target which leads the person to believe that he is visiting a trusted website like social media sites, e.g.,  shellphish github termux Facebook, SnapChat, Instagram, Google, Netflix, and so on. The target will then put his/her username and password on the malicious website (cloned website) and then the username and password will be sent to the attacker instead of the real website, and the target will be redirected to the real website. Let’s do a demo of phishing using shellphish. shellphish github download


    Top 9 Advance phishing Tool for hack a social site, website etc



    Website :- https://www.hackingtruth.in/2019/10/the-linux-choice-shell-phish.html






    9) ZPHISHER



    Zphisher is an upgraded form of Shellphish. The main source code is from Shellphish. But I have not fully copied it. I have upgraded it & cleared the Unnecessary Files. It has 37 Phishing Page Templates ; including Facebook , Twitter & Paypal. It also has 4 Port Forwarding Tools .



    Top 9 Advance phishing Tool for hack a social site, website etc




    Github :- https://github.com/htr-tech/zphisher






    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)








  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.