Ethical Hacking Lab to Test and Learn SQL injection,XSS, CSRF Vulnerability

So far i have provided few Web Application Pen Testing tutorials .  Now it is time to for practicing your hacking / pentesting skills in legal way. Last time , i explained about the Damn Vulnerable  Web Application(DVWA). 

Now, i've come with different web application that will help you to improve your knowledge in web app pentesting.


The BodgeIt Store
Like DVWA, This is also a Vulnerable web

Set up your own Lab for practicing SQL injection and XSS : Ethical Hacking

I hope you learned about the Sql injection and XSS from BTS.  But you may curious to practice the SQLi and XSS attacks. we know that doing the attack on third-party website is crime.  So how can we do the practice? Here is the solution for you friends. Why shouldn't set up your own web application ? Yes, you can setup your own Pen Testing lab for practicing the XSS and SQLi vulnerabilities.

What is Blind Sql Injection ? Web Application Vulnerability Tutorial

Blind SQL injection technique is used when the web application is vulnerable but the output doesn’t display to the attacker. When hacker tries SQL injection, they will redirect to some other pages instead of error message. Blind SQL Injection is harder to implement when compared with the above Traditional SQL Injection Technique, it will take more time . There are some tools for Blind SQL

Automated Blind SQL Injection Attacking Tools~bsqlbf Brute forcer

What is Blind SQL Injection:Some Websites are vulnerable to SQL Injection but the results of injection are not visible to the attacker.  In this situation, Blind SQL Injection is used. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This

List of Online SQL Injection Scanner Websites

http://www.be007.gigfa.com/scanner/scanner.php
http://www.sunmagazin.com/tools/hack/SQLI-Scan
http://scanner.drie88.tk
http://localvn.biz/Tools/tools/Hack-Shop/SQLI-Scan
http://wolfscps.com/gscanner.php

How does your Website becomes vulnerable to SQL Injection?

Developer is the one and only reason for the SQL Injection Vulnerability. While developing the Web Application, he fails to handle some vulnerability(because he doesn't know about it. Don't be one of them. If you are Web Application developer, then you must read these security techniquest in order to overcome the SQL Injection Vulnerability.



Reason 1:Incorrectly filtered escape

UPDATE: Safe3 Sql Injector v8.6

Safe3 developers have brought us the updated Safe3 Sql Injector version 8.3. We have discussed about Safe3 Sql Injector in detail here.



“Safe3 is one of the most powerful and easy usage penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for the

SQL Inject Me -SQL Injection Tool to test the Vulnerability for Pen Testers

So far i have written what is sql Injection, How to prevent SQL Injection? .  In this post, i am going to introduce a new SQLi tool for Pen Testers and Webmasters.
The tool name is SQL Inject Me.

What is SQL Inject Me?
SQL Inject Me is Mozilla addon that is used to test the SQL Injection Vulnerability of Web Application.  It reduces the workload of Manual SQL Injection Test.  This is especially

How to Prevent SQL Injection Vulnerability? Website Security

Hi webmasters and budding Pen Testers, I hope you read my article about SQL Injection. Our Aim is to provide Security, right? So here is the prevention techniques.




Use Prepared Statements:

Use prepared statements, parameterized queries, or stored procedures. Don't use Dynamic SQL.
In Java you can use PreparedStatement() with bind variables 
In .NET you can use parameterized queries, such as

What is SQL Injection? Web Application Vulnerability

WebApplication(Website) stores the information in database such as user info, admin info, and passwords. When the developer fails to handle escape characters and type, it results in vulnerable database. Hacking or accessing the database using this vulnerability is known as SQL injection.
What an attacker can do? Bypassing Logins
Accessing secret data
Modifying contents of website
Shutting

What is an IFrame Injection? Mass IFrame Attack Tutorial

Recently 90000 webpages infected by Iframe Injection attack.  Here i am going to explain what  IFrame Injection is.

What is an IFrame Injection?Using IFrame tag, The Attackers injects the malware contain website(links) using Cross site Scripting in popular websites.  So if the usual visitors of that popular sites opens the website, it will redirect to malware contain website.  Malware  will

Havij Tool - Automatic SQL Injection Process

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.
It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even

Hacking website using SQL Injection -step by step guide

What is SQL Injection?
SQL injection is one of the popular web application hacking method.  Using the SQL Injection attack, an unauthorized person can access the database of the website. Attacker can extract the data from the Database.

What a hacker can do with SQL Injection attack?

* ByPassing Logins
* Accessing secret data
* Modifying contents of website
* Shutting down the My SQL

Hi friends my first SQL Injection attack

Hi friends, today i used SQL injection on one websites.  The result is positive.  Successfully i have found the Admin id and password.  But i did not deface it.  If you have any doubts in SQL Injection attack ask me frankly.   Ask your doubts in my forum.  http://forum.2viet.blogspot.com

Come and join with me. 


you have understand here one thing clearly. My aim is not hacking a website.

How to Find a vulnerable website?

Google is best friend for Hackers. We can find the Vulnerable website using google search. This is known as Google Dorks.

Small List of Google Dork:
inurl:index.php?id=

inurl:gallery.php?id=

inurl:post.php?id=

inurl:article?id=
Download A large list of Google dork from here

copy one from above list and paste in google search box,hit enter

You can see list of websites ending with that

COMMON METHODS USED FOR WEBSITE HACKING

Remote File Inclusion or RFI
SQL injection
Cross site scripting or XXS
Local file inclusion or LFI
Directory Traversal attack



RFI:
  RFI stands for Remote File Inclusion and it allows the attacker to upload a custom coded/malicious file on a website or server using a script.  The vulnerability occurs due to the use of user supplied input without proper validation. This can lead to