XSS Filter Bypassing Techniques

Sometimes a simple XSS query just won't do the trick. The reason your query isn't working, is because the website has a WAF or Filter set in place. A filter will block as many XSS and SQLi queries as possible. In this case, we're dealing with XSS.

There are many ways on bypassing XSS filters, but I will only explain a few.

--XSS CrOss Site ScriPting

What is Xss?

Explenation.

The full name for Xss is cross site scripting.
You can take this name literally. Because we inject right into the site/ into the inputs.
Changing/editing html. which gives us the advantage to gather user information if they click the malicious input!.cross site scripting is injecting javascript and html into the inputs of a site.

     What is a cookie?

FULL PATH DISCLOSURE TUTORIAL

In this little write up today, I am going to try and explain you what 'FPD' is, how to detect it, analyze it, and some pretty good methods of finding it in the wild.

/* Note that my write up was intended to PHP-based websites, but some of the methods works for ASP/ASPX too. */

what is FPD

 FPD' (Stands for Full Path Disclosure) is one of the most common methods of attacks (While I doubt this kind of action categorized as a form of an attack, it is still a highly-related method of website security testing), that Pen-testers / Hackers / whatever use in order to gain an error which will expose the full installation path of the targeted site.

Why is this happening?

By default (Don't quote me here. Some web-services and packages disable this function, but partly in most cases), the PHP error reporting function -

Code:

error_reporting(0);

different hash types

diferent websites use different types of hashing technique to store their password in the database.So,one must identify the hash type in order to crack it.
here are the different types of hash:

DES(Unix)
Example: IvS7aeT4NzQPM
Used in Linux and other similar OS.
Length: 13 characters.
Description: The first two characters are the salt (random characters; in our example the salt is the string "Iv"), then there follows the actual hash.
Notes: [1] [2]

how to find admin page of a website

Today im gonna show how to find admin panels when you have info to login.

There's a few options to find it.

1) Adding to URL

http://www.site.com/admin
http://www.site.com/administrator
http://www.site.com/admin.php
http://www.site.com/login

Oracle SQL injection

Hello guys this is a tutorial about Oracle based SQL injection
Here is the site to learn with

PHP Code:

http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 

Let's try order by

Basic SQL injection with Login Queries

Bypassing Login pages on websites using SQL injectable queries

Level: Beginners and Intermediate
Requirements: Patience and stradegy
Alright in this tutorial, we'll be learning how to bypass login pages with the help of MySequel injection using Login Queries. 

 

 What is SQL injection?
Answer: Basically, it's a process where you execute a certain query in a website in order to extract information such as log-in information, users etc. for either personal gain or random use from the website's database.