Automated Blind SQL Injection Attacking Tools~bsqlbf Brute forcer

What is Blind SQL Injection:
Some Websites are vulnerable to SQL Injection but the results of injection are not visible to the attacker.  In this situation, Blind SQL Injection is used. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This type of attack can become time-intensive because a new statement must be crafted for each bit recovered.
There are plenty of automated Blind Sql Injection tool available. Here i am introducing one of Tool named as bsqlbf(expanded as Blind Sql Injection Brute Forcer).

This tool is written in Perl and allows extraction of data from Blind SQL Injections. It accepts custom SQL queries as a command line parameter and it works for both integer and string based injections
Supported Database:
  • MS-SQL
  • MySQL
  • PostgreSQL
  • Oracle

The tool supports 8 attack modes(-type switch):-
Type 0: Blind SQL Injection based on true and false conditions returned by back-end server

Type 1: Blind SQL Injection based on true and error(e.g syntax error) returned by back-end server.

Type 2: Blind SQL Injection in "order by" and "group by".

Type 3: extracting data with SYS privileges (ORACLE dbms_export_extension exploit)

Type 4: is O.S code execution (ORACLE dbms_export_extension exploit)

Type 5: is reading files (ORACLE dbms_export_extension exploit, based on java)

Type 6: is O.S code execution DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC exploit

Type 7: is O.S code execution SYS.KUPP$PROC.CREATE_MASTER_PROCESS(), DBA Privs

-cmd=revshell Type 7 supports meterpreter payload execution, run generator.exe first

Type 8: is O.S code execution DBMS_JAVA_TEST.FUNCALL, with JAVA IO Permissions

-cmd=revshell Type 8 supports meterpreter payload execution, run generator.exe first

For Type 4(O.S code execution) the following methods are supported:

-stype: How you want to execute command:

SType 0 (default) is based on java..will NOT work against XE.

SType 1 is against oracle 9 with plsql_native_make_utility.

SType 2 is against oracle 10 with dbms_scheduler.


Note:
This Article is for Education purpose only.  The above mentioned software is developed for Penetration testers to test their own Web application Vulnerability. 

List of Online SQL Injection Scanner Websites

1) http://www.be007.gigfa.com/scanner/scanner.php
2) http://www.sunmagazin.com/tools/hack/SQLI-Scan
3) http://scanner.drie88.tk
4) http://localvn.biz/Tools/tools/Hack-Shop/SQLI-Scan
5) http://wolfscps.com/gscanner.php

Top 10 ways to exploit SQL Server Systems



Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.

1. Direct connections via the Internet

These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield's Port Report shows just how many systems are sitting out there waiting to be attacked. I don't understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.

2. Vulnerability scanning

Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.'s NGSSquirrel for SQL Server (for database-specific scanning). They're easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.



Common SQL injection vulnerabilities found using WebInspect.
3. Enumerating the SQL Server Resolution Service

Running on UDP port 1434, this allows you to find hidden database instances and probe deeper into the system. Chip Andrews' SQLPing v 2.5 is a great tool to use to look for SQL Server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren't listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434.

4. Cracking SA passwords

Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou?!). Yet another use for the handy-dandy SQLPing tool mentioned earlier. The commercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS Software Ltd. also have this capability.

5. Direct-exploit attacks

Direct attacks using tools such as Metasploit, shown in Figure 2, and its commercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silver-bullet hack for attackers penetrating a system and performing code injection or gaining unauthorized command-line access.


SQL Server vulnerability exploitable using Metasploit's MSFConsole.
 6. SQL injection

SQL injection attacks are executed via front-end Web applications that don't properly validate user input. Malformed SQL queries, including SQL commands, can be inserted directly into Web URLs and return informative errors, commands being executed and more. These attacks can be carried out manually -- if you have a lot of time. Once I discover that a server has a potential SQL injection vulnerability, I prefer to perform the follow-through using an automated tool, such as SPI Dynamics' SQL Injector
SPI Dynamics' SQL Injector tool automates the SQL injection process.
7. Blind SQL injection

These attacks go about exploiting Web applications and back-end SQL Servers in the same basic fashion as standard SQL injection. The big difference is that the attacker doesn't receive feedback from the Web server in the form of returned error messages. Such an attack is even slower than standard SQL injection given the guesswork involved. You need a good tool for this situation, and that's where Absinthe, shown in Figure 4, comes in handy.
Absinthe tool takes the pain out of blind SQL injection testing.
  8. Reverse engineering the system

The reverse engineering trick looks for software exploits, memory corruption weaknesses and so on. In this sample chapter from the excellent book Exploiting Software: How to Break Code by Greg Hoglund and Gary McGraw, you'll find a discussion about reverse engineering ploys.

9. Google hacks

Google hacks use the extraordinary power of the Google search engine to ferret out SQL Server errors -- such as "Incorrect syntax near" -- leaking from publicly accessible systems. Several Google queries are available at Johnny Long's Google Hacking Database. (Look in the sections titled Error Messages and Files containing passwords.) Hackers use Google to find passwords, vulnerabilities in Web servers, underlying operating systems, publicly available procedures and more that they can use to further compromise a SQL Server system. Combining these queries with Web site names via Google's 'site:' operator often turns up juicy info you never imagined you could unearth.

10. Perusing Web site source code

Source code can also turn up information that may lead to a SQL Server break in. Specifically, developers may store SQL Server authentication information in ASP scripts to simplify the authentication process. A manual assessment or Google could uncover this information in a split second.


What is hacking? Introduction to Hacking

1.originally, someone who makes furniture with an axe1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.

2. One whoprograms enthusiastically (even obsessively) or who enjoys programming
rather than just theorizing about programming.

3. Aperson capable of appreciating hack value.

4. A person who is good at programming quickly.

5. An expert at a particular program,
or one who frequently does work using it or on it; as in ‘a
Unix hacker.’ (Definitions 1 through 5 are correlated, and people

who fit them congregate.)

6. An expert or enthusiast of any kind.
One might be an astronomy hacker, for example.
7. One who
enjoys the intellectual challenge of creatively overcoming or circumventing
limitations.

8. [deprecated] A malicious meddler who
tries to discover sensitive information by poking around. Hence
‘password hacker,’ ‘network hacker.’ The correct term for this
sense is cracker.

Cracker

One who breaks security on a system. Coined ca. 1985 by hackers
in defense against journalistic misuse of hacker (q.v., sense 8). An
earlier attempt to establish ‘worm’ in this sense around 1981–82
on Usenet was largely a failure.

Use of both these neologisms reflects a strong revulsion against
the theft and vandalism perpetrated by cracking rings. While it is
expected that any real hacker will have done some playful cracking
and knows many of the basic techniques, anyone past larval stage
is expected to have outgrown the desire to do so except for immediate,
benign, practical reasons (for example, if it’s necessary to get
around some security in order to get some work done).
Thus, there is far less overlap between hackerdom and crackerdom
than the mundane reader misled by sensationalistic journalism
might expect. Crackers tend to gather in small, tight-knit,
very secretive groups that have little overlap with the huge, open
poly-culture this lexicon describes; though crackers often like to
describe themselves as hackers, most true hackers consider them a
separate and lower form of life.

It’s clear that the term cracker is absolutely meant to be derogatory. One
shouldn’t take the tone too seriously though, as The Jargon File is done with a
sense of humor, and the above is said with a smile. As we can see from the
above, illegal or perhaps immoral activity is viewed with disdain by the “true
hackers,” whomever they may be. It also makes reference to cracker being a
possible intermediate step to hacker, perhaps something to be overcome.

Script Kiddie

The term script kiddie has come into vogue in recent years. The term refers to
crackers who use scripts and programs written by others to perform their intrusions.
If one is labeled a “script kiddie,” then he or she is assumed to be incapable
of producing his or her own tools and exploits, and lacks proper
understanding of exactly how the tools he or she uses work. As will be apparent
by the end of this chapter, skill and knowledge (and secondarily, ethics) are the
essential ingredients to achieving status in the minds of hackers. By definition,
a script kiddie has no skills, no knowledge, and no ethics.

Phreak

A phreak is a hacker variant, or rather, a specific species of hacker. Phreak is
short for phone phreak (freak spelled with a ph, like phone is). Phreaks are
hackers with an interest in telephones and telephone systems. Naturally, there
has been at times a tremendous amount of overlap between traditional hacker
roles and phreaks.

White Hat/Black Hat/Gray Hat

White Hat Hacker:
White Hat hackers are good guys who does the hacking for defensing.  They probably work an organization for providing security.

Black Hat Hacker
Black hat hackers are bad guys(the malicious hackers or crackers).  They usually steal the other bank information and steal the money.
They use their skills for illegal purposes.
They are creators of viruses,malware,spyware.
They will destroy your pc.

Gray Hat Hackers

Grey hats are hackers who may work offensively or defensively, depending on the situation.
This is the dividing line between hacker and cracker. Both are powerful forces on the Internet,
and both will remain permanently. And some individuals qualify for both categories. The
existence of such individuals further clouds the division between these two groups of people.
In addition to these groups, there are self-proclaimed ethical hackers, who are interested in
hacker tools mostly from a curiosity standpoint. They may want to highlight security problems
in a system or educate victims so they secure their systems properly. These hackers are
doing their “victims” a favor. For instance, if a weakness is discovered in a service offered by
an investment bank, the hacker is doing the bank a favor by giving the bank a chance to rectify
the vulnerability.


How to make USB Bootable for Window 7/Vista


Step1: Create Bootable USB Drive:

   1.Start PowerISO (v4.8 or newer version, download here).
   2.Insert the USB drive you intend to boot from.
   3.Choose the menu "Tools > Create Bootable USB Drive". The    "Create Bootable USB Drive" dialog will popup. If you are using Windows Vista or Windows 7 operating system, you need confirm the UAC dialog to continue.
   4. In "Create Bootable USB Drive" dialog, click "..." button to open the iso file of Windows 7.
   5.Select the correct USB drive from the "Destination USB Drive" list if multiple USB drives are connected to the computer.

   6.Choose the proper writing method. "USB-HDD" is recommended.
   7.Click "Start" button to start creating windows 7 bootable USB drive.

If no errors occured in the above process, you should now be all set to setup Windows 7 from USB drive!

 Step 2: Configuring the BIOS:

You should now reboot and go into the BIOS configuration to boot from USB. Instructions for doing so wildly from system to system, but generally entail the following:

   1.Reboot the system.
   2.While booting (before Windows starts loading), get into the BIOS configuration screen by hitting something like F1, F2, Delete or Escape. Hotkey instructions are generally provided on the screen.
   3.Go to the section that contains your boot devices.
   4.With your USB drive plugged in, the USB drive should be listed. If it isn’t, your system might not support booting from USB. Assuming that it is supported (as is the case with virtually all modern hardware), promote your USB drive to the primary boot device.
   5.Exit from the BIOS configuration, saving all changes.

If you’re completely new to BIOS configuration, BIOS for Beginners over at Tom’s Hardware might be a good primer. Be aware though, that you can seriously screw up your system by providing incorrect settings!

 Step 3: Booting and setup windows 7 from USB drive:

Assuming that you properly configured your BIOS and your USB drive supports booting,  Windows 7 setup should now load. Depending on the speed of your USB drive, this may take a while.

If it isn’t working, then double-check the following before making a scene:

    Is your BIOS properly configured for booting from the USB device? (Is the USB device listed and does it have top priority?)
   
      Have you correctly prepared the USB drive in step one? (Restart the procedure.)
    Does your USB drive properly support being booted from? (Try another one!)

Avira Premium Security Suite 10.2 for Free Download Full Version

Avira Premium Security Suite 10.2 


Avira Premium Security Suite:
All round protection for you and your family Premium Security Suite is essential if you:Rely on the internet for everything


Regularly shop and buy from online retailers, or bid on auction sites
Ever access your bank or financial accounts online
Chat, communicate and social network constantly
Share your computer with your partner or other family members
Worry about keeping your precious family memories safe
Are concerned about what your children might see and do online
Avira AntiVir Premium:Enhanced surfing and email protection
If you use your computer for more than an hour a day on average, you need better protection than any free software can provide. That’s because traditional antivirus only goes so far to protect you in today’s world wide web.

Avira AntiVir Premium places 6 extra layers of security in front of the award winning technologies at the centre of our basic antivirus. It doesn’t just wait and sort out a virus only when it arrives at your PC. Now it stops problems before they even reach you through the internet.
So you can feel much more comfortable, spending much more time online.

Note:
 This is Torrent file. You must be install utorrent or bittorrent on your system. For Downloading    utorrent click Here and for downloading bittorrent click Here.



                         
                                                       
                                                        For Downloading Click Here

Password of RAR File : brain hackers


Live TV Software 2011 for Free Download Full Version

                     Live TV Software 2011




Installation Instructions
Extract files with WinRAR
.exe File Format (Setup File + Crack)
Run Application
Click on "Live TV Software 2011 Cracked Install" For Next Cracked..


Note:
 This is Torrent file. You must be install utorrent or bittorrent on your system. For Downloading    utorrent click Here and for downloading bittorrent click Here.



                         
                                                       
                                                        For Downloading Click Here

Password of RAR File : brain hackers