Selamat Datang Di Thread Ane Gan

Ane Mau Share Ilmu Sedikit Gan
Ini merupakan salah satu cara yang sering digunakan para hacker untuk menerobos masuk suatu web, yaitu menggunakan tools Havij. Kali ini saya akan menunjukkan cara menggunakan tools Havij ini.
Simak baik - baik.

1. Silahkan buka tools Havij anda, jika belum punya bisa di download Havij versi 1.15 Free disini : [url]http://www.zid*du.com/download/21429123/Havij1.15Free.rar.html[/url]

2. Masukkan link target ke kolom target lalu klik "Analyze"
NB : Masukkan bagian url yang berakhiran id=angka untuk di inject, bukan indexnya
Contoh : www.site.com/index.asp?id=123 seperti contoh yang ada di havijnya

3. Di bagian bawah, proses scan akan berjalan untuk mencari databasenya. Selama proses scanning, Havij akan berstatus Analyzing Target. Jika proses scan selesai, Havij akan berstatus I'm IDLE.

4. Jika Havij sudah berstatus I'm IDLE tekan tables, setelah itu klik "Get DBs"




5. Tunggu prosesnya, jika sudah silahkan anda klik "Get Tables"




6. Nah disitu nanti akan ada beberapa table, coba anda tebak ada dimana letak admin dan passwordnya, jika anda sudah merasa menemukannya anda centang lalu klik "Get Column"

7. Jika sudah nanti anda akan menemukan data yang anda cari seperti username dan password. Anda centang keduanya lalu klik "Get Data" untuk melihat username dan passwordnya

8. Selesai. Anda sudah mendapatkan username dan password target. Anda tinggal cari halaman login adminnya menggunakan fasilitas admin finder di havij tersebut. Jika password anda berupa MD5 seperti e10adc3949ba59abbe56e057f20f883e coba anda gunakan fasilitas MD5 untuk menkrack password itu.

9. Dan kini anda sudah masuk ke admin panel web target tersebut ^_^

INGAT!! Tidak semua web itu vuln, kita harus mencari target mana yang memiliki vulnerability dengan menggunakan dork, Berikut List Dork Nya

intext:"error in your SQL syntax" +site:my
intext:"mysql_num_rows()" +site:il
intext:"mysql_fetch_array()" +site:br
intext:"Error Occurred While Processing Request" +site:il
intext:"Server Error in '/' Application" +site:my
intext:"Microsoft OLE DB Provider for ODBC Drivers error" +site:br
intext:"Invalid Querystring" +site:my
intext:"OLE DB Provider for ODBC" +site:my
intext:"VBScript Runtime" +site:my
intext:"ADODB.Field" +site:my
intext:"BOF or EOF"+site:my intext:"ADODB.Command" +site:my intext:"JET Database" +site:my
intext:"mysql_fetch_row()" +site:my intext:"Syntax error" +site:my intext:"include()" +site:my
intext:"mysql_fetch_assoc()" +site:my intext:"mysql_fetch_object()" +site:my intext:"mysql_numrows()" +site:il
intext:"GetArray()" +site:my intext:"FetchRow()" +site:my
intext:"Input string was not in a correct format" +site:my

allinurl:xml.php?id=
allinurl:xml.php?code=
allinurl:xml.php?code= module_ID=

inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:Pageid=
inurl.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurlreview.php?id=
inurl:loadpsb.php?id=
inurlpinions.php?id=
inurl:spr.php?id=
nurlages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurlarticipant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurlrod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurlerson.php?id=
inurlroductinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurlrofile_view.php?id=
inurl:category.php?id=
inurlublications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurlrod_info.php?id=
inurl:shop.php?do=part&id=
inurl:Productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurlroduct.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurlroduit.php?id=
inurlop.php?id=
inurl:shopping.php?id=
inurlroductdetail.php?id=
inurlost.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurlage.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurlroduct_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id= inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurlroduct-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:review.php?id=
inurl:loadpsb.php?id=
inurl:ages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurlpinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurlffer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl:trainers.php?id=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:Pageid=
inurl.php?id=
inurl:newsDetail.php?id=
inurl:staff_id=
inurl:historialeer.php?num=
inurlroduct-item.php?id=
inurl:news_view.php?id=
inurl:humor.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurlpinions.php?id=
inurl:spr.php?id=
inurlages.php?id=
inurl:chappies.php?id=
inurlrod_detail.php?id=
inurl:viewphoto.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gery.php?id=
inurl:detail.php?ID=
inurlublications.php?id=
inurl:Productinfo.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurlroduit.php?id=
inurlop.php?id=
inurl:shopping.php?id=
inurlroductdetail.php?id=
inurlost.php?id= section.php?id=
inurl:theme.php?id=
inurlage.php?id=
inurl:shredder-categories.php?id=
inurlroduct_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:channel_id=
inurl:newsid=
inurl:news_display.php?getid=
inurl:ages.php?id=
inurl:clanek.php4?id=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:look.php?ID=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurlffer.php?idf=

"id=" & intext:"Warning: mysql_fetch_array()
"id=" & intext:"Warning: getimagesize()
"id=" & intext:"Warning: session_start()
"id=" & intext:"Warning: mysql_num_rows()
"id=" & intext:"Warning: mysql_query()
"id=" & intext:"Warning: array_merge()
"id=" & intext:"Warning: preg_match()
"id=" & intext:"Warning: ilesize()
"id=" & intext:"Warning: filesize()

inurl:index.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:newsitem.php?num=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl: forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurlgl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurlreview.php?id=
inurl:loadpsb.php?id=
inurlpinions.php?id=
inurl:spr.php?id=
inurl:announce.php?id=
inurlarticipant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurlrod_detail.php?id=
inurl:article.php?id=
inurlerson.php?id=
inurlroductinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurlrofile_view.php?id=
inurl:category.php?id=
inurlublications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurlrod_info.php?id=
inurl:shop.php?do=part&id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurlroduct.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurlroduit.php?id=
inurlop.php?id=
inurl:shopping.php?id=
inurlroductdetail.php?id=
inurlost.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurlage.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurlroduct_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:newsone.php?id=
inurlroduct-item.php?id=
inurlages.php?id=
inurl:clanek.php4?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:galeri_info.php?l=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:aboutbook.php?id=

"id=" & intext:"Warning: mysql_fetch_assoc()
"id=" & intext:"Warning: is_writable()
"id=" & intext:"Warning: Unknown()
"id=" & intext:"Warning: mysql_result()
"id=" & intext:"Warning: pg_exec()
"id=" & intext:"Warning: require()

Untuk mengetahui vulnerability'nya, anda tambahkan tanda petik ' pada belakang url dari hasil dork tersebut. Misal www.site.com/curriculum.php?id=30' atau [url=http://www.site.com/curriculum.php?id='30]www.site.com/curriculum.php?id='30[/url] jika ditemui tulisan seperti syntax error berarti web tersebut dapat kita eksekusi