Cyber Learning and Hacking Tutorial

  Overview Command Injection may occcur when an attacker is able to run script into a users browser. To forge a legitimate request, the script creates and send the same parameters to the target website that would be sent if the user had submitted the legitimate form themselves. The target website knows the request has come from the users browser but cannot detect that the request was created and sent by a malicious script running in the users browser. As far as the target site can tell, the user submitted the request by using the web site in the expected way. Discovery Methodology Fuzz with command separators like ;, & and && depending on if you are using Linux or Windows respectively. Look for errors that are related to operating system errors, delays in responses which can be repeated by repeating the injection, or unexpected output in the response. The error may appear as an HTML comment. Attempt to determine the operating system type. Reserved characters used in fuz...

Code Injection:  There are many ways to inject code, let's begin this section with cookie viewing and editing. Erase everything in your address bar, and type in javascript:alert(document.cookie); Carefully examine the data Now erase everything again and type javascript: void(document.cookie='user:=guest'); Run the original script again to view the cookie, as you can see you have changed the cookie data. This is how cookie editing can be used to possibly access a site through cookies. There are many tools that can be used to help automate this process such as: Paros Proxy, Burp Suite, and Web Scarab to name a few. There are better ways to achieve this in a more targeted manner. Let's move on. Session Hijacking: Let's revisit the blog and see what we can do. 1) Open a different web browser and point it to the main page. 2) Log in to the anonymous account with the attack browser and create a post with a hyperlink in the blog that points to the cookie stealing code th...

Overview: Javascript injection (or Javascript source code injection) is closely related to HTML injection and Cross site scripting. In all these cases the input is interpreted as code rather than data. The code may break out of the current context and switch to another context. Alternatively an injection may stay in the current context but modify the source code. "Context" is the type of code and object into which the injection occurs. For Javascript injection, this is often the value of a Javascript string being dynamically set. An example of breaking context is injecting script tags into HTML output. The developer believes the context should be HTML (perhaps a table), but the input of script tags (with embedded script) causes the browser to stop processing HTML and switch to processing script. The context switch occurs when the browser stops executing the HTML instructions and instead executes the JS. Injection within context could be injecting HTML into HTML output. Althou...

  Hi guys if you are searching for how to install hydra and searching for the best article to get the best explanation about how to install hydra . Then you are in the right place . What is Hydra Tool? Thc-hydra, In short, we can call it  hydra , This tool is used for penetration testing and cracking the open ports and web login pages like FTP login pages, HTTP login pages, and many more pages. This tool is purely made to make the cracking process more efficient with the best results. So this tool is available for only some limited devices like Linux, Debian based but today will discuss how to install the hydra tool on any device without any errors or issues, Like termux and other terminal emulator apps. How to Install Hydra? To Install hydra there are some must requirements which you need to follow. REQUIREMENTS (Termux/Kali) > 1 GB of data storage > 50 MB internet data > 3 GB of ram for better performance >  Android with 5.0.0 and higher >  Rooted de...

  A Complete Guide to Cross-Site Scripting (XSS) Attack,  how to prevent it, and XSS testing. Cross-Site Scripting (XSS) is one of the most popular and vulnerable attacks which is known by every advanced tester. It is considered one of the riskiest attacks for web applications and can bring harmful consequences too. XSS is often compared with similar client-side attacks, as client-side languages are mostly being used during this attack. However, an XSS attack is considered riskier, because of its ability to damage even less vulnerable technologies. In this XSS attack tutorial, we will give you a complete overview of its types, tools, and preventive measures with perfect examples in simple terms for your easy understanding. Introduction to XSS Attack A cross-Site Scripting attack is a malicious code injection, which will be executed in the victim’s browser. The malicious script can be saved on the webserver and executed every time when the user calls the appropriate functionali...

HTML Injection Tutorial: Types & Prevention With Examples:- HTML is a markup language, where all the website’s elements are written in the tags. It is mostly being used for creating websites. Web pages are being sent to the browser in the form of HTML documents. Then those HTML documents are being converted into normal websites and displayed for the final users. This tutorial will give you a complete overview of HTML Injection, its types and preventive measures along with practical examples in simple terms for your easy understanding of the concept. What is HTML Injection? The essence of this type of injection attack is injecting HTML code through the vulnerable parts of the website. The Malicious user sends HTML code through any vulnerable field with a purpose to change the website’s design or any information, that is displayed to the user. In the result, the user may see the data, that was sent by the malicious user. Therefore, in general, HTML Injection is just the injection of ...

Best Tools For Termux:- Many security professionals and certified ethical hackers use these Termux tools for legal penetration testing. Here is the list you are looking for: Metasploit Framework- One of the Best Termux tools. Nmap - Termux tool for scanning IP addresses and ports in a network. Wireshark - A tool for analyzing send and capture network packets. SQLMAP - Termux tool for SQL injection. Social Engineering Toolkit - Toolkit containing several Termux tools. Nikto - Web app vulnerabilities scanner Termux tool. Tool-X - Covers all Termux tools. Fsociety Toolkit - Contains tools featured in MR.Robot series. Hydra - A Termux tool used to crack passwords. Slowloris - A Termux tool for DDoS attacks. Zphisher - A phishing tool for Termux. IP Tracer - A tool for Termux used to trace IP addresses. EasY_HaCk - Network scanning and information gathering tool for Termux. Seeker - A tool for Termux that allows you to track real-time location. Infect - Termux tool for sending virus in Andr...