Hacking Websites

Disclaimer: Any damage/damages which may occur or arise using the information or by gaining knowledge through this particular post provided here lies solely on the person performing the act. I'm not responsible for any damage/damages of the same. What is written here, is provided solely on informational purpose.

Even dreamed of Hacking a website? Ever wonder how to get into ones website and deface it?

Well dream it.. there's no harm in doing that; but don't practice it (Are you confident enough about hiding your traces behind?).

Words be, lemme tell you a few live hacks done through SQL injections. You can try right now as it works (by the time this post is written) but CONSIDER doing it at your OWN RISK. What i'm telling here is more of a Ethical Hacking; that means, know that it can be done the way I'm explaining here, and find out how to protect from being a victim yourself.

It's simple. Most people think Hacking is for the master coders only, which rather is wrong. Of course some knowledge are required and depending on the level of security, one can break through any system. HACKING into a system can be minimize but you CAN'T guarantee a 100% secure system.. as there is always a way!!

So now, here are some sites which lack some serious security measures:

Uttar Pradesh technical University website -

http://uptu.ac.in/ (To login, goto login on the top right, go to college login, and then choose VC)

Red Fm 93.5 website -

http://myredfm.com/ (To login Goto http://myredfm.com/admin)

What the web developer of these sites have done is, they forgot, or don't know how to use a escape string function (in PHP language). I won't go into details just for the sake of the laymen. They don't know or haven't implemented certain measure to exclude certain characters from being input by the user. When a site asked for a username & password, what happens is that, the code checks the username to the username existing in the database and compare with the password in the same row with the user input password. If both the conditions returns TRUE, then the user is shown the next password protected page.

Look at this: "1' or '1' = '1". Put the above in the username as well as the password field (without the double quotes). Here we formed an always TRUE condition as 1 always equals to 1. Or you can change it '2' = '2' or anything else. Now press enter and voila, you are at the backend of those sites. You can change anything from the backend.

Windows: Generic Win32 Service Error

I've come across this problem myself and I tried googling a lot and found out a few methods to fix this problem but, the interesting part is that NONE works. 

With this error, your audio, your networks, the graphics; all are affected. Your audio devices will not be shown in the devices section, your internet will not work and one thing for sure is that, you'll be really pissed! The error seems to be caused by some old version of HP printer drivers. Microsoft has release updates for Windows XP sp2 but the problem still continues with SP3. (Haven't tried with Vista)

I read about a few other methods other than the WORKING one I've given here, and that includes software updates or patches from Windows and HP; but as I'm using a new enough software, the patch didn't work. 

Anyway, here's the steps for Manual fixing, which is by far the best:

1. Open Registry Editor: Start>Run and in the box type: regedit and press OK.

2. Find "TransportBindName”. (Edit>Find or Ctrl+F) It may take a few mins to search. (You can look for it yourself at the location HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters)

3. Double-click on that value and delete the default value in the box and press OK.

4. Find the value “EnableDCOM”, located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole

5. Double-click on that value and set the value in the box as ‘N’ which currently maybe set as ‘Y’.

6. Close the Registry Editor and restart your computer.

I think this will solve your problem.

Shristi.org: the Series of hurdles

I've been approached to build and launch the the website for the Techno - Management Festival of my university. I've designed and developed a couple of websites on my own and so it wasn't a big deal, or at least i thought so, for me at FIRST. Things however, have been going pretty weasy and confusing with various hurdles and problems i've to face which are quite unexpected and uncool.

The very first hurdle was when znetindia.com took 3 days to process my domain registration order. The second one came when i found out that znetindia doesnt bundle DNS control with the domain registration; and for which i've to activate an extra addon for the domain paying extra money. The third was the unfriendly user interface structure of the znetindia account manager area (if you are a starter, i bet you won't be able to find out where you should change your nameserver if your are changing your hosting service to some other service provider!). The fourth was when i realise that the TTL values for the DNS at znetindia was quite huge, which means any update in the DNS, A, MX, CNAME, NS, TXT etc will take time for its propagation. This happened when i mistyped the NS records and then i realise i mistyped it, i had to change it and for the change to propagate, i had to wait the whole day.

Later when everything from the domain point of view is working, unfortunately, my PC breaks down... or at least i thought so, coz later on i found it was my wireless modem problem. As an engineering student, and in the CSE branch, i use to do a lot of stuffs on my PC and it is not uncommon that i install a fresh copy of Windows a couple of times every month. This time, i'd already formated my PC 4 to 5 times since my semester starts, and that would be from the 1st week of Jan and i've already made it by heart the serial number to my copy of the windows. For development purposes, i've created a lot of complex structures, programs and databases that i don't want to lose but i'd to compromise some to make my PC working again.

Now, everything is set, the site is up (www.shristi.org, though still under active construction) and i'm using joomla cms for a quick built. A problem which i'd never faced before arises to my joomla hosting then. At the same hosting company, with the same apache, php and mysql configuration, i'm hosting another joomla website and it's not showing any problem but however in this website, problems after problems showered. I'd the problem fixed temporarily although it's not the best way to fix the problem.

The Joomla problem was that, whenever you try to upload/ install a component/ plugin/ module/ template etc, you got an error message "Warning! failed to move file".

This happens because of certain settings and file permissions on your joomla host. There are methods to overcome this problem but they are not the best yet known. For some, setting CHMOD to 777 for the" public_html/tmp" file seems to work but for others it's far from solving. Some solved it by disabling the FTP layer at joomla, but some solve it by just changing the temporary path "public_html/tmp" to "public_html/temp" or the vice versa. Other ways to solve includes giving the php file more space changing the php.ini, which requires contacting your hosting company. The best method, however, seems to be disabling the php "Safe Mode", which also require you to contact your hosting company.

For now, as my works need to be completed in a short period, i'd changed all the files/folders concern to 777 giving permission to change and execute to all while making the installation and then changing back to the normal CHMOD file permission after the installation is over; leaving no ways for hackers to poke their nose in. If you are having this problem, u can do it as i've done as it is the simplest and will always solve it regardless of the FTP, php.ini, apache or any other settings.

NovaTechNetwork has done a great job with there hosting servers. I prefer them.

Anyway, let me see if there're any other problems that are gonna pop up in front of me..

How to reset my Joomla administrator password?

Joomla's admin username can be easily changed with a simple MySQL query. The most convenient way to manage the database is through the phpMyAdmin tool. Go to your cPanel and click on phpMyAdmin in the Databases box. (If you are not using cPanel or do not have phpMyAdmin, you can run the query directly for Joomla's database.)

Once in the phpMyAdmin select the Joomla's database from the drop-down menu at left. The page will refresh and the database's tables will be displayed on it. Open the SQL tab (look at the top navigation bar).

In the text field write the following SQL query:

UPDATE `jos_users` SET `password` = MD5( 'new_password' ) WHERE `jos_users`.`username` = "admin" ;

"new_password" - replace this with the new password you wish to use.

"admin" - replace this if your admin username is different.

Once you are ready, click on the GO button to submit the query. If everything goes fine without errors, you should be able to login to Joomla with the new password.

Note: These instructions are valid both for Joomla 1.5 and Joomla 1.0.*.

Why do we need CSS Hacks - for beginners

Most people, or rather web developers must have found out the limitations to the existing structure of the CSS". Separating content from the looks", that was the major aim of the existence of the CSS. However, the Cascading Style Sheet, has its own limitations.

Due to the various technologies and the front-end display structure of the various browsers, that some browsers supports some CSS functions while others doesn't; or just interprets some functions differently.

As such, look at the screenshots carefully. The displayed page is the same webpage viewed with

 different browsers, ie. Internet Explorer 7, Firefox and Google Chrome. The page is a simple static page generated with plain HTML using tables and cells, Javascript a

nd CSS. The page looks extremely perfect in Internet Explorer while in Firefox and Chrome, the alignment is different and as you can see, the cell-padding and cell-spacing seems weird. The image on the page seems to float above the navigation menu on the right.

This is the main reason why we need CSS hacks. With the use of well streamed CSS functions, you can let your page displayed in different manner according to the type of browser the user is browsing with. Changing a few things on the linked Style Sheet saves you from the repeated 

work of changing every file manually.. which can quite be a mess for a large website. There will be more posts following on CSS and how to hack it, making it a more powerful design tool for a webmaster. Keep checking back.

Adding "Read More" expandable link at Blogger

It's almost every bloggers' wish to have a "Read More" link displaying only a certaing part of his posts on the main page making the homepage more spacious and maintained. Here's a quick hack on blogger account to add a "Read More" link and display the rest of the story:

1. Log in to your blogger account select Layout of the blog which you want to modify
2. Navigate through Template --> Edit HTML
3. Take backup of your template by clicking Download Full Template. This backup will help you if you want to revert to old template
4. Search for in your template HTML and paste the following piece of code in between and

<!-- Style to implement "Read more on this Article" link in all the posts (Start) -->
<style>
<b:if cond='data:blog.pageType == "item"'>
span.fullpost {display:inline;}
<b:else/>
span.fullpost {display:none;}
</b:if>
</style>
<!-- Style to implement "Read more on this Article" link in all the posts (End) -->

5. After pasting the code, your template should look like as shown in the following image

6. Save your template and click on select Expand Widget Templates
7. Search for in the template HTML and paste the following piece of code after

<!-- Code to show "Read more on this article..." Link (Begin) -->
<b:if cond='data:blog.pageType != "item"'>
<span>
<a expr:href='data:post.url' style='color:#0000FF; text-align:right; font-weight:bold; text-decoration:none' >Read more on this article...</a>
</span>
</b:if>
<!-- Code to show "Read more on this article..." Link (End) -->

8. After pasting the code, your template should look like as shown in the following image

9. That's all. Your template is modified to show expandable posts.
10. Now in every post, the content which you want to show only in post's page should be included between This will be shown only in post's page.
11. Post a test article using the following HTML to see your blog working as expected

Chrome Secrets

Type these on your chrome browser address bar and see what each of these do:

about:memory

about:network

about:histograms

about:cache

about:plugins

about:stats

about:version

about:internets (this one's really interesting!!)

about:dns

about:crash

Google really makes things interesting.