Way to HACK an Operating System using Metasploit

We can gain access to an Operating System, though another operating system. So we can do anything in that machine which we hacked. But there are few conditions which should satisfied. 

• Make sure both the Operating Systems are in same IP range.
• There should be a vulnerability in the OS which we are going to exploit. 

Now let's see it with a simple example

Here my Vulnerable OS is Windows 2000 (you can try this in all the operating systems). 

and I'm going to exploit it with Kali Linux.

To do the process there are some key tools needed. Those are,

• Nmap
• Nessus tool
• Exploit-DB
• Metasploit

Now look in to the process.., 

First set up both the Kali and Windows 2000 to same ip ranges. Because we can't ping each other with different ip ranges.

Here is the Kali's IP

and Windows 2000 IP is this.., 

then ping each other

use ping <other machine's IP address> command to do that

If it happened successfully you'll display it like this..,

Next, using nmap tool, find open ports in of Windows 2000

use nmap <Windows 2000's IP address> command

Then identify vulnerabilities using Nessus tool. It will display vulnerabilities separately group by the criticality.

those are the vulnerabilities found in Windows 2000.We can't exploit all the vulnerabilities. We should find a exploitable vulnerability next.

then, use the command msfconsole 

Next, try to find exploitable vulnerability. to do that first use the command

search  <the code of the vulnerability which was found from Nessus>

here i'm trying with MS03-026: Microsoft RPC Interface Buffer Overrun (823980) vulnerability.

then do as following pictures.., 

This vulnerability allows us to create a meterpreter session with the server by metasploit. And we can access the windows 2000 shell with root privileges.

Now we are in windows 2000’s root.

Now we can access the windows 2000 from Kali. 

As an example we can get System information and Network configurations in Windows, from Kali.

And we can also access the UI of Windows 2000 from kali using a exploitable vulnerability.

Hope you guys understand this post. If it is a doubt feel free to send me a mail.. :)

Let's login to a site using SQL INJECTION

What is SQL Injection?

Simply, SQL injection is a code injection technique that might destroy your database. and it is one of the most common web hacking techniques.

In other terms, SQL injection is a code injection technique, used to attack data-driven applications, in which nefarious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).

Now we'll see what should we do to login to a Web Site which we didn't signup before..,

A person who is trying to login to a certain site without signing up, he/she can use following command to username and password text boxes. SQL Injection can be performed with following values to bypass authentication

         " or ""="

It's just like this..,

The code at the server will create a valid SQL statement as follows,
  
  SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

What should we do to prevent SQL Injection?

To prevent SQL Injection, we need to avoid running dynamic queries and use prepared statements in the code.