Hello partners, first of all I would like to thank all those who have sent me positive feedback about my posts, to say that I'm always willing to learn and teach. I'm also open to answer the appropriate questions.

Second i want to say sorry for the series i left in stand by mode, as soon as i get time i will return them, lastly i wanna wish happy new year and happy hacking for you all.

How to Hack a Website?

We all know that hacking is nothing more than the skill of this century.
So what does it means? ´

It means that not everyone can get that skill. so you can see how privileged is to know hacking, in other hands it´s just like a sport, some are born with the talent, some have to practice a lot to get the necessary skills.

Why to Hack a Website? Are Not We White-Hat?

Even in case you never had a successful hack before i assume that once you here you already know what is the meaning of the pic above(the picture looks a little scary and more like a black-hat attitude) , the classification of hackers actually does not make a lot of sense, in my opinion there are newbies,hackers,expert hackers and even worse the skids around, even as a white-hat(according to what the world define as white-hat) sometimes you will find yourself in situations where you have to bring an a*hole down because they are running non--human websites like child pornography and etc.

OK! So How to Hack a Website?

There are a bunch of tutorials here on null---byte and around the internet on how to hack a website with a specific tool, in case you want to learn you are in right place, just look around, but today i want to share something that i think it will be very useful for you, take a cup of coffee grab your chair and start to read this, what i m going to show you today is totally different from my other tutorials, instead of showing you how to use these tools, i will guide you on how you can successfully use these tools and tricks to hack any website, based on my experiences.

Below is my list when i want to hack a website

The Reconnaissance

The reason why a lot of newbies and non-professional hackers fail to get a successful hacking is because they don´t want to wait, most of time they want a magic button where they can click and that´s all, but in the reality it does not work like that, the first thing you have to do is a good reconnaissance about your target, for those familiar with the software development is easier to understand what i mean, you can not develop a good software without a good documentation, just like the UML in software industry here is the same, we need info about the target to make our tasks easier.

My Advice on Good Recon

What are the services they are running?

Figure out stuffs like open ports, software and versions on the server, and try to look for the exploit in case there is at least one online, or you can just make your own exploit.

Tools that i recommend for this section are nmap,whatweb and nikto and of course some others made by Mr_Nakup3nda or you.

Did they write the script by themselves?

In case they wrote it by themselves, look for scripts that take user input,scan for directory listing,check the source code,figure out how the website react to abnormal inputs, i often use these inputs:

ADMIN' OR 1=1# when its an admin url like website/admin/loign/

when its a normal login just try those traditional sql injectors like
' OR '1'='1' --
' OR '1'='1' ({
' OR '1'='1' /*

, but it does not end here, try to write sql statements on the inputs, do echo back to you, try to execute a command based on the server OS, figure out how the website filter the inputs and try to bypass the filters.

And in case they used someone else's code such as CMS just grab a copy of it and try to find bugs on your own, or find an exploit if they use a exploitable version of the CMS.

The Evil Google

Sometimes i hack websites simply with the help of some crafted google searches, as hacker you must know how to use google to gather info or hack, in case you do not know you can see my tutorial on how to use google to hack

Changing the Source Code

I bet at this point you already know how to see the source code of a webpage using the right click trick, just to remember that scripting languages like php,perl,asp, python and so on run on the server--side, so it means you can not see by right click unless its an open source platform where you can get a copy of it and change the whole code.

Directory Listing

Index browsing can be very useful when trying to find files you normally shouldn't see like password files,files used to administrate the web page, log files, any files where information get stored.

you can also manually check for suspicious urls like that:
website.com/logs/
website.com/files/
website.com/sql/
website.com/secret/
you can either make tools that will automatically do it for you, tools like dirbsuter can be very useful for this task.

My Friend robots.txt

Its very important while hacking to have a look at these files, i wont explain the use of robots.txt(just google it), they often lead us to a lot of path where they don´t want robots to see and sometimes they are very sensitive paths.