How Hackers Login To Any Websites Without Password?!

// Membership //
Want to learn all about cyber-security and become an ethical hacker? Join this channel now to gain access into exclusive ethical hacking videos by clicking this link: / @loiliangyang
// Courses //
Full Ethical Hacking Course: www.udemy.com/...
Full Web Ethical Hacking Course: www.udemy.com/...
Full Mobile Hacking Course: www.udemy.com/...
// Books //
Kali Linux Hacking: amzn.to/3IUXaJv
Linux Basics for Hackers: amzn.to/3EzRPV6
The Ultimate Kali Linux Book: amzn.to/3m7cutD
// Social Links //
Website: www.loiliangya...
Facebook: / loiliangyang
Instagram: / loiliangyang
LinkedIn: / loiliangyang
// Disclaimer //
Hacking without permission is illegal. This channel is strictly educational for learning about cyber-security in the areas of ethical hacking and penetration testing so that we can protect ourselves against the real hackers.

[@iqlessmemes4115]

It's a good day when hacker loi uploads.

[@Driftwood740EvSide]

Agreed

[@codespeed116]

and bad day for someone who he hacked

[@UnknownUser-sj3sc]

Facts

[@sciencekingdom2322]

Exactly bro Just found it and am already happy

[@hf-xb2wy]

try website I provide

[@gauntletwielder6306]

Interesting video. However…. 1. The IP address used in the video, is PRIVATE. Which means the server is on the same private network and probably NOT behind a firewall… therefore unrealistically easy to access. 2. Only completely incompetent people open up all ports to all IP addresses of a server facing the Internet. This is the kind of thing that would get someone fired immediately. 3. Most user names and passwords ( actually hashed passwords ) are stored in databases. Storing plaintext or encrypted passwords, goes against best practices. 4. Most password inputs check for the length ( is it too short or too long ) and content ( does it have numbers, lowercase, uppercase ) of the password BEFORE attempting to validate the password. Nice video, but too many red flags for me.

[@kanister21]

5. more and more websites forces user to use 2FA

[@UnDarkVader]

6. The exploit is very old. Its very less probably that this service didn't update in many time.

[@dev-debug]

The target was setup for the sake of the video but yeah on a modern server install most of what was running is off by default at install or firewalled. I haven't seen FTP enabled in a long long time, virtually everyone uses SFTP now. FTP and web apps like forum software had tons of security flaws in the past, they were the easy way in.

[@epolpier]

Red flags ? It's a pure bullshit...

[@animalconsultant7796]

Yeah basically all usernames and passwords are stored in a database and you’d need a lot of CPU power to crack anything

[@theunveil8333]

No trash talk, right into the topic nice vid man

[@FRUITSparty]

It's more complex than what he teach. Especially when you meet firewalls , other protection system timing.

[@FzEdits]

Really enjoyed the shorter video format here. Keeps things simple

[@moabifokotsane]

THE REAL LESSON : Find the login access port , look for vulnerabilities (of overall system) , exploit the vulnerability, when shell runs move on dir to find the login access system, look for config file of the login system, get credentials, HACK COMPLETE. 😄 NB : the system doesn't need to be running services you saw on the video only to be hackable, its a process learn and understand it, then apply steps on any machine. The lesson here is to understand the concept ((technical steps)) not to learn about a new vulnerability. Many systems have different services therefore the ((technical steps)) will remain the same but dealing with different machines, services and vulnerabilities.

[@ufc786]

Are most websites all hackable ? Like loi showed. Can all websites be hacked as admin ?

[@Sp3cia1m4n]

@@ufc786 all website are hackable but you have to find the right vulnerability for it, but you wanna hack web applications without any basic knowledge of programming language, Linux, windows, type of vulnerability, I guess go watch other channel this channel clearly don't explain what he's doing exactly.. Bottom line I came here to laugh at his stupidity and leave and found your comment thanks

[@YasiruRidmaka]

andrew tate?

[@user-vz8fs9yl8i]

😂😂😂😂😂

[@burstfireno1617]

Larry Tate 😂

[@Lazumor9]

LMAOOOO

[@YasiruRidmaka]

@@user-vz8fs9yl8i 🤣

[@YasiruRidmaka]

@@Lazumor9 🤣

[@alexanderohman1707]

How many servers are inside your own firewall, has passwords stored in plain text and all ports open and would accept an the hash rather than the password? This is like "opening a door without a key" when the door is a shower curtain.

[@Pinkyyybrainn]

But, imagine you never knew how to open the shower curtain - that's where this video helps!

[@Smiley957]

I think this video is meant for inexperienced web app developers who need to learn about these vulnerabilities.

[@animalconsultant7796]

But dude he hacked it dude, dude

[@tourreallen6872]

I wish you uploaded this two weeks ago. lol you taught me everything me prof did not in under 7 mins and he had a whole semester lol This is exactly what we did on the final even down to the elastics. makes me want to fire up Linux rn lol very informative thank you.

[@momosayma6647]

I need to find a login URL, can you find that please?

[@Pinkyyybrainn]

Just install linux and follow this guide man!

[@vinothnatarajan9154]

Hi, very interesting, i love this, how to connect you to learning.... pls help me out...

[@kamraman6487]

hacker loi why have you not been uploading 😭😭😭 my kali linux is running i have nothing to do

[@Franciscolney]

i watched many of your videos ,live demostrations,etc, i knew that you are an expert... Interesting...

[@Deepu253]

help me( i stucked at Started reverse TCP handler in metasploit)help me

[@onlyfuns7410]

Same☹️

[@Deepu253]

@@onlyfuns7410 how to get rid out of it

[@ronitdhase2511]

You can never take a chance to skip loi's Video..!!!!!

[@FunTime-qj9hn]

yes i like it, every second is important.

[@sushant7906]

Hi , sir can you give us a road map in hacking field like what we learn first and how we become a successful hacker

[@tamaragraham8342]

If you guys want to log in on any websites then you guys should watch these videos about how hackers log in any websites.

[@lynxi-b1e]

Hi sir, I need your help. Please

[@juliusrowe9374]

Loi, thanks for another brilliant tutorial sir!

[@creditphysician173]

It's a cool place, i don't what yo say i just liked and all the spies stuff they got

[@hassanwandoow3999]

hello how are you i want to learn syp security i want to become syp security but i didn't get good website can your help me pleace am from uganda am waiting your answer and teel me the fees if i manech i learn it

[@mustaqimahmed3304]

Can you show a video if some sites use vpn how to hack them;

[@Griff0617]

Hi Loi Liang Yang i have been hacked and can you pls help me if my pc is still hacked.

[@Notthetylor]

Hi. Is it save for me try to huck something for practice? 🤔

[@JesusChrist-zt6rg]

Oh God. I'm about to deploy a website all by my big boy self for the first time (meaning not a squares pace website but a website I hard coded **ahem with lots of open source help**). I'm worried it's gonna be vulnerable and now i'm really worried lol. But I'm gonna be much more careful now.

[@god8774]

You called for me? lol jk have a nice day, son.

[@randomletters1834]

JESUS!!!!!!!!!

[@melbinalbert1525]

Is there any way to track the live location of a mobile phone.

[@burikat392]

Hello sir. I have a friend scammed on intime tax refund website. He invested ₱50,000 and got scammed. Can you help my friend sir

[@seiv-]

I mean, you got yourself a meterpreter shell on the server. Why tf you would after that need to login to a random whatever service that the server is hosting ?

[@fflecker]

Can you realy use the hash in the glassfish config file as the password ?

[@lauwer_v6504]

Hello mr hackerloi i didn't understand why did u search the exploit elastic or how did you know that it was the exploit to use please do answer (love ur vids btw) Lauwer

[@2Sor2Fig]

Elastic is a common package used to enable search on many websites. He knew to use that exploit specifically because the nmap command returned it as one of the services running on an open port. Don't get too excited, though. There's almost no chance you'd find an open port to a service like that which wasn't password/IP address protected. This only works because the victim machine was intentionally very poorly designed.

[@lauwer_v6504]

@@2Sor2Fig Thanks for your answer, although i wasn't getting excited, i was just wondering why he did use this exploit other than a other (Thanks again for your answer)

[@2Sor2Fig]

@@lauwer_v6504 No probs

[@dietrichdietrich7763]

Okay, how do I protect my WordPress site from this kind of attack?

[@bluesquare23]

Updates! Automatic updates!!! Get a plugin for it or put a wp-cli command on a cronjob. Always keep ya shit up to date!

[@Peppermint1]

Small tip: if you suspect a hacked page, enter a wrong password, if you get access then walk away

[@JJs_playground]

How secure are banking apps on an android phone, with fingerprint biometrics?

[@TruthSeeker12345]

Informative and brief... Well Done...

[@rcchristian2]

Back in the old days, we would have to take that HSH and decrypt it. What I don't get is you enter the encrypted password in to the INSPECT element, but how does it decrypt it? It clearly isn't decrypting it. Is this a way around the decryption?

[@ArikCool]

Password isn't decrypted, he simply removed the code that hides the characters of the password. He is pasting the same hash string if you look carefully.

[@rcchristian2]

@@ArikCool haha! :) I wrote this a year ago... lol forgot about it. Yeah I figured it out shortly after I posted this, but forgot I posted! I didn't realize this was a private IP what he did was use a remote code execution vulnerability (in glass fish) that created a shell on the server. From the shell he found the password stored in plain text. Glassfish was looking at the POST body and hashing anything with type password and because the type was removed, the value of password wasn’t hashed server side and just compared against the stored hashed password.

[@ArikCool]

@@rcchristian2 hey thanks for elaborated answer but I have one question. So. because he removed the 'password' property from input variable the server won't hash tje password?

[@rcchristian2]

@@ArikCool said _"So. because he removed the 'password' property from input variable the server won't hash tje password?"_ Exactly. Apparently that was a vulnerability in Glassfish which I assume has been plugged by now. I think what the point of this video is... finding shell, executing server side commands, you can find exploits and vulnerabilities in tons of applications server side because of less security and bad programming. I think this is what the video poster was trying to demonstrate.

[@ArikCool]

@@rcchristian2 Thank you very much dude for the help, I checked your playlisy called 'something to think about' its great to know that we share the same interest.

[@sadidas1]

Sir big fan please reply how to start with your "how to hack series".what shall I know or learn before starting before starting or algorithm of starting it

[@lishmansupport716]

☝️☝️ get in touch with them on the official page they can help get hidden information about background checks and other services available in pdf

[@janthony824]

Hi I've been having a lot of issues with cellphone data and home Internet. In the first part of the video you said u know u would know if someone would hack you. Can you explain the process or tools you use for that??

[@tanmoyrajtuhin8653]

Brother, how can I be a member of your youtube channel?

[@Filipino8729]

hello, how are you. just want to ask how to recover social media got hack and they changed password, name and make it private. i still have my social media link that been hack.

[@wahyono1739]

Sudo msfconsole need a passwd and where we can find this passwd ?.if we target a machine is it posible that we know the msfconsole passwd ?

[@SqurdTheOne]

so, if a hacker hacks my outlook. changes its name. (wich i know) how can i hack it?

[@Goldindollar]

Your awesome!! Love the videos you make

[@basilbrian]

Wow! I've been waiting for you😂

[@reinoob]

What about just leaving port 80 open and proxy whatever you need to be open to the world?

[@2Sor2Fig]

Yeah, all those services should be running in dockerized containers without publicly exposed ports. Poor systems architecture seems to be 70% of getting hacked.

[@nerdygeek9865]

Let’s face it some of us are here to get revenge on someone

[@3dsbros64]

And let's be realistic for those who want that: You will not be able to hack that person. *cries*

[@labiV1]

@@3dsbros64 sadly 😢

[@3dsbros64]

@@labiV1 ye i know 3dsbros64 0001

[@sfincione2000]

Yeah, this was pointless since he's "hacking" his own server and has loads of ports open. This isn't hacking

[@techwithajak]

Your a best ethical Hacker sir

[@cameronrich2536]

Only a mad lad would show how to hack their system. I've been telling you guys he's savage

[@abiolamashood3829]

hey can you help get some credible details on how i can access the student portal of our school

[@masterkeyplanolocksmith3674]

Amazing, but could you please speak a little bit slower please🙏

[@momosayma6647]

I need to find an admin login page, can anybody please help?

[@mc.chandra1935]

how long does it take time for the result nmap -sV -p1-65535 ipadd ?

[@SamuraiXProGaming]

just awesome nice bro just keep moving forward

[@ltthepm]

Hello Loi I’m 17 years old starting out in the e-commerce, reselling business buying and selling items from thrift stores to Walmart and target. And throughout this since I can’t have my own debit card yet I have to buy visa gift cards and someone has stolen some of my info I’ve used to register those cards I’m pretty sure. They keep buying something from google play and stole about $150+ if I’m correct and even though that may not seem like a lot to you it’s a lot for me due to the current situation I’m in. what’s a way I can prevent this from happening again and if able to can you or your subs help me out? I wanna find out who the person behind this scam is so they can get justice but the visa website never has customer service available

[@shaxzoddavlatov3957]

😆😆 he get password from config file and config file located in local computer.

[@shutanovac]

lolz this is what he does in every video, mixing it with some hackery mumbo jumbo and dramatic overacting 😂

[@telischrisos2628]

Lol

[@EGTFROUDHACK]

You need to be hiden once you do this, i think you forgot to specify this, any scan you do you're ip gets send to host, so you need to use proxychain

[@nervonabliss2071]

Anyone willing to do this should know that already

[@user-vq8pe9dd7e]

Please does this work and have you tried it

[@vijayendrarathod]

Totally uselesss as 2013 vulnerability already patched in 2022

[@amirramadan3625]

Do u ve the new version tools!!

[@vijayendrarathod]

@@amirramadan3625 0day vulnerability reported to bug bounty and reporter need to agreed to non disclosure agreements untill the vulnerability fixed hence whatever paylod exist in Metasploit it is already patched so no point to use that useless things

[@amirramadan3625]

So that mean that no one can do it anymore??? Is there any chance to do this!!

[@vijayendrarathod]

@@amirramadan3625 if you can get 0day payload before it patched in real world

[@djvinesse1719]

Some Info here helped me! Thank you friend!

[@KeroZimerman]

I don’t get it. How is removing the “password” type from the password input field make the server accept the verbatim password hash instead? AFAIK, the only thing the “password” property does is display ‘*’s and deny copying its contents. Whatever the user enters *must* be converted to a hash (with salt added) before comparing it to the stored hash.

[@telischrisos2628]

Haha indeed.

[@CodrTV1]

My guess is that is the vulnerability that’s being exploited here. Probably Glassfish is looking at the POST body and hashing anything with type password. Because the type was removed, the value of password wasn’t hashed server side and just compared against the stored hashed password.

[@KeroZimerman]

@@CodrTV1 Yes, that is a plausible explanation. This would be *very* lazy programming, though. The server must *never* assume that the data provided by the client is benign.

[@CodrTV1]

@@KeroZimerman oh absolutely. But this is why vulnerabilities exist. Inexperienced developers making silly mistakes.

[@daitedve1984]

There is no need to remove "password" type - it's just for presentation. Actual trick is to prevent JS from hashing your ALREADY HASHED password and send this hash directly to the server (like it's done by JS). Nothing hard and done logical.

[@meysamamarlou7671]

why you are so fast😄 please make one video about how to find admin login page

[@Steve_Bloks]

how to install metasploit? i tried sudo apt install metasploit but it didnt work

[@dasariupendarrao4233]

Love from India 🇮🇳🇮🇳❤️

[@BambiOnIce19]

Just hit 'ENTER' ????? lolol Yes, i've done it before.... But I DO behave these days, just staying out of trouble.... However, i find your videos so very delightful, you are very, very, VERY good. I cannot believe that they even let you publicise all this information - unbelievable

[@Kiddie91]

Sir, is the target from the AWS cloud?

[@xinuai3655]

Thank you for tips but im not talking abt this video but another my phone got hacked and your tips helped me so the hacker tried to send sms called access content blah blah to many numbers but my sim hasnt been rechared so i was fine thanks

[@mohamaddahhan6069]

really nice camera and energy, love it

[@ilanamper9436]

What to do if No Session was created ?

[@codopy]

you should have told them how long the nmap scan took 😂 😂

[@devopsyoutube]

7 hours!!!!!!!!!!

[@onlyharleygames]

does it effect the server of the website ? by scanning all the ports ?

[@mitchellpullin4766]

what program are you using?

[@linux6065]

Just awesome!

[@rupadas9040]

Wow so lovely vedio... Really amazing.. Well done thanks for sharing this vedio . 🙂🙂🙂

[@qshindia]

Great tutorial sir, love this from India. Sir can you make a video how can i recover ranking hacked website. My site was hacked and recover the content but failed to get visitors and ranking in serch engine

[@deadbrad6041]

0:38 i love his threats ahhh like an anime villan!

[@willywonkka]

Who leaves the ports open? 😂

[@kevinm7523]

People can forget to wipe their own assess, forgetting to close ports isn't a stretch

[@mr-black_rock321]

nowadays nobody put the password in config file, we use volt with hash value. Its waist of time to crack password. Phishing is most powerful tool for hacking.

[@adnansheikh4751]

Hii ,sir your video is great ! I LEARN ALOT OF haking from your channel

[@jacoblessard8213]

Whatever you do, don't tell them you know who is Hacker Loi 👀

[@trioluminatti]

Bro ethical hacking is much more difficult than this in real time, WTF is all these?!

[@captianhegantv6638]

I loving hacking but ,not knowing the way

[@iwasthererecording]

What if 2FA is enabled? 🤔

[@rikysharaya5110]

thn u very much , even i tried it , it works 👍👍👍👍👍

[@katherinefiori]

Is there any way I can see my gmail password whilst I am logged in on my pc? I don't remember the password and it is not saved in password manager. Please help 🙏🥺🥺

[@swizzleedits8500]

Could you do a video fro roblox like hacking a roblox account?

[@pa32779]

0:45 *That crap scares me man, pls no evil laugh* XD

[@dollymartin3035]

Good day sir please how can I become a member of this channel sir …

[@bilalkhan-gj5su]

Hi Sir how i can change content of someone other website that i am not the owner because some website sharing my property personal information like cars pictures etc?

[@GET_A_LIFE_420]

My dad is also cissp certified and also and aws trainer but he never let watch stuff Can u help me in hacking a pvt website portal

[@AMI13554]

Failed to resolve/decode supposed IPv4 source address "V": Temporary failure in name resolution

[@expertgamer2309]

Can you please tell a password of a site/someone login password to me.....if possible...please

[@sharky9493]

Thanks Loi ,very good. I learned somthing new....but,,please slooooow down! You are to fast. Had to press stop several times to read the output,, and understand :)

[@darkness8876]

Dude 😂 That greeting was off the charts hallarious!🤣🤣

[@essenceidentity]

This was great very useful!!! 😃🤘

[@gesnow]

No Firewalls and no IP Tables setup on the servers, interesting.

[@telischrisos2628]

Haha this must be an ideal world for hackers 😁

[@LTP23]

Yeah! Perfect server😂

[@raymondakoson5165]

Private IP. Not realistic especially if the target is behind a WAF and or there's MFA in place!

[@moacirschneider5096]

hi, i am from brasil, i learn to much from you

[@alphalearninghub5237]

Thank you. Very good example 👍

[@friendlyapk]

I Use Email verification before entring to database! I use passwordless login! Tell what else can I DO?

[@PraiseThaDon]

You know how to hack?

[@friendlyapk]

@@PraiseThaDon i know some testing not a hacker!

[@conferences4u]

How to hack Facebook any account?

[@seyiekuolieseyie1005]

Can you hack any website..?

[@practiceaccount2727]

Please make video on how hackers get/order anything for free plzzz

[@purdysanchez]

Who exposes all those systems through their edge servers for nmap to find them?

[@dev-debug]

Who installs FTP ? lol