Learning Materials

Auto-update Notice & End of Public Updates for Oracle JDK 7 Coincident with the January 2015 CPU release users with the auto-update feature enabled will be migrated from Oracle JRE 7 to Oracle JRE 8. Also, please note this release will be the last Oracle JDK 7 publicly available update. For more information, and details on how to receive longer term support for Oracle JDK 7, please see the Oracle Java SE Support Roadmap.

Do you want to run Java^TM programs, or do you want to develop Java programs? If you want to run Java programs, but not develop them, download the Java Runtime Environment, or JRE^TM.

If you want to develop applications for Java, download the Java Development Kit, or JDK^TM. The JDK includes the JRE, so you do not have to download both separately.

7u79 JRE MD5 Checksum
7u80 JRE MD5 Checksum

What is the difference between a Java CPU (7u79) and PSU (7u80) release?
Java SE Critical Patch Updates (CPU) contain fixes to security vulnerabilities and critical bug fixes. Oracle strongly recommends that all Java SE users upgrade to the latest CPU releases as they are made available. Most user should choose this release.
Java SE Patch Set Updates (PSU) contain all of the security fixes in the CPUs released up to that version, as well as additional non-critical fixes. Java PSU releases should only be used if you are being impacted by one of the additional bugs fixed in that version.

Visit Java CPU and PSU Releases Explained for details.

Java SE Runtime Environment 7u79 You must accept the Oracle Binary Code License Agreement for Java SE to download this software. Accept License Agreement Decline License Agreement
Product / File Description	File Size	Download
Linux x86	31.62 MB	jre-7u79-linux-i586.rpm
Linux x86	46.28 MB	jre-7u79-linux-i586.tar.gz
Linux x64	32.14 MB	jre-7u79-linux-x64.rpm
Linux x64	44.92 MB	jre-7u79-linux-x64.tar.gz
Mac OS X x64	48.65 MB	jre-7u79-macosx-x64.dmg
Mac OS X x64	44.58 MB	jre-7u79-macosx-x64.tar.gz
Solaris x86	52.32 MB	jre-7u79-solaris-i586.tar.gz
Solaris x64	16.15 MB	jre-7u79-solaris-x64.tar.gz
Solaris SPARC	55 MB	jre-7u79-solaris-sparc.tar.gz
Solaris SPARC 64-bit	18.15 MB	jre-7u79-solaris-sparcv9.tar.gz
Windows x86 Online	0.89 MB	jre-7u79-windows-i586-iftw.exe
Windows x86 Offline	28.12 MB	jre-7u79-windows-i586.exe
Windows x86	40.04 MB	jre-7u79-windows-i586.tar.gz
Windows x64	29.78 MB	jre-7u79-windows-x64.exe
Windows x64	41.75 MB	jre-7u79-windows-x64.tar.gz

Java SE Runtime Environment 7u80 You must accept the Oracle Binary Code License Agreement for Java SE to download this software. Accept License Agreement Decline License Agreement
Product / File Description	File Size	Download
Linux x86	31.63 MB	jre-7u80-linux-i586.rpm
Linux x86	46.31 MB	jre-7u80-linux-i586.tar.gz
Linux x64	32.14 MB	jre-7u80-linux-x64.rpm
Linux x64	44.93 MB	jre-7u80-linux-x64.tar.gz
Mac OS X x64	48.66 MB	jre-7u80-macosx-x64.dmg
Mac OS X x64	44.61 MB	jre-7u80-macosx-x64.tar.gz
Solaris x86	52.33 MB	jre-7u80-solaris-i586.tar.gz
Solaris x64	16.16 MB	jre-7u80-solaris-x64.tar.gz
Solaris SPARC	55.05 MB	jre-7u80-solaris-sparc.tar.gz
Solaris SPARC 64-bit	18.16 MB	jre-7u80-solaris-sparcv9.tar.gz
Windows x86 Online	0.89 MB	jre-7u80-windows-i586-iftw.exe
Windows x86 Offline	28.14 MB	jre-7u80-windows-i586.exe
Windows x86	40.06 MB	jre-7u80-windows-i586.tar.gz
Windows x64	29.79 MB	jre-7u80-windows-x64.exe
Windows x64	41.77 MB	jre-7u80-windows-x64.tar.gz

| Javascript Injections |

Disclaimer: This site is for learning purposes only! Anyone looking to commit a crime, must leave this page now! We do not encourage or approve illegal acts nor criminal activity of any sort. Using these skills outside of these sites could result in arrest and imprisonment!

Introduction: In this tutorial we are going to teach you all the basics you need to know, to start hacking with Javascript Injections. Hackers use Javascript Injections to find and change the values of elements in a website.

We can use Javascript for 3 things: Alerts, Cookies, forms, and values. And we have two types of injections we will use: Alert and Void. We use the Javascript Alert Injection to find out what an element is. And we use the Javascript Void Injection to change that element. The Javascript Void Injection prevents your page from refreshing. This ensures your changes are valid on your current page. While this can be done on any browser, most do not support this straight out of the box. The best browser to use while doing this is Internet Explorer.

The Javascript Alert injection: is used to show you the value of an element within the site via a pop up. A Javascript Alert is written like this “javascript:alert();” without the quotes. So in order to show the cookies on the site; we could write “javascript:alert(document.cookie);” in address bar and press enter. This would show us a list of the cookies in use. Which we can use as valuable knowledge to make our attack via a injection.

*note: This could be used to show the value of any element, just replace the cookie for the element of your choice.

The Javascript Void Injection: is used for changing the values of elements within the site. The void injection makes sure your web browser does not refresh. This ensures your changes validity on the current page your editing. We could use this to change the value of a cookie we found using our Alert Injection. For that we would write the following “javascript:void(document.cookie=”hackedcookie=value”);”. You would just replace ‘hackedcookie’ with the cookie you want to change. And ‘value’ to that which the cookie needs to be set to. For example you could use ‘true’ without the quotes. This could make the cookie (i.e. possibly a user) valid and grant you access to the site.

*note: This could be used to change the value of any element, just replace the cookie for the element of your choice.

Javascript Form Injections: You can use the methods learned above to edit forms as well. Through editing forms you can have valuable information like passwords emailed to you. But forms require the code to be written a little bit different. . For example let’s say the form code was the following “<form action=”http://www.test.com/submit.php” method=”post”> <input type=”hidden” name=”to” value=”info@test.com”>” you would need to write “javascript:void(document.forms[0].to.value=”myemail@tester.com”);” in order to change the email of the form. When Javascript Injecting a form you need to let it know which form you want to change; In case there are multiple forms on the page. The form is referenced by ‘forms[x]’, x being which form. The first form on the page is 0. Just like when counting arrays you start with 0 not 1. And you can change to.value to any part of the form you want to change.

*Note: To legally hack using what you learned in this tutorial please see our article on sites where you can legally hack by Clicking Here, most of them will have a mission related to the teachings in this tutorial. Just look out for the missions on Javacript

Javascript Hacking Tutorial

1. I need the HTML source code of the pages

A webpage consists of a main document, and, if that one is a framework, of any number of child pages. Parts of the script code may be in any of them. There are different methods to get the source code of the html pages. The easiest one is a right click in the desired frame, then choose view source. If that doesn't work for whatever reason, try to save the whole page to your desktop via the "File" menu.

If you get any problems with scripts in the page that disable right clicks or create popups, go and disable scripting in the browser menu first. Additional problems can come up if you are inside a framework and need to break out of it. Simply look for the name of the child window you want to go to inside the parent frames html source and plug the name into the browser. If you can't get the source that way you can use programs like "codelifter" to get it, or just telnet to the web server.

2. I need to analyze the html source code and find the JavaScript code inside.

Now that you have the html source code, look for the < script > < /script > tags. Inside those tags is the script code responsible for password protection. The code looks like standard Java, C# or C++ code. Its easy to understand. Now look into the html source again and find the < form > < /form > tags. There may be more than one for distraction, but the one you are looking for should have as action the name of a password script function you found.

There may be distraction inside the html source, like comment tags that hide the JavaScript code, so make sure you have the complete html source. Also make sure you scroll the complete source code file, there are programs out there that put lots of spaces into html code to hide parts of the code in very long lines or at the very end of the file behind a few thousand empty lines.3. I need to analyze the found password scripting function.

First make sure this is the function that really gets called, and not fake code to fool you. Now see if you find any hardcoded URL's inside the password script. JavaScript calls new webpages with something like

'window.open(newpage.php,_self)'

_self meaning in a new window, or

'location=newpage.php'

So if you find any hard coded URL, paste it into your browser and you are done. If the function creates the URL from the entered password or username and does not check it you will have to find them both by either fooling the owner of the password into giving it to you, or finding it written down somewhere.

If the script checks the entered password against something, either the plain text password or some generated hash, you can often get or guess the password from the comparison. Just look for it. Worst case you will have to understand the hash function and find passwords that fit into the comparison. The only really secure script is a script where the password really is the URL that gets called, either plain text or encrypted in any way. If you find a script like that and have no way to get the password, try to find other ways into the web server.

Sometimes people mess up file and/or folder restriction, allowing people to access parts of the web space that should be restricted, and that way finding files that are not for outside use. If that also fails you are down to good old brute forcing. That's not allowed in here, and won't be necessary. If brute forcing the web server should fail as well you would then go and attack other services like ftp with the hope to get access to the web files.

how to hack any password any site with javascript

Want to know someone's private website password? It's the biggest wanted hack: passwords, but how do you do it? Well, this tutorial shows you how to hack any password on any site with JavaScript. But this works best on public computers because multiple people log on to them, which means a better chance at unintentionally stored passwords. It helps to know a little bit about JavaScript before attempting this password hack.

link in description

https://www.youtube.com/watch?v=j9vQW6MsGA0