Hackers Elite

In this post i will teach you how to get in-app purchases for free in Android device. There are paid apps, that you need to pay before you download it. But there are apps which is free to download, but in game there are some things that you can buy with real money, or activate to Pro version. And in this post we gonna learn to do that all for free.

1) You need a rooted Android device.
2) Download this app and install it.
3) Now go to Settings of your device. And from Security select Unknown sources.
4) After that you need to change time zone of phone to the Moscow GMT +4:00.
5) After that open app you just downloaded on step 2. And you need to press on the Grant button from pop out SuperSU window. And your device need to be connected to the internet!
6) And you can see the list of your apps, where in-app purchase is available.
7) Choose one app from list and wait after its finished loading.
8) And after app opened, you need to go to page of upgrading, or if its a game the press on the plus button to buy coins or something like that.


9) After that press on the purchase button and in pop out little window press on BUY button.



10) And You can see Payment Successful message.
11) But after you finished in-app purchasing i recommend you to delete that app, if you want to do in-app purchasing then install it again.
12) Now you can't use Play Store, its showing no connection error message. 
13) After you have deleted that app, you need to install one app from this post. Do all as in that post and open that hosts file.
14) And remove 2nd line from file. Only keep first line 127.0.0.1 localhost and press on the save button and in pop out window press on the OK button and after that on Yes button.



And that's all. You can ope Play Store!

If you are a newbie in hacking then you need to learn some things. There are some terms that every hacker should know about them. Some words and abbreviations that you should know.

Some words you need to know about

Algorithm - A series of steps specifying which actions to take in which order. 
ANSI Bomb - ANSI.SYS key-remapping commands consist of cryptic-looking text that specifies, using ansi numeric codes to redefine keys. 
Back Door - Something a hacker leaves behind on a system in order to be able to get back in at a later time. 
Binary - A numbering system in which there are only two possible values for each digit: 0 and 1. 
Black Hat - A hacker who performs illegal actions to do with hacking online. (Bad guy, per se) 
Blue Hat - A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events. 
Bot - A piece of malware that connects computer to an attacker commonly using the HTTP or IRC protocal to await malicous instructions. 
Botnet - Computers infected by worms or Trojans and taken over by hackers and brought into networks to send spam, more viruses, or launch denial of service attacks. 
Buffer Overflow - A classic exploit that sends more data than a programmer expects to receive. Buffer overflows are one of the most common programming errors, and the ones most likely to slip through quality assurance testing. 
Cracker - A specific type of hacker who decrypts passwords or breaks software copy protection schemes. 
DDoS - Distributed denial of service. Flooding someones connection with packets. Servers or web-hosted shells can send packets to a connection on a website usually from a booter. 
Deface - A website deface is an attack on a site that changes the appearance of the site or a certain webpage on the site. 
Dictionary Attack - A dictionary attack is an attack in which a cyber criminal can attempt to gain your account password. The attack uses a dictionary file, a simple list of possible passwords, and a program which fills them in. The program just fills in every single possible password on the list, untill it has found the correct one. Dictionary files usually contain the most common used passwords. 
DOX - Personal information about someone on the Internet usualy contains real name, address, phone number, SSN, credit card number, etc. 
E-Whore - A person who manipulates other people to believe that he/she is a beautiful girl doing cam shows or selling sexual pictures to make money. 
Encryption - In cryptography, encryption applies mathematical operations to data in order to render it incomprehensible. The only way to read the data is apply the reverse mathematical operations. In technical speak, encryption is applies mathematical algorithms with a key that converts plaintext to ciphertext. Only someone in possession of the key can decrypt the message. 
Exploit - A way of breaking into a system. An exploit takes advantage of a weakness in a system in order to hack it. 
FUD - Fully undetectable, can be used in many terms. Generally in combination with crypters, or when trying to infect someone. 
Grey Hat - A grey hat hacker is a combination of a Black Hat and a White Hat Hacker. A Grey Hat Hacker may surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has been hacked, for example. Then they may offer to repair their system for a small fee.Hacker (definition is widely disputed among people...) = A hacker is someone who is able to manipulate the inner workings of computers, information, and technology to work in his/her favor. 
Hacktivist -  A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks. 
IP Address - On the Internet, your IP address is the unique number that others use to send you traffic. 
IP Grabber - A link that grabs someone's IP when they visit it. Keylogger - A software program that records all keystrokes on a computer's keyboard, used as a surveillance tool or covertly as spyware.Leach = A cultural term in the warez community referring to people who download lots of stuff but never give back to the community. 
LOIC/HOIC - Tool(s) used by many anonymous members to conduct DDoS attacks. It is not recommended to use these under any circumstances. 
Malware - Software designed to do all kinds of evil stuff like stealing identity information, running DDoS attacks, or soliciting money from the slave. Neophyte = A neophyte, "n00b", or "newbie" is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking. 
smith - Somebody new to a forum/game. 
OldFag - Somebody who's been around a forum/game for a long time. 
Packet - Data that is sent across the Internet is broken up into packets, sent individually across the network, and reassembled back into the original data at the other end. 
Phreak - Phone Freaks. Hackers who hack cell phones for free calling. Free Long distance calling. Etc. 
Phreaking - The art and science of cracking the phone network. Proxy - A proxy is something that acts as a server, but when given requests from clients, acts itself as a client to the real servers. Rainbow Table - A rainbow table is a table of possible passwords and their hashes. It is way faster to crack a password using rainbow tables then using a dictionary attack (Bruteforce). 
Remote Administration Tool - A tool which is used to remotely control (an)other machine(s). These can be used for monitoring user actions, but often misused by cyber criminals as malware, to get their hands on valuable information, such as log in credentials. Resolver - Software created to get an IP address through IM (instant messenger, like Skype/MSN) programs. 
Reverse Engineering - A technique whereby the hacker attempts to discover secrets about a program. Often used by crackers, and in direct modifications to a process/application. 
Root - Highest permission level on a computer, able to modify anything on the system without restriction. 
Rootkit (ring3 ring0) - A powerful exploit used by malware to conceal all traces that it exists. Ring3 - Can be removed easily without booting in safemode. Ring0 - Very hard to remove and very rare in the wild, these can require you to format, it's very hard to remove certain ring0 rootkits without safemode. 
Script Kiddie - A script kid, or skid is a term used to describe those who use scripts created by others to hack computer systems and websites. Used as an insult, meaning that they know nothing about hacking. 
Shell - The common meaning here is a hacked web server with a DoS script uploaded to conduct DDoS attacks via a booter. OR A shell is an script-executing unit - Something you'd stick somewhere in order to execute commands of your choice. 
Social Engineer - Social engineering is a form of hacking that targets people's minds rather than their computers. A typical example is sending out snail mail marketing materials with the words "You may already have won" emblazoned across the outside of the letter. As you can see, social engineering is not unique to hackers; it's main practitioners are the marketing departments of corporations. 
Spoof - The word spoof generally means the act of forging your identity. More specifically, it refers to forging the sender's IP address (IP spoofing). (Spoofing an extension for a RAT to change it from .exe to .jpg, etc.) 
SQL Injection - An SQL injection is a method often used to hack SQL databases via a website, and gain admin control (sometimes) of the site. You can attack programs with SQLi too. 
Trojan - A Trojan is a type of malware that masquerades as a legitimate file or helpful program with the ultimate purpose of granting a hacker unauthorized access to a computer. 
VPS - The term is used for emphasizing that the virtual machine, although running in software on the same physical computer as other customers' virtual machines, is in many respects functionallyequivalent to a separate physical computer, is dedicated to the individual customer's needs, has the privacy of a separate physical computer, and can be configured to run server software. Warez - Software piracy 
White Hat - A "white hat" refers to an ethical hacker, or a computer security expert, who specializes in penetration testing and in other testing methods to ensure the security of a businesses information systems. (Good guy, per se) 
Worm - Software designed to spread malware with little to no human interaction. Zero Day Exploit = An attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability. This means that the developers have had zero days to address and patch the vulnerability.

Abbreviations

DDoS - Distributed Denial of Service 
DrDoS - Distributed Reflected Denial of Service Attack, uses a list of reflection servers or other methods such as DNS to spoof an attack to look like it's coming from multiple ips. Amplification of power in the attack COULD occur. 
FTP - File Transfer Protocol. Used for transferring files over an FTP server. 
FUD - Fully Undetectable 
Hex - In computer science, hexadecimal refers to base-16 numbers. These are numbers that use digits in the range: 0123456789ABCDEF. In the C programming language (as well as Java, JavaScript, C++, and other places), hexadecimal numbers are prefixed by a 0x. In this manner, one can tell that the number 0x80 is equivalent to 128 decimal, not 80 decimal. 
HTTP - Hyper Text Transfer Protocol. The foundation of data communication for the World Wide Web. 
IRC - Internet Relay Chat. Transmiting text messages in real time between online users. 
JDB - Java drive-by, a very commonly used web-based exploit which allows an attacker to download and execute malicious code locally on a slave's machine through a widely known java vulnerability. 
Malware - Malicious Software 
Nix - Unix based operating system, usually refered to here when refering to DoS'ing. 
POP3 - This is the most popular protocol for picking up e-mail from a server. 
R.A.T - Remote Administration Tool 
SDB - Silent drive-by, using a zero day web-based exploit to hiddenly and un-detectably download and execute malicious code on a slave's system. (similar to a JDB however no notification or warning is given to the user) 
SE -  Social Engineering 
Skid - Script Kid/Script Kiddie 
SMTP - A TCP/IP protocol used in sending and receiving e-mail. SQL - Structured Query Language. It's a programming language, that used to communicate with databases and DBMS. Can go along with a word after it, such as "SQL Injection." 
SSH - Secure Shell, used to connect to Virtual Private Servers.  
TCP -  Transmission Control Protocol, creates connections and exchanges packets of data. 
UDP - User Datagram Protocol, An alternative data transport to TCP used for DNS, Voice over IP, and file sharing. 
VPN - Virtual Private Network 
VPS - Virtual Private Server 
XSS (CSS) - Cross Site Scripting 

You should learn this all. Else you will stay a newbie.

In previous post we already talked about what is Phishing, how we can use it and for what is that. And now really time come to learn how we can hack Facebook accounts using Phishing attack. 

1. Download Facebook Phishing page files.
2. Now go to this free hosting website and create an account. Ar registration time choose free subdomain and write something in text box.
3. After that check your mailbox you will received a mail with verification link. 
4. After you clicked on that verification link, you will be redirected to that hosting page.
5. Under Action tab press on the Refresh Status and after that press on the Go TO CPanel button.


6. And now little scroll down find and choose File manager.


7. Now in new opened tab you need to enter password of your this web hosting account, enter it and press on Continue button.
8. Now go to public_html folder and delete default.php file.
9. After you delete file, press on the Upload button.
10. In new screen you need to press on the Browse button from right side and choose that zip archive you already download in step 1. And definitely press on the green button.


11. Now you need to send phishing link to victim. Which you entered at registration time. You can find it from CPanel page at right side.
12. But make that link shorten to not detect as SPAM. We already talked about how we can shorten links with URL shorteners.
13. After victim open a link and enter his/her login and password you can get it.
14. Go to that webhosting and login to your account. Go to CPanel and after that File Manager. Go to public_html folder and click on log.txt file name. Download that text document and open it!


Now your done! You have hacked Facebook account using Phishing Attack.

In this post i'll give you special software which generate license keys for programs. When you download a trial version of software you start search any serial key or crack of that program. But results not usually can be good. You can defaced to the problem such as you can download a virus between of crack. And you need to be secure for that, because its can be dangerous. And for that this key generator will help you to bypass that dangerous searching process. You can find a list of famous programs, which means you have a serial of that program. So i recommend you to download it now and see the results.

Password of RAR file: 46xX5xFV6qVTVEr

As you remember in previous post we talked about surveys, how to bypass them. And in this post i'll show you more smart and easy ways to do that, i mean bypass surveys. So i hope you like it, do not forget to share it with your friends and stay tuned.

In some survey websites we need to fill our information to bypass them, such as phone number, mail address etc.
And really that's some time dangerous, because we give our information to some faces whom we don't ever know. And after defaced that problem we sadly close that window, and stop that process, complete survey.
But there are method to fill fake information and bypass them easily.
We do this with Firefox browser as usually.
1. Add this extension to your Firefox browser.
2. After installing it download this script which runs with the help of that add-on you just added to Firefox.
3. Now make sure that add-on you have added is active.

And now go to that survey website which want that you fill your information.
4. You can see an option on top left side of the page Press CTRL+SHIFT+F to fill in form.

5. Do all as you see in that text, press keyboard combination CTRL+SHIFT+F and you will see that all information automatically get filled. Click on Submit and you already have completed Survey.
But that's not all. Maybe some surveys need to verify your identity by logging into your mail to open some URL or get some pin.
For that you need to open this website. Go to this site and you'll get a temporary email id for around 15-30 minute. Now paste that temporary email id at the place of email id which your intelligent form has randomly filled and click on submit form.
Check received mail from this link. And your done!

But wait this is not all. Some surveys ask for voice calls verification. Don't worry there are solution for that too.
Go to this website, register, and now you can receive with this website voice calls via mail.

Really awesome ways to bypass that surveys, that we don't like. Enjoy it!

I think that you ever listen about Phishing. So maybe you listen that you can create clone of some websites, give them same template, only URL little different. And send that to your victim, and after he fill on his email and password, he got hacked. All information come to you. So in this post i will explain more about Phishing, more exactly. And after that you understand completely about Phishing.

Phishing is for fraudulently acquire sensitive information, such as usernames, passwords and credit card details, by appearing as a trustworthy entity in an electronic communication. Phishing is typically carried out by email or instant messaging and often directs users to enter details at a website, although phone contact has also been used.
Recent phishing attempts have targeted the customers of banks and online payment services.
Spoofed e-mails are the most widely used tools to carry out the phishing attack. In most cases we get a fake e-mail that appears to have come from a Trusted Website. Hacker may request victim to verify username and password by replaying to a given email address.

Link manipulation is the best method of phishing to make a link in an email appear to belong to some trusted organization. Misspelled URL or the use of subdomains are common tricks used by phishers. To imagine good look at example given below.

www.gogle.com
www.goolge.com
instead of www.google.com

Phishers are using images instead of text to make harder for anti phishing filters to detect text used in phishing emails. This is why Gmail and Yahoo disable the images by default for incoming mails. 
Hackers often include official looking logos from real organizations and other identifying information taken directly from legitimate Web sites. For example look at picture below.

There are a few phrases to look for if you think an e-mail message is a phishing scam. 

1. Legitimate sites will never ask you to send passwords, login names, Social Security numbers, or any other personal information via email.

If you don’t respond within 48 hours, your account will be closed.
These messages convey a sense of urgency so that you’ll respond immediately without thinking.

Dear Valued Customer.
Phishing email messages are usually sent out in bulk and often do not contain your first or last name.

Click the link below to gain access to your account.
HTML formatted messages can contain links or forms that you can fill out just as you’d fill out a form on a Web site. The links that you are urged to click may contain all or part of a real company’s name and are usually “masked,” meaning that the link you see does not take you to that address but somewhere different, usually a scam Web site.

           Defend From Phishing Attack

1. Never assume that an email is valid based on the sender’s email address. 
2. A trusted bank/organization such as PayPal will never ask you for your full name and password in a PayPal email. 
3. An email from trusted organization will never contain attachments or software. 
4. Clicking on a link in an email is the most insecure way to get to your account.

That's it. I hope you understand all about Phishing. So stay tuned and we will post how to create Phishing websites and how to hack someone, get someones log in and password.

So i know that all of you like this post, because i know that all of you play computer games. So in this post i will give you a Hacker game. That game is very interesting and really amazing. You hack banks, organizations, use a lot of hacking software. Me too play this game and really i like it. So share it with your friends, post comments in comment section below. So enjoy it.

                                                                                                            

Sometimes, there is a downside to the fact that the internet makes everything so easy. Case in point: cybercrime. Without ever seeing you, total strangers can access passwords and information that will give them access to your funds, credit and even your identity. In short, any personal data that you have access to online, from bank accounts to sensitive emails, can fall prey to a hacker. One of the most common ways of internet fraud is through the use of keylogging or the use of spyware to monitor every keystroke you make. Such criminal technology is all the more sinister in that it can be difficult to detect; however, if you are vigilant, it doesn’t take a tech whiz to keep the keyloggers at bay. Here are some reliable guidelines to prevent your information from getting hacked, to know if you are being keylogged, and what to do if you know you’re being compromised.

• Know your control panel. This sounds simple, but keeping track of your authorized programs may be all you need to do. If there’s a mystery guest on your panel, check it out ASAP—this may even include hardware that your computer sees, but simply does not exist! 

• Regularly “do the sweeps.” A number of routine security precautions are also reliable ways of routing out spyware. Do regular scans with a reliable virus protector to find possible trojans, and always make sure your firewall is up. You should also inspect all running programs from time to time by pressing the “control”, “alt” and “delete” keys to consult your task manager. 

• Always consider the source. In short, never open a file from someone you don’t know—this includes pop-ups from mystery contacts. Most of all, never respond to pop-ups or emails requesting you to update your ID’s or passwords; it’s almost certainly a scam. Finally, while this may seem slightly overboard, make a habit of intermittently checking the web addresses of the sites you visit. Dummy sites used to harvest vital information may be perfect facsimiles, but they will have suspicious-looking URLs. 

• Use the big guns. If you regularly access particularly sensitive materials or you have reason to suspect you are a repeated target, it would be wise to take special precautions. Certain programs, such as Microsoft’s Process Monitor or Hijack This, will find any invaders. You may also consider running from a virtual PC so you can leave fewer trails for hackers to follow.

BIOS passwords are used to add some extra security to computers. You can either set a password to prevent access to BIOS settings or to prevent PC from booting. But sometimes this extra security might become a pain when you forget the BIOS password or someone changes your system BIOS password intentionally. There are some tricks to reset the BIOS password.
Almost all motherboards use a small coin sized CMOS battery to store all BIOS settings along with the password. To reset the password, unplug the PC, open the cabinet and remove the CMOS battery for approx. 15-30 minutes and then put it back. It'll reset all BIOS settings as well as the password and you'll need to re-enter all settings. If it fails, then try to remove the battery for at least one hour.

Method No 1

Almost all motherboards contain a jumper that can clear all CMOS settings along with the BIOS password. The location of this jumper varies depending upon the motherboard brand. You should read your motherboard manual to check its location. If you don't have the manual then look for the jumpers near the CMOS battery. Most of the manufacturers label the jumper as CLR, CLEAR, CLEAR CMOS, etc. When you find the jumper, look carefully. There will be 3 pins and the jumper will be joining the center pin to either left or right pin. What you need to do, is remove the jumper and join the center pin to the opposite pin. e.g. if the jumper joins center pin to left pin, then remove it and join center pin to right pin. Now wait for a few seconds and then again remove the jumper and join the center pin to left pin. Make sure to turn the PC off before opening the cabinet and resetting the jumper.

Method No 2

This method works only if you have access to the system when its turned on because this method requires MS DOS. Open Command Prompt from Programs menu and provide following commands.
debug 
o 70 2E 
o 71 FF 
quit 
After providing the above commands, restart your system and it should reset the CMOS Settings along with the BIOS password.

In this post we explain the difference between hackers and crackers, and speak about hackers hat colors. Every Hacker need to know this information, and need to know which type of hacker he want to become. 
For many years, media has erroneously used the hacker word with a cracker. So the general public now believes hacker is someone who breaks into computer systems,hack passwords, websites and misuse them. But this is absolutely untrue and it demoralizes some of our most talented hackers.

"Hacking is unauthorized use of computer and network resources. (The term "hacker" originally meant a very gifted programmer. In recent years though, with easier access to multiple systems, it now has negative implications.)"

There is a very thin line difference between the hacker and cracker. Like a coin has two faces heads or tails, similar is true for computer experts. Some uses their techniques and expertize to help the others and secure the systems or networks and some misuses them and use that for their own selfish reasons. There are several traditional ways that determines the difference between the hackers and crackers. I will provide you these ways in order of their acceptance in the computer and IT market. First of all, let me provide you the basic definitions of both hackers and crackers.

Hackers

A Hacker is a person who is extremely interested in exploring the things and recondite workings of any computer system or networking system. Most often, hackers are the expert programmers. These are also called Ethical Hackers or white hat hackers. And the technique or hacking they perform is called ethical hacking. Ethical Hacking Means you think like Hackers. i.e First you Hack the Systems and find out the loop holes and then try to correct those Loop Holes..These type of hackers protect the cyberworld from every possible threat and fixes the future coming security loop holes. These peoples are also called as "GURU's" of Computer Security. 

Crackers

Crackers or Black Hat hackers or cheaters or simply criminals, they are called criminals because they are having the mindset of causing harm to security and they steals very useful data and use it in wrong ways. Phishers also come in this category who steals account info and steal your credit card nos. and money over the Net.

To imagine better look at picture below.



I hope this will help you to clear most of your doubts about hackers and crackers. And the most important thing, until and unless a ethical hacker thinks like a cracker you can never become a expert ethical hacker because to get most out of any computer system you must understand the mindset of crackers that what they can do and up to what level they can damage. Now when you will identify the vulnerabilities and loopholes , If you fixes them so that in future anyone cannot breach that same vulnerability then you are Hacker or ethical hacker or White Hat hacker and if you utilize that loophole of misdeeds or for fun then its cracking or Black hat hacking. And black hat hackers are intelligent peoples but criminals or simply cyber cops call them evil genius. For more such articles keep visiting our website or simple subscribe our post so that you can directly get this on your email.

I'm sure that you know about Firefox browser, and hope that you use it. So it was the best browser for hacking, and more safe. And in this post we talk for what we can use, where exactly we can use in hacking. So there are special add-ons for Firefox, which can help us in some parts of hacking. I hope that you enjoy this post.

1) Hackbar

Hackbar is a simple penetration tool for Firefox. It helps in testing simple SQL injection and XSS holes. You cannot execute standard exploits but you can easily use it to test whether vulnerability exists or not. You can also manually submit form data with GET or POST requests. It also has encryption and encoding tools. Most of the times, this tool helps in testing XSS vulnerability with encoded XSS payloads. It also supports keyboard shortcuts to perform various tasks.I am sure, most of the persons in the security field already know about this tool. This tool is mostly used in finding POST XSS vulnerabilities because it can send POST data manually to any page you like. With the ability of manually sending POST form data, you can easily bypass client side validations of the page. If your payload is being encoded at client side, you can use an encoding tool to encode your payload and then perform the attack. If the application is vulnerable to the XSS.
Add to Firefox

2) Tamper Data

Tamper data is an great tool to to view and modify HTTP/HTTPS headers and post parameters. We can alter each request going from our machine to destination host with this. Thus it helps in security testing web application by modifying POST parameters. It can be used in performing XSS and SQL Injection attacks by modifying header data.
Add to Firefox

3) Cookies Manager +

Cookie Manager is one of the greatest tool ever made. Using this tool you can actually play with cookies. You can alter almost all cookie using this tool. You can use Cookies manager to view, edit and create new cookies. It also shows extra information about cookies, allows edit multiple cookies at once and backup/restore them.
Add to Firefox

4) Firebug

Firebug is a nice add-on that integrates a web development tool inside the browser. With this tool, you can edit and debug HTML, CSS and JavaScript live in any webpage to see the effect of changes. It helps in analyzing JS files to find XSS vulnerabilities. It’s an really helpful add-on in finding DOM based XSS for security testing professionals.
Add to Firefox

5) Grease Monkey

Grease Monkey is an counter part of No Script, its actually behaves opposite of Noscript. We use Noscript to block the scripts and use GreaseMonkey to run the scripts. It allows you to customize the way a web page displays or behaves, by using small bits of JavaScript.
Add to Firefox

6) NoScript

No Script add-ons greatness is beyond imagination. With this tool you can monitor each an every script running on website, you can block any of scripts and see what actually that scripts does on website. But this add-on is for experts, newbies will face problems using this. Note: If you are testing XSS, HTTPS header modifications, Injection attacks on any website you need to disable this plugin because it will not allow you to do so.
Add to Firefox

7) User Agent Switcher

User Agent Switcher add-on; adds a one click user agent switch to the browser. It adds a menu and tool bar button in the browser. Whenever you want to switch the user agent, use the browser button. User Agent add on helps in spoofing the browser while performing some attack.
Add to Firefox

8) SQL Inject Me

SQL Inject Me is another nice Firefox add-on used to find SQL injection vulnerabilities in web applications. This tool does not exploit the vulnerability but display that it exists. SQL injection is one of the most harmful web application vulnerabilities, it can allow attackers to view, modify, edit, add or delete records in a database.The tool sends escape strings through form fields, and tries to search database error messages. If it finds a database error message, it marks the page as vulnerable.
Add to Firefox

9) CryptoFox

CryptoFox is an encryption or decryption tool for Mozilla Firefox. It supports most of the available encryption algorithm. So, you can easily encrypt or decrypt data with supported encryption algorithm. This add-on comes with dictionary attack support, to crack MD5 cracking passwords.
Add to Firefox

10) XSS ME

Cross Site Scripting is the most found web application vulnerability. For detecting XSS vulnerabilities in web applications, this add-on can be a useful tool. XSS-Me is used to find reflected XSS vulnerabilities from a browser. It scans all forms of the page, and then performs an attack on the selected pages with pre-defined XSS payloads. After the scan is complete, it lists all the pages that renders a payload on the page, and may be vulnerable to XSS attack.
Add to Firefox

11) Passive Recon

Last but not the least. Passive recon is a good information gathering tool. PassiveRecon provides information security professionals with the ability to perform "packetless" discovery of target resources utilizing publicly available information. It gathers information like DnsStuff tool available on backtrack.
Add to Firefox

12) Access Me

The first tool on our list is called “Access Me” which examines vulnerabilities in applications. This allows a pentester, ethical hacker etc to access network or computer system resources without being authenticated. In short, Access Me is used to test for Access vulnerabilities.
Add to Firefox

13) JavaScript Deobfuscator

This pentesting addon tells you what JavaScript files are running within an HTML page or other, even if it is obfuscated and generated elsewhere. Simply open the JavaScript Deobfuscator app from the Firefox Tools menu and watch the scripts being compiled or executed. Kinda similar to NoScript. Should add that if this addon is on all the time then all code will render slower so you are best advised to only use it when you need it.
Add to Firefox

14) FoxyProxy

FoxyProxy is an old hat, been around for a while now. There is tons of help on setting this up – just hit up YouTube and take a look. For the complete newbies reading this, FoxyProxy is an advanced proxy management tool that can replace Firefox’s proxying capabilities, (which are pretty limited). There are others out there, such as SwitchProxy, QuickProxy or the infamous TorButton.
Add to Firefox

15) Key Manager

This pentesting tool allows for Key Generation, Certificate Enrolment and Authority Delegation. In summary you can see encryption keys that are generated when you visit secure websites. You can also create your own encryption keys.
Add to Firefox

16) Selenium IDE

Got to be honest about this one, we don’t know too much about it. More detailed info here about Selenium IDE, but what we can tell you is what we read elsewhere, i.e. that this addon “is an integrated development environment for Selenium scripts. It is implemented as a Firefox extension, and allows you to record, edit, and debug tests.”
Add to Firefox

17) CookieSwap

This addon does exactly what its’ name suggests. From a pentesters point of view, being able to change your cookies allows you to identity and understand how sites treat you differently depending on who you are. For example, if a travel site recognizes you as a returning customer they give you a page showing similar flight choices for example. Google uses ‘Personalized Search’, where they modify their search results based on your personal identity. So if you have a Google account then you’ll be treated to a ‘Personalized Search.’ CookieSwap allows you to be anonymous. Quite a nice tool for those interested in SEO since Search Engine Results can differ.
Add to Firefox

18) FoxySpider

FoxySpider is a web crawler! This tool scrapes websites to find what you want. The tool can scan for videos, images, PDF’s etc. FoxySpider displays the located items in a well-structured thumbnail gallery for ease of use.
Add to Firefox

19) OSVDB

This tool hits the Open Source Vulnerability Database Search and gives you known security vulnerabilities. The community is great and stemmed from the Black Hat conferences. This is one of the best addons in our opinion.
Add to Firefox

20) Domain Details

Its’ name says it all – this is a nice and simple addon because it displays the server type, headers, precise IP address and location and whois. 
Add to Firefox

21) Live HTTP Headers

If your interested in headers then also take a look at Tamper Data (a few above this one). Live HTTP headers shows headers of the actual page or application that you are browsing.
Add to Firefox

22) Groundspeed

Groundspeed allows security testers to manipulate the application user interface to eliminate possible limitations and client-side restrictions that interfere with penetration testing.
Add to Firefox

23) Poster

This tool allows you to interact with web services and other web resources by showing HTTP requests, entity body commands, and content type. See also Live HTTP Headers.
Add to Firefox

24) RESTClient

Similar to Live HTTP Headers, RESTClient supports all HTTP methods RFC2616 (HTTP/1.1) and RFC2518 (WebDAV). You can construct custom HTTP requests.
Add to Firefox

25) Wappalyzer

Wappalyzer identifies software on websites. Again, can be used with Open Source Vulnerability Database Search.
Add to Firefox

26) Host Spy

Useful if you want to know if your neighbour is spitting out spam since you can see who is on the same IP as you are.
Add to Firefox

27) Firecookie

Firecookie works alongside Firebug. Rather similar to SwapCookies, this addon creates and deletes existing cookies.
Add to Firefox

28) HttpFox

Got to love this one. If you like Wireshark then this addon is your friend. HttpFox monitors and analyzes all incoming and outgoing HTTP traffic between the browser and the web servers.
Add to Firefox

29) RefControl

You are able to create a list of sites, and the referrer that should be sent for each site. You can select to send that referrer unconditionally or only for third-party requests. Alternatively, you can specify the default behavior for any site not on your generated list.
Add to Firefox

30) XSSed Search

Related to the addon above, this allows for the searching of cross-site scripting vulnerabilities at the XSSed database.
Add to Firefox

31) Firesheep

This addon got a lot of publicity. This addon highlights HTTP session hijacking (when a hacker gets their hands on a user’s cookies). There is a similar tool called Facesniff for Android. As cookies are transmitted over networks, this tool, which is a packet sniffer, can discover identities and allows the pentester to take on the log-in credentials of the user or victim.
Add to Firefox

32) Proxybar

Similar to FoxyProxy. The user can change proxy. 
Add to Firefox

33) Cookie Watcher

This tool probably helps the developer more than the pentester – because it can quickly wipe ‘session’ cookies. The main purpose of this though is to help identify cluster nodes by cookie values.
Add to Firefox

34) WOT

Another highly popular addon. The Web of Trust shows you “trusted sites” – from a pentesters point of view it allows for a snapshot of the credibility of backlinks or otherwise.
Add to Firefox

35) Google Site Indexer

This tool generates site maps based on Google queries which can be useful for both Penetration Testing and Search Engine Optimization. The tool sends zero packets to the host making it anonymous.
Add to Firefox

36) refspoof

Allows for URL Spoofing by pretending to origin from any site by overriding the url referrer in an HTTP request.
Add to Firefox

37) ShowIP

Shows the IP of the current page in the status bar. Also bundles info like hostname, ISP, country and the city.
Add to Firefox

38) Packet Storm search plugin

This allows the ethical hacker or pentester to search the packet storm database for exploits, tools and advisories.
Add to Firefox

39) Offsec Exploit-db Search

Allows for the ability to search the Exploit-db Archive – similar to the Open Source Vulnerability Database Search addon.
Add to Firefox

40) Security Focus Vulnerabilities Search Plugin

Allows for the ability to search the Security Focus – similar to the Open Source Vulnerability Database Search and Exploit-db Archive addons.
Add to Firefox

41) XML Developer Toolbar

This addon allows for XML Developer standard tools from within Firefox.
Add to Firefox

42) CipherFox

CipherFox allows you to view the specific SSL cipher that is being used to encrypt connections to a web site. The addon displays the keysize of the cipher and also allows for RC4 to be disabled.
Add to Firefox

43) FlagFox

Similarto ShowIP this addon displays a country flag for the location of a web server and other useful information.
Add to Firefox

44) ViewStatePeeker

ViewStatePeeker decodes and displays viewstate contents of an *.aspx page
Add to Firefox

45) Server Spy

As the name suggests, this addon tells you the technology of the web server (Apache, Samba, IIS etc) of the client you are working for.
Add to Firefox

46) Default Passwords

This addon searches the CIRT.net default password database.
Add to Firefox

47) Snort IDS Rule Search

This addon works with Snort’s open source network-based intrusion detection system (NIDS) which can perform real-time traffic analysis and packet logging on Internet Protocol (IP) networks. Take a look at HttpFox if you are interested in this.
Add to Firefox

48) Header Spy

Similar to Live HTTP Headers – this addon shows HTTP Headers live on the status bar.
Add to Firefox