HOT TECH TIPS

Facebook reportedly preparing for US election chaos with tools intended for 'at-risk' nations

2020-10-25T19:11:00.000-07:00

Facebook is planning for conceivable chaos around the November third US presidential election with inner tools it's used before in nations like Sri Lanka and Myanmar, The Wall Street Journal reported.

The plans may incorporate easing back the spread of posts as they begin to circulate around the web, modifying the news source algorithm to change what content users see, and changing the standards for what sort of substance is dangerous and warrants evacuation. They're strategies Facebook has previously used in so-called "at-risk" nations managing mass ethnic unrest or political gore.

The tools would just be used in case of election-related viciousness or other serious circumstances, according to the WSJ, however some workers at the company said they were worried that attempting to hinder viral substance could inadvertently conceal legitimate political discussions.

Facebook's handling of rough hate discourse against Rohingya Muslims in Myanmar quite a long while back was broadly reprimanded. After a 2018 free assessment of the situation, the social media giant surrendered it wasn't "doing what's necessary to help keep our platform from being used to instigate division and induce offline viciousness. We concur that we can and ought to accomplish more." It swore to better plan for future risks.

Facebook CEO Mark Zuckerberg said in a September blog post that the US presidential election "is not going to be business as usual." He said he was "worried that with our nation so divided and election results potentially taking days or weeks to be finalized, there could be an increased risk of civil unrest across the country."

Platforms are preparing for pre-and post-election vulnerability in the US, after President Trump has repeatedly scrutinized mail-in voting, which many individuals are using this election cycle due to the coronavirus pandemic. He's also declined to state whether he would acknowledge the election results in the event that he loses.

Facebook said last month that it would not acknowledge new political ads seven days before the US election (however those that had just been endorsed will keep running). It also included a "voter information center" at the top of Facebook and Instagram feeds, and plans to give live, official election results when accessible through an organization with Reuters. Facebook has said it will label any posts pronouncing premature victory, and will eliminate posts with misinformation about COVID-19 and voting. And it plans to ban all US political ads inconclusively after the November third election.

iPhone 8: UK release date, price and best features of Apple's new device

2017-09-12T15:36:00.000-07:00

Apple has launched two new smartphones, the iPhone 8 and iPhone 8 Plus, at a major event in California, which also saw the release of the premium iPhone X handset.

The iPhone 8 and 8 Plus are upgrades to Apple's current iPhone 7 and 7 Plus range, updating some of the main features found on Apple's current products.

Initially, most pundits thought the iPhone 8 would be Apple's main new phone - however it instead released three smartphones as part of the 10th anniversary of the original iPhone.

Apple has launched a new iPhone 8 and iPhone 8 Plus CREDIT: BLOOMBERG

"Our intention has always to create something so magical, powerful, that the hardware virtually disappears," said Tim Cook at the launch.

He added it was a "new step forward for iPhone" that will "set the path for technology for the next decade".

Introducing the iPhone 8, Apple executive Phil Schiller said the device "improves on everything we love about the iPhone".

Here are all the details, specs and, importantly, prices that you need to know.

Design and appearance

Tim Cook introduces the new iPhone 8 and 8 Plus CREDIT: BLOOMBERG

The iPhone 8 and iPhone 8 Plus are similar in appearance to the current iPhone 7 and 7 Plus.

The smaller version has a 4.7-inch screen, while the larger phone has a 5.5-inch screen and a dual camera lens on the back.

The processor is the A11 Bionic, "the most powerful and smartest chip ever in a smartphone," Apple says.

Phil Schiller at the launch CREDIT: BLOOMBERG

There will be glass on the front and the back of the device, "reinforced by a laser welded steel and copper". It will be water and dust resistant sealed.

"The new iPhone will have the most durable glass ever in a smartphone," says Schiller.

Both models will have a HD retina display and feature a 12MP camera.

What colours will it come in?

The iPhone 8 will be available in silver, space grey and a new blush gold colour.

The iPhone 8 comes in three colours CREDIT: GETTY

When will the iPhone 8 and 8 Plus go on sale?

The iPhone 8 will go on sale on September 22. You will be able to pre-order the new device from 15 September. iOS 11 will be available to download from 19 September.

How much will they cost?

The iPhone 8 will cost £699 for the 64GB version, while the iPhone 8 Plus will start from £799 (64GB). 256GB versions will also be available.

iPhone 8 and 8 Plus best features

Wireless charging

The iPhone 8 will feature wireless charging CREDIT: BLOOMBERG

Like the iPhone X, the two new iPhone 8 and 8 Plus phones will come with wireless charging capabilities.

This means the phone can be charged by simply placing it on a power pad. It is the first time the technology has come to the iPhone range.

"This is a simple thing. We do it everyday. We use them every day and charge every night," said Schiller.

"Words can't describe how much nicer it is to never plug in a cable again."

iOS 11

The new iPhones will come with Apple's new operating system iOS 11. iOS 11 includes hundreds of new features like a redesigned control centre, better multitasking, improvements to the camera, peer-to-peer Apple Pay and new safety features.

Dual camera

The iPhone 8 Plus will have a 12MP dual-lens camera, similar to the one featured on the iPhone 7 Plus released last year.

It features a larger and faster sensor, a new colour filter and deeper pixels.

Video

Apple claims the new camera delivers “the highest quality video capture ever in a smartphone” with better video stabilisation and 4K video up to 60fps.

Home button

While the demise of the home button and Touch ID on the iPhone X has been in the news, the iPhone 8 will maintain the button and Touch ID. It won't, however, have facial recognition.

Source: www.telegraph.co.uk

Bash Shell Commands You Really Need to Know

2017-09-06T12:16:00.002-07:00

Just about every geek and nerd that wants to be a hacker always wants to skip straight to the good stuff, and it’s no wonder why. There’s a certain amount of mystery, intrigue, and awe in being able to used advanced tools (such as those found on Kali Linux like Metasploit) to hack into another computing system. Hackers have been around for decades now, and are frequently present in action and thriller films, such as The Matrix. And to be fair, we’ve gone through some detailed guides that show how to use these tools.

For instance, we’ve already covered NMAP, Metasploit, and other similar tools. But there’s one big problem. These tools work almost exclusively at the command line, or in Linux, the BASH shell. And even the highest quality guides are flawed – especially in the hands of a newb. You see, a single article can’t hope to cover every eventuality, caveat, an ‘gotchas.’

Computers are composed of individual parts made all around the world, and assimilated as a hodgepodge of different manufacturers’ parts. The amount and type of memory, wireless card, processor architecture, HDD or SDD, peripheral devices, and more vary greatly from system to system, and Kali (or for that matter, Linux) can’t hope to to run exactly the same on every different piece of hardware.

Even if you’re hacking guide is highly detailed, chances are that you’ll run into a surprising error that doesn’t fit in nicely with your guide’s 12 easy steps. And most guides can’t hope to account for every single error. Doing so would lie far outside the scope of the guide.

As such, it’s imperative that hackers and penetration testers who want to learn how to hack have a solid foundational knowledge of common BASH shell concepts. Look folks, though they may not be the most ‘sexy’ commands, there are some simple commands that you need to know like the back of your hand.

If you get caught on the job not knowing how to run these simple commands, you’re likely going to get laughed out of the office – and perhaps even be handed a pink slip. So, today we’re going to be talking about general purpose BASH commands that you really need to know before moving on to advanced hacking topics. Basically, you need to be comfortable in a command line environment, so let’s start with one of my favorites: network interface configuration commands.

The network interface commands are also exceptionally useful for troubleshooting connectivity problems. Also, note that with few exceptions, the following commands are mostly universal. That is, they can be utilized on almost all varieties of Linux, and some of them can even be used in an OSX environment since Mac OSX is a descendant of BSD.

For reference, we are going to be taking a closer look at how to make shell configurations regarding the following topics:

Network interfaces
Canceling commands
Default gateways and routes
Piping commands
Viewing and killing processes
File system navigation

Many of these topics will be useful to those wishing to test for Linux certifications such as the Comptia Linux+ or LPI certs. To put it bluntly, you should really know these basics before trying to run advanced packet capture and Metasploit demos. So, without further adieu, let’s start with the network interface commands.

Network Interfaces

Whether using an internal wireless card in your laptop, Ethernet, or an external USB wireless interface, you had better darn well know how to configure them. Just about all of the wireless hacking demos we’ve run involve configuring a wireless interface in some way, and you need to know how read their current configuration. So, let’s start with the basics. The following command pulls up current interface configuration data:

ifconfig

Those of you who have worked in the Windows command prompt can easily remember this command, because it only has a single character that varies from the Window’s ipconfig command. Go ahead and run it, and notice that all of the data is separated by interface.

This command is incredibly useful because it will quickly display encapsulation type, MAC address, IP address, broadcast address, subnet mask, transmit and receive packet-count, total information sent over the interface, and other useful information. But it doesn’t show all the available data for that interface. For a more detailed report of interface data, simply run the following command:

ifconfig -a

In the command listed above, the -a parameter indicates ‘all.’ It will show incredibly detailed information that is useful to network engineers, and can help troubleshoot network interface problems. If your terminal window is getting too messy, you can simply enter the clear command to clear things up a bit. Also, you can run ifconfig followed by an interface’s name to only display parameters for that individual interface.

Furthermore, you’re going to need to know how to bring an interface online and offline (or up and down). Often times, after making a configuration change to an individual interface, it’s necessary to ‘bounce’ the interface by bringing it down, and then bringing it up again. You do need to have administrative privilges to run these commands. Also, note that if you’re running a live version of Linux – such as one installed on a bootable USB flash drive like Ubuntu Live – you’ll likely need to precede the commands with the sudo command.

ifconfig [interface_name] down
ifconfig [interface_name] up

So, for instance, if I wanted to reset my Ethernet interface, I would run the ifconfig eth0 downcommand. After waiting for a decent amount of time (30 seconds at least to be safe), I’d then run the ifconfig eth0 up. Note that the interface’s name includes a zero rather than the letter of the alphabet sandwiched between ‘N’ and ‘P.’ Your interface names may differ, too, so just run the ifconfig command to display the interfaces’ names.

And arguably, one of the largest reasons that Linux is so powerful is due to it’s command line. You can make configurations within seconds without having to go through long and contrived GUI windows to find the correct setting. It would be a good idea to know how to change IP address information on a per-interface basis as follows:

ifconfig eth0 10.1.1.2
ifconfig eth0 netmask 255.255.255.0
ifconfig eth0 broadcast 10.1.1.255

In order, these commands will set the IP address, subnet mask, and broadcast address of the specified interface – which is eth0 in this example. Next up, you’ll also want to know how to set an interface in promiscuous mode. This is an undoubtedly crucial tool for most kinds of wireless hacking, so let’s first define what this mode does.

Through various network mediums and address types (such as broadcast frames on wireless interfaces or broadcast data like ARP protocol data), an interface can be presented with frames that weren’t addressed to the receiving interface. The default action of the interface is to drop these packets, since it’s not the intended destination. However, many attacks leverage the information contained within the frames and packets.

By setting the interface in promiscuous mode, the interface will receive and process the frames that weren’t intended for it, and instead send them to the CPU for processing. Use the following command:

ifconfig eth0 promisc

This mode of operation is frequently used in a lot of different network tools, such as protocol analyzers and packet captures. If you want to shut off promiscuous mode on an interface, simply run the following command:

ifconfig eth0 -promisc

Canceling a Command

Sometimes, for whatever reason, you may find that a command has frozen, locked up, or is simply taking too long to complete. Linux novices typically find this incredibly frustrating, and don’t know how to cancel the command. Instead, they simply close out the terminal window and open a new one – but there’s a much simpler way. Simply issue the following command hotkey to cancel currently running command or one that is hanging:

ctrl + c

To test it out, run something like a ping command. For instance, ping Google’s DNS servers with the ping 8.8.8.8 command. You’ll notice that the shell will continue pinging the server on an endless loop. To stop the ping operation, just run the ctrl + c command and it should terminate.

Default Gateway and Routes

Every competent network engineer and penetration tester should have a firm grasp on routing technologies. It’s fairly atypical to setup custom routes for an individual computer, because that function is typically controlled by routers. Nevertheless, you should know how to view your Linux system’s routing table. And the command couldn’t be simpler, as follows:

route

The most practical purpose for this command is to check and verify your default route. In a home setting, the default route is going to almost always be your wireless router. But in corporate and professional network environments, there may be more complex configurations.

Piping Commands

One of the wonderful and powerful qualities of the BASH shell is that one command’s output can be used as input for another command. These features are unbelievably flexible, and allow for command formatting and complex configurations. However, we’re only going to be discussing the most rudimentary of piping techniques today.

You may have noticed that sometimes when entering a command, the entire shell window fills up with loads of text that all flit by in fractions of a second. If you want to read the output page by page, you can simply pipe it to the less command. The pipe symbol is located directly above the enter key on most keyboards, and looks like a solid vertical line. The syntax to pipe command output to lessfollows:

[command] | less

We’re going to be using this in the services and daemons section, but for now test it out on a simple command. For instance, issue the following command:

ifconfig -a | less

Doing so will display your network interface information one page at a time. Now you can use the arrow keys to move up and down the output, or hit the spacebar to move down an entire page. If you want to exit the output display, simply type the ‘q’ key to quit and be returned to the command prompt.

Viewing and Killing Currently Running Processes

There are a seemingly endless number of process running diligently in the background of your Linux system. It would be of great benefit to know how to view them and potentially kill them. Sometimes a process might malfunction, and even cause a memory leak. There are so many processes that, for the sake of this demonstration, we’re going to be piping the command output to less. Run the following command:

ps aux | less

Note that there are actually several ways to view currently running processes, too. Alternatively, you can use the jobs or top commands. They will show you related information, such as the owner, process ID, and other vital information about background processes.

However, once in a while, you may need to shut one of these processes down. It’s rare for a process to render a Linux system completely unusable. Nevertheless, runaway and zombie background processes aren’t uncommon in a Window’s environment. And you should also consider that Linux is susceptible to viruses more than ever before. So, being able to kill a process is crucial. Simply use the following command:

kill [process_id]

For example, if I wanted to kill my Firefox process because it crashed and wasn’t behaving properly, I would issue the command as follows:

kill 17648

It’s just a matter of looking up the process ID before running the kill command.

File System Navigation

Though understanding the entirety of the Linux file system lies far outside the scope of this guide, knowing how to navigate the file system from the command line is one of the most basic and fundamental skills. The first command you need to know relates to knowing which directory you reside in.

In Linux, this is known as your current working directory. And the command to display that information is known as the print working directory command, as follows:

By default, you’re likely in the home directory. To change directories, simply use the following command:

cd [directory]

For instance, if I wanted to change to the root directory (assuming I had root privileges), I would type ‘cd /’. Also, if you simply wanted to move up one level to the next highest directory, you can issue the ‘cd ../’ command. But knowing what files and folders are available for navigation requires you to run the list command. Doing so will show you all files and folders within your current working directory. The basic command is as follows:

This command will simply display common files and folders, but it has several useful parameters to display more information. If you wished to view the read, write, and edit permissions for the current user or group, simply issue a long-listing command as follows:

ls -l

This command will also display when a file was created or last edited, though it won’t display hidden files. If you’re trying to make a configuration change to an application file, it will likely be hidden, so simply run the following command:

ls -a

Note that all of the hidden files and folders will be preceded with the ‘.’ character. There are actually a lot of different flags that can be used with the ls command, but this should suffice for basic file system navigation. Between the ls, cd, and pwd commands, you should be able to navigate throughout your HDD/SDD’s Linux file system by only using the terminal.

Final Thoughts

These don’t make up every foundational command that you should learn in order to be competent using the BASH shell. However, these are certainly some of the most important from a perspective of penetration testing and hacking. In particular, you should learn the ifconfig and route commands, and know them like the back of your hand.

If you’re new to the BASH shell, I’d learn these commands – and learn them well – before pursuing harder tutorials. But after using the shell for a while, perhaps as little as a week or two, they should become second nature to you. And having the ability to pull up all of this information on the fly is what makes Linux so powerful.

You won’t have to navigate through a tedious organization of text fields and GUI windows. Though Windows does have the CMD prompt, it isn’t anywhere near as powerful as the BASH shell. Once you factor in the ability to write and run scripts and use advanced tools like Metasploit, you’ll begin to understand what makes Kali Linux so formidable. Stay tuned for more tutorials as well, because we’ll run through tutorials to help demystify the most popular Kali command line tools that hackers and penetration testers use to break other computing systems.

How to Launch an Untraceable DoS Attack with hping3

2017-08-27T02:57:00.000-07:00

Welcome back everyone, lets talk about DoS attacks and hping3! DoS attacks are some of, if not the, most common attack (DoS stands for Denial of Service). Not to be confused with DDoS, a DoS attack is when a single host attempts to overwhelm a server or another host. This is done by expensing all resources, so that they cannot be used by others.

There is a tool by the name of hping3 that allows the attacker to craft and send custom packets. This allows us to do many things with it including recon, possibly some basic exploitation, but for now we’re going to use it to launch a DoS attack. There are mutliple kinds of DoS attacks, but today we’re going to launching a SYN flood. This sends requests to a server as fast as it can. When these requests are processed, it will take up the server’s resources, and will render it unable to respond to any actual users trying to use it.

The problem with DoS attacks is that when we send all these packets the server, it has our address in it. All the administrator has to do is look at the logs and turn our address into the authorities, then we’re behind bars in a matter of days. We’re not only going to be launching a SYN flood, but we’re going to spoof our address so we don’t get thrown in the big house! Before we launch the attack, let’s deeper discuss the concept of SYN flooding.

SYN Flooding

As we previously stated, a SYN flood is sending an insane amount of requests to a server in order to use up all it’s resources. But you may be asking “What does SYN have to do with using up resources?“. Well, it’s all about the TCP three-way handshake.

If you haven’t already read the second recon article, I suggest you do so in order to understand the TCP three-way handshake. Remember, SYN stands for synchronize. When we send a SYN packet, we’re requesting to establish a connection.

We can see that the attacker sent many SYN packets (with spoofed addresses) to the victim. The victim responded with a SYN-ACK to confirm the connection, but since there was no response, it sends it again and again, using up all it’s resources! Also, since the attacker used a fake address, the administrator will have a much more difficult time tracing the source of the attack.

Now that we know how SYN floods work, let’s get to launching the attack!

Launching the DoS Attack

First things first, we’ll need to look at the help page for hping3. In order to condense the output, I’m going to grep the lines that are essential. Let’s see the flags we need to use:

We can see here that we need to use –flood, –interface, -S, and –rand-source. These flags are fairly self-explanatory, but let’s run through them. Using –flood will set hping3 into flood mode. This is the flood part of our SYN flood. Then we have –interface, so we can decide which network interface to send our packets out of. Finally we have –rand-source, this will randomize the source address of each packet. Not only will source not point back to us, but it will appear to come from a wide range of addresses, this increases the trace difficulty even further.

Now that we know what flags we’re going to use, let’s launch our attack. I’m going to be launching this attack against a VM I’ve set up, Metasploitable 2. First, let’s ping the Metasploitable VM to make sure it’s up and running, then we’ll ping it again when we launch our attack to see the effect. Let’s ping it now:

Alright, our VM is up and running. Now let’s take a look at the command we’ll use to launch our attack before we do it:

Alright, now that we have our command let’s execute it. Now that we’ve started the attack we should see some output like this:

There we go! Now we’re flooding the target. To see our spoofed packets in action, let’s open up one of the best network sniffers out there, wireshark. We should be able to see packets from multiple addresses being flooded towards the same address. Let’s take a look at the packets the wireshark has captured:

Here we can see 5 packets, each with it’s own unique source address! We can see that they are being send to our target at the IP 10.0.0.37, with the SYN flag set. Now that we’re attacking our target, let’s retry pinging the target and see what happens:

We can see by this ping tool output that our pings failed, we can’t reach the server anymore! This proves that our attack was effective in that the server spent all it’s resources responding to our attack instead of the real users, we’ve successfully DoS’d our target!

Since we’ve randomized the source of every packet, it will be much more difficult for an administrator. Now we can launch DoS attack without landing ourselves a seat in prison!

I know this tutorial isn’t really related to any of my currently running series such as the recon series. But due to the recently published article on DoSing with LOIC I felt like this was necessary so if anyone does decide to use this power for evil they won’t land themselves in prison. I’m just looking out for my fellow hackers! The next article will be the start of a brief course teaching the basics of Python, I’ll see you there!

DISCLAIMER: hottechtips.blogspot.com does not condone the use of these tools for illegal activities, we’re just here to educate!

Understanding Google Dorks and How Hackers Use Them

2017-08-27T01:51:00.002-07:00

The idea of using Google as a hacking tool or platform certainly isn’t a novel idea, and hackers have been leveraging this incredibly popular search engine for years. In fact, Google Dorks have their roots in 2002 when a man by the name of Johnny Long started using custom queries to search for elements of certain websites that he could leverage in an attack. At its core, that’s exactly what Google Dorks are – a way to use the search engine to pinpoint websites that have certain flaws, vulnerabilities, and sensitive information that can be taken advantage of. As a side note, some people refer to Google Dorks as Google Hacking (they’re more or less synonymous terms).

Believe it or not, Google Dorks can uncover some incredible information such as email addresses and lists, login credentials, sensitive files, website vulnerabilities, and even financial information (e.g. payment card data). In fact, in our WordPress hacking tutorial, we listed a few Google Dorks that could be used to find SQLi (SQL injection) vulnerabilities. And the wonderful thing is that this is an incredibly passive form of attack that doesn’t draw much attention to the hacker. Unfortunately, some people use these techniques for illicit and nefarious activities such as cyberwarfare, digital terrorism, identity theft, and a whole host of other undesirable activities.

If you are reading this to learn how to break into a website and harm others just for kicks, perhaps you should pursue other interests. Let me caution you by stating that breaking into websites is an illegal activity, and it violates not only laws bur moral codes as well. If you get caught, the consequences could be dire. Then why learn this to begin with, you ask? Well, the first place any white hat hacker needs to start is with understanding how hackers operate. Only then can they plug up security holes to prevent future attacks.

Understanding Google Dorks Operators

Just like in simple math equations, programming code, and other types of algorithms, Google Dorks has several operators that aspiring white hat hackers need to understand. There are far too many to include in this guide, but we will go over some of the most common:

intitle – this allows a hacker to search for pages with specific text in their HTML title. So intitle: “login page” will help a hacker scour the web for login pages.
allintitle – similar to the previous operator, but only returns results for pages that meet all of the keyword criteria.
inurl – allows a hacker to search for pages based on the text contained in the URL (i.e. “login.php”).
allinurl – similar to the previous operator, but only returns matches for URLs that meet all the matching criteria.
filetype – helps a hacker narrow down search results to specific types of files such as PHP, PDF, or TXT file types.
ext – very similar to filetype, but this looks for files based on their file extension.
intext – this operator searches the entire content of a given page for keywords supplied by the hacker.
allintext – similar to the previous operator, but requires a page to match all of the given keywords.
site – limits the scope of a query to a single website.

Custom Crafting Google Dork Queries

Now that we have a basic understanding of some of the operators and how Google Dorks can be used to scour the web, it’s time to look at query syntax. The following is the high level structure of Google Dorks that targets a specific domain:

“inurl: domain/” “additional dorks”

A hacker would simply plug in the desired parameters as follows:

inurl = the URL of a site you want to query
domain = the domain for the site
dorks = the sub-fields and parameters that a hacker wants to scan

If a hacker wishes to search by a field other than the URL, the following can be effectively substituted:

intitle:
inurl:
intext:
define:
site:
phonebook:
maps:
book:
info:
movie:
weather:
related:
link:

These options will help a hacker uncover a lot of information about a site that isn’t readily apparent without a Google Dork. These options also offer ways to scan the web to located hard to find content. The following is an example of a Google Dork:

inurl:login.jsp intitle:login

Making Effective Use of Operators

It may seem a little cryptic at first, so let me provide a few examples that show how the different operators can be used to locate content and website data. A user can make effective use of the intitle operator to locate anything on a website. Perhaps they are scraping email addresses and want to scan sites for the “@” symbol, or maybe they are looking for an index of other files.

Furthermore, the intext operator can basically be used to scan individual pages for any text you want, such as a target’s email address, name, the name of a web page (like a login screen) or other personal information to collect data about them.

The more you practice, the further you’ll be able to hone your queries to pinpoint different types of websites, pages, and vulnerabilities. Again, I need to caution you not to use these queries to attack another website, because that would be illegal and could get you into a lot of trouble. Still, Google Dorks are a great way to locate hidden information on the web, which is why hackers love to use them to find security flaws in websites.

If you want to dig into some more queries, there are some great Google Dork resources on the web.

The Ultimate Guide to Using Maltego as a Powerful Footprinting Tool

2017-08-27T01:45:00.000-07:00

Every pentester and hacker uses tools to make them more efficient at what they do.

That includes when conducting reconnaissance.

So by now you may or may not have heard of a tool called Maltego?

When I first heard about it, I was wondering why it was such a big deal in the IT Security and Pentesting community. If you look at many of the IT Security jobs available online you will eventually come across Maltego as one of those tools companies want you to have experience with.

That goes without saying that you are likely to run across it as a test question when taking many of the security certifications out there as well.

I want to show you how you can use this tool to improve your Footprinting technique. As humans we are very visual creatures. For instance seeing a location on a map is much easier to understand than looking at GPS coordinates. This is exactly what I think is the genius of Maltego.

Think of it like this, we are trying to find treasure on a treasure map but we need to start filling in the map and we need to pick a starting location. Basically you start with one piece of information and use that piece to find the next section of the map, and then use that next section to find another and so on.

Do you remember when the huge insurance firm called Anthem was hacked and 80 million social security numbers were exposed?

Maltego was used by the security firm CrowdStrike to do research, create their own treasure map and find servers that were tied to the Chinese hacker group behind that hack.(See http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/).

Personally, I already had some experience information gathering/Footprinting and knew that I could do all of my reconnaissance without this tool. When I first opened it up I remember thinking that this seems like a really cumbersome way of trying to perform recon.

We will get into why I eventually came to see how powerful this tool really was but first lets just go over some basics on what it is.

Maltego in the simplest form is an information-gathering tool and a tool that will help you perform reconnaissance on your next target. By target I mean people, infrastructure, networks, servers, IP addresses and the list goes on and on. If there is information to find this tool can help you find it.

Maltego is basically a hub for a bunch of different scripts that help you perform different Footprinting actions called transforms. It then puts all that information together in a nice format that makes it easy for you to consume the information.

Maltego actually comes pre-installed on Kali Linux and if you don’t have it already you can install it rather quickly using a Kali Linux Virtual Box Setup (https://www.hackingloops.com/kali-linux-virtualbox-pentest-lab/).

So, enough talk lets take it for a test drive. To start Maltego in Kali Linux simply type “Maltego”.

You will see something that looks like the following graphic, and if you are booting for the first time it could take a couple of minutes:

When it finally boots you can see the setup and basic look of Maltego:

From this setup screen just follow the steps by clicking next, create a login for yourself and then registering. The setup will guide you through all of that rather easily.

Once you’ve logged into the servers using the login you just created, you will see that “Maltego public servers” is checked. Just leave this checked, as these are the servers we want to discover transforms from and click next.

You will then see the following launch page that will finally let us get started. Just leave Run a machine (NEW!!) checked and click finish.

Ok, so now that is done it starts to get really interesting because on the next screen as you can see below, we are actually able to choose the type of reconnaissance we want to do now on our target. We have several options but lets just do a quick overview of some of the more important ones:

Company Stalker

This option basically allows us to select a particular domain, from that it searches for all the email addresses it can find and from there it tries to find all the social media networks it can find.

Footprint L1

This is a basic footprint of a domain in its simplest form.

Footprint L2

Same as above just a little more involved and will take a little longer. We might get a bit more data than the most basic Footprint above.

Footprint L3

Same as the other two above except much more involved. This can take a ton of time to complete but might also net us much more information in the end.

Person – Email Address

You input an email address and it sees what it can find using that out on the web.

URL To Network And Domain Information

You input a URL and you get back network information.

For this next exercise lets just do the basic Footprint of an organization for now. It will be the quickest and let us see how the basic functionality works. Select Footprint L1 and click next.

Lets do a Footprint on the company that created Maltego: www.paterva.com:

From there you just hit run and Maltego will automatically start Footprinting the domain for you. If you have ever done reconnaissance you know how amazing a tool like this is because it takes time to do the proper research on your target and generally speaking when conducting a pentest, the reconnaissance is the part that takes the longest.

Just below our new graph it created, you might notice the Transform Output. This is output of the actual Footprint transform in action and gives us a look at what it is looking for. You might also notice the domain we typed in laid out in an easy to digest graph format. You also might notice if you zoom out of the graph a bit it will reveal some other entities besides the domain you typed in.

Using the most basic Footprint starting with only the domain we were able to find the website, IP Address, Netblock and AS Number. Not a ton of information but much more than we had before and these pieces will help us find other crucial information on the treasure map that is our target.

So now that we know some basic functionality on how this works, lets try and use that to take our Footprinting further. You might have noticed in the graph that there looks to be several computers in a cluster with an IP Range below it. This is a netblock that the domain belongs to. So if we take a second to think about that, we could reasonably assume that there may be other systems on the same netblock that might be relevant to our initial target.

With that information we could simply right click the netblock and run the transform NetblocktoIPs:

That then gets us what we were looking for and we have found other machines within that netblock that might be relevant:

Chances are that some of these machines might belong to www.paterva.com. From there we could then run new transforms on each of these machines to produce an even more detailed map of our target. You can now see how powerful this tool is as you have the ability to keep running these transforms until you find what you need.

To get started from scratch and create a completely new transform you can click the “create a new graph” icon in the top left hand corner. You can then just right click anywhere on the new graph and you will be able to choose a starting point once again:

You can also use the main menu option, which is the large circular button (top left) to create a new graph, open an older one or save the current one as well.

In the above tutorials we used default Footprinting transforms at the most basic levels for network intelligence gathering. There will be many other times where we need to be more specific in narrowing our search to one specific device, location or personal piece of information.

Lets say for this example that all we have is a mail server name and we need to use that as the starting point on our map because at this point it is all we have. We first need to find that particular item to place on our map. One way we can do that is by opening up the Palette menu box. You can get there by going to the Manage tab and then find the Palette options in the Windows section.

We then can drag the MX Record item on to our graph. You will notice below that when you drag it over it uses the default MX Record of mail.paterva.com. We can change that though by double left clicking the item name and typing in the MX Record that we want to use.

From there as we did above we can use this one item to build out this great visual that paints a picture of our target in a way that is most easy for our brains to understand. We can even drag over more items from our Palette if we already have that information. Some examples are an IP Address, MX Record, Netblock, URL, Website, DNS Name, email address, phone number, document or even a location.

Overall Maltego is an amazing tool for research and there is good reason why security firms look for Pentesters to have experience with it. However, I must caution that you can never rely on one tool to do proper reconnaissance. This tool should be one of the many items in your toolset to help you paint a proper picture of your target. Not to mention tools don’t always get it right so make sure you perform your due diligence when conducting your next pentest.

Please feel free to test these different transforms with emails, other domains and learn. However, never perform any active action against any network except with written consent of the owner.

Hashflare Review

2017-08-21T12:55:00.000-07:00

Hashflare.io is an arm of the services delivered by the HashCoins Team of professional cryptocurrency miners.

HashCoins has been in existence since the beginning of the cryptocurrency era in 2013. The team is patronized by over 350000 individuals and companies who have seized the opportunity to multiply their money by investing it wisely.
With hashflare.io, individuals can participate in mining cryptocurrency without doing the work by themselves. This means they can earn cryptocurrencies without purchasing the needed hardware and electricity supply.

Overview of Hashflare.io

Nothing goes wrong when trying to open www.hashflare.io. If you like, you can do this ten times per minute since it is pretty fast with a decent internet access. This makes registration, deposits and withdrawals fast and secure. To ease language barrier and to ensure that their presence is well felt in every region, Hashflare has included not just English Language on its webpage. As a matter of fact, potential investors from Russia, Turkey, Italy, Spain, Portugal, Germany and some more countries can browse the site comfortably by reading the content in their native languages.
On the home page of the site is written the site’s main objective—to mine cryptocurrency. This is followed by what you should expect and the different clouds they offer. With everything being detailed, nobody can say that he or she made a mistake while trying to figure out a good investment plan.

Benefits of Hashflare.io

Free for all

There is no need to ask your friend in Europe to open an account for you on Hashflare since you can do it yourself no matter where you are from. As long as you are an adult and you have some amount to invest, Hashflare.io is just meant for you. There is no restriction to the time limit for investment since they have already declared they are an investment for life opportunity.

VISIT Hashflare.io

The Right Cloud for Everyone

There are different categories of investments on Hashflare to suit everyone’s spending capacity. You can buy one or more units of Scrypt Cloud Mining, SHA-256 Cloud Mining, Ethereum Cloud Mining or Dash Cloud Mining. 1 MH/S of DASH Cloud Mining costs $6 but your contract ends for one year. There is also no maintenance fee for this mining just as in Ethereum Cloud Mining, which also expires in one year.
The minimum hashrate in Ethereum is 100 KH/S and it costs only $2.90. The other two packages have life time contracts but they do require some maintenance fees which can vary depending on prevailing circumstances. Cloud mining on Hashrate.io is like purchasing shares in the stock market. The miners who have donated their money get their share of profits based on the amount they have put into the company.

Hashflare.io Instant Payouts

Hashflare works like a robot. They don’t waste time in paying their share holders at the end of their operations. Investors can collect their funds into their Bitcoin wallets or reinvest it for higher profits.

Conclusion

You can be a member of this company the next minute. All you have to do is to sign up at hashflare.io and send in some bitcoins for any of the four categories I already listed. Your profits start calculating the moment you successfully make a deposit.

VISIT Hashflare.io

Hashflare.io is an arm of the services delivered by the HashCoins Team of professional cryptocurrency miners. Bitcoin Cloud Mining, Hashflare.io Review

A Foolproof Method to Remotely Install a Spy Software

2017-08-21T00:26:00.000-07:00

In many of my previous posts on email hacking, I had suggested the usage of SniperSpy (remote spy software) to hack an email or any other password. To remotely install the SniperSpy on the target computer, all you have to do is just send the remote install file to the target email address as an attachment. Once the target user (victim) runs the file it gets installed automatically.

But there is one small problem…

What if the victim refuses to run the attached file?

This is the common problem that many of my visitors face. To solve this problem, I have come up with a foolproof method to remotely install the Sniperspy (or any other remote spy software) with a very high success rate.

To make the victim run the attached file without any hesitation, here’s a small social engineering trick.

All you have to do is just send the file from an email address that the victim will trust, instead of sending it from your own email account. Here is how it can be done

1. If the target email address is on Yahoo, then you need to create a dummy Yahoo account as follows

While creating a new Yahoo account just select the first name as Yahoo Securityand last name as Team.

Choose an email ID something like notifications09@yahoo.com,alerts009@yahoo.com etc.

Once you sign up, attach the spy software and send it from this fake ID. Since it appears to have come from Yahoo Security Team the victim runs it without any hesitation.

2. If the target email address is on Gmail, follow these steps

Create a new account with Security as first name and Team as last name

Choose an email ID something like alerts009@gmail.com

Complete the sign up process and go to your account

Click on Settings (on the top right corner)

Select the accounts tab, and you’ll see the option Send mail as: Next to this click on edit info

A new popup window will appear. Under the option Name: click on the second radio button and type the name as Gmail Team.

Click on save changes

Now whenever you send an email from this account, it appears to have come fromGmail Team. The victim will trust any emails from Gmail Team and hence will run the attached file without any second thought.

Please follow these instructions carefully

You should not attach the Sniperspy along with your email. You should place only the download link for your SniperSpy file and ask the victim to download it. Here is a step-by-step instructions to do that.

1. Goto www.hotlinkfiles.com and register a free account.

2. After you login to your account, at the top you’ll see an option to “Upload”. Click on it.

3. Now you’ll get a browse option to upload your file.

4. Upload the yahooupdate.zip (or gmailupdate.zip) file to hotlinkfiles.com server. Please note that you should place the snipersy file in a .zip or .rar format and rename it asyahooupdate/gmailupdate before uploading it.

5. Once uploading is completed, you’ll see the option “Direct Link:” under Linking Codes. Click on the option “Just the direct URLs”.

6. Now you’ll see the direct downlink to your yahooupdate.zip/gmailupdate.zip file. Copy it.

7. Place this download link in the body of the email and ask the victim to download the file from this link.

Do not paste the download link as it is. Instead type as “Download Here” and link this text to the download URL.

How to compose the Foolproof email?

Once you create a dummy email account compose a new mail as follows.

NOTE: Text in red color are for your reference only. Do not include that in the actual email body.

Subject: Install the latest security update

————————————- Email Body ——————————————-

Dear Gmail/Yahoo user (or name of the victim)

This is a security alert from Gmail/Yahoo security team. We hereby notify you to install the latest security update (see the download link) as an additional safety for your account. We are pleased to release this latest security update to our subscribers to keep their email accounts safe from unauthorized access. It is highly recommended that you install this update as a part of your Yahoo/Gmail security. To install this security update please follow these instructions

1. Disable your existing antivirus/antispyware (if you have one) before you install this update. This is required to avoid any compatibility issues.

2. Download the update from the following link and unzip the downloaded file.

Download Here

3. Double click on the file to install it. The update gets installed automatically and will not display any window.

4. Now re-enable the antivirus/antispyware software.

Please be advised that we are sending this email only to a list of selected subscribes whose accounts are likely to have vulnerabilities.

thanks,

The Yahoo/Gmail security team

NOTE: This email is sent from an automated system. Hence do not reply to this email.

—————————————– End body ——————————————

Once you send an email to the victim as specified above, the victim will download and install it without any hesitation/suspicion. So what are you waiting for? Go getSniperSpy now!

DISCLAIMER: This Tutorial Is ONLY For Learning Purposes. AnyOne Who Will Use It In A Negative Sense Is Himself Responsible For Any Trouble.

How To Clean Video Game Consoles Hardware And Accessories

2017-08-19T03:15:00.001-07:00

Aside from lag, having to clean your gaming equipment is one of the worst things that can happen to a gamer. Seriously, who cleans their things, anyway? Gaming is for fun, not doing chores. But in those rare occasions when you decide that your console can't really take much more, then you have no choice but to clean it, especially as far as dust is concerned. Dust is the biggest enemy your gaming set-up can possibly have. It can not only make your hardware run worse than it usually does, but it can also damage it beyond repair. And in the light of the holidays and the oncoming Christmas celebrations, when I assume many people get the new generation of consoles as presents, I decided to do a guide on how to properly clean and maintain and clean your console hardware and accessories. This will not only increase the longevity of your console,but it will also ensure that it runs great for as long as possible. It's not going to be pleasant, let me tell you that much, but it's worth doing if you are a true enthusiast and plan utilizing your new (or old console) in the best way possible.

Unplug everything

This is possibly the most important step in the process. You need to unplug everything, otherwise you risk damaging the platform. Not only that, but you can also get hurt so it's a good idea to apply extra caution. After all, you are working with sensitive equipment. Carefully unplug everything that can be plugged and make sure you don't forget anything.

If some of the accessories aren't plugged (like your controllers or headset) and are powered by batteries, instead, remove the batteries. You want to discontinue all power supply to both the console and its components.

Cleaning the exterior

There are several things that you will need here in order to accomplish this fairly simple task. First of all, buying a microfiber towel would yield better results in the cleaning process, even though this part is optional. You can use any lint-free old rag you can get your hands on. You will need two of them – one for the processing and one for the drying out. Also purchase an electronics spray (the kind of spray you can use to clean all sorts of electronics, like laptops, consoles, monitors and more). Spray some of the solution on the cloth and wipe off all the surfaces of your hardware. Dry out with the other cloth immediately so you make sure that everything works well afterwards. Never spray directly on the surface of the console or any of the periphery. This may very well damage the devices so be careful.

Cleaning the interior

Cleaning the interior is a bit trickier. You should open the console because odds are you don't know what you're doing (otherwise why would you be reading this?) so you might damage it. Spraying compressed air into the air vents of your device would be enough to remove a large portion of the dust outside the console. This way you don't need to open it but you will still be able to clean most of it. Something to keep in mind is that compressed air comes out rather cold so you shouldn't be keeping the device too close to the source. Otherwise the air will condensate inside and damage the console.

Cleaning peripheral devices

Use a cotton swab and some rubbing alcohol to clean the peripheral devices such as controllers, microphones, headsets, etc. Just make sure to dry it out immediately. If you're not confident in your abilities to clean the console properly, seek the help of a specialist.

Mobile Hacking Part 1: Introduction and Device Building

2017-08-15T16:44:00.000-07:00

Welcome back everyone! Today we start a brand new series about mobile hacking. This article will be an introduction to the concepts we’ll cover throughout the series, and a tutorial on how to build our own mobile hacking device. So, without further adieu, let’s get started!

Introduction and Overview

Smartphones are everywhere. Most people carry one with them majority of the time. Imagine if we could turn a cell phone into an advanced hacking machine, capable of launching targeted attacks. We’d be immensely powerful in the world of mobile devices. Being able to hack from a mobile devices comes with insanely valuable advantages. Throughout this series we’ll be learning to use these advantages in order to further enhance our hacking abilities.

Now that we have a premise for this material, we need to explain what we’ll be covering in this series. In order to avoid divulging too much information about the upcoming articles (no spoilers!), I’ll give a general overview instead of a specific timeline.

The advantages and disadvantages of mobile hacking
The different options in mobile hacking equipment and setups
- Also including the pros and cons of each set
Mobile specific hacks
- Hacks that can easily/only be performed on a mobile platform
Mobile v.s. Mobile
- Hacking mobile devices with mobile devices
Additional (optional) mobile equipment for specialized attacks

It may not seem like a lot, but trust me, these topics will seriously help us grow and develop as hackers.

Building our First Mobile Hacking Device

Now that we have a basic overview of what we’ll cover throughout this series, we can move on to building our own hacking device! We’ll start by explaining the tech behind the device we’re going to make, and then we’ll get right into it.

It’s time to introduce a company that made the technology we’ll be using today, Pwnie Express. Pwnie Express makes a variety of hacking devices available for purchase. Among these devices is the Pwn Phone. Normally you’d have pay a little over $1000 for a Pwn Phone. But for those with enough ambition, the Pwnie Express maintains the AOPP (Android Open Pwn Project), which allows us to build our very own Pwn Phone! Just a heads up; the AOPP only supports a handful of devices, before continuing, I recommend you make sure your device is supported!

Now that we know where this technology is coming from, we can get building. We’ll be building our Pwn Phone out of a LG Nexus 5, running completely stock ware. So, let’s get started!

Step 1: Download Needed Files

In order to start making our pwn phone, we need to download a handful of files. Since we here at Hacking Loops care about you, I’ve made a simple BASH script to do all the downloading for us. We need to download this script, format it, and make it executable. Let’s do all that now:

Now that we have this download script, all we need to do is execute it and wait. These files are quite big, so you’ll need to have some patience. It will store all the downloaded files in a new directory named project. So, let’s execute this script and wait:

Now that we have these files, we need to do some work with them before we continue.

Step 2: Unpack the Android Command Line Tools

In order to work with our Nexus, we need to use the Android SDK platform tools. In order to use these tools, we need to unzip the Android file we downloaded in the project directory:

Here we use the tar command in order to extract the Android SDK zip archive into a new directory name android-sdk-linux. Inside of this new directory is an install tool that we need to use in order to install the proper platform tools. Let’s move into this directory and use the update tool:

By using these settings with this install tool, we can install just the platform tools, not any of the other software that would be installed by default. Once we execute this command, we will receive a LOT of output. Eventually we’ll be given a prompt asking if we accept, answer yes and we can continue:

Now that we’ve finished the install, a new directory can be found one directory up named platform-tools. We need to add this directory to our PATH so we can use the tools from anywhere, which will make our job way easier:

Now that we’ve added this to our PATH, we need to do some work on our device before we can continue.

Step 3: Enable USB Debugging

Before we can continue, we need to enable USB debugging on our device so we can modify it from our Kali system. In order to enable USB debugging, we first go to ‘Settings’, and scroll all the way down to ‘About phone’:

Inside of this option we see a large amount of information about our device. Near the bottom of the menu, we can see a tab labeled ‘Build Number’:

If we keep tapping the build number option, we will unlock developer options for our device. Once it happens we will be given a notification:

Now that we’ve been given this notification, we can go back to the main settings menu and see a new option:

Developer options allows us more power over our device, including the ability to enable USB debugging. Around the middle of the menu we can find the option to enable it. Once we do, we will see a prompt asking for us to confirm our decision:

There we go. Now that we have USB debugging enabled, we can continue.

Step 3: Unlock the Bootloader and Install TWRP Custom Recovery

In order to install the AOPP, we need to install it through a custom recovery. If we’re going to use a custom recovery, we ought to install one first! We’re going to be install the Team Win Recovery Project (TWRP for short). This will allow us to backup and install software on our device easily.

But, there’s a catch. In order to install TWRP, we need to unlock the bootloader. This is incredibly easy so let’s just get it out of the way. Inside of the compressed file that we setup earlier is a tool named fastboot. This tool allows us to interact with the device while it’s in the fastboot state. In order to access the fastboot menu, power down your device, then hold the power and volume down buttons at the same time until a menu with an open android appears.

Now that we have the fastboot menu open, we need to make sure our Kali system is recognizing the phone. We can tell fastboot to list all the devices current connected. Once we do that we’re going to use fastboot to unlock the bootloader so we can install TWRP. Let’s do these things now:

Now that we have the bootloader unlocked, we can flash the TWRP recovery image to our device. We also use fastboot for this, and the process is rather simple. Let’s flash TWRP now:

Now that we’ve installed a custom recovery, we can continue.

Step 4: Install the AOPP ROM

Now that we can use our custom recovery, we can install the AOPP. In order to boot into our recovery, we need to select the “Recovery” option from our fastboot menu on our device. You can scroll through the options by using the up and down volume buttons, and choose the selected option with the power button.

We should see the boot screen for TWRP, once it loads it should look something like this:

Now that we’re in TWRP, we need to do some wiping. To do this, we need to select the “Wipe” option, and select everything except Internal Storage and then swipe the bar at the bottom of the menu. After a few seconds, the wipe should be successful.

Now that we have wiped our system, we need to move the AOPP file over from our Kali system to our device. We can do this using a tool known as android debugging bridge (adb). We need to stay in recovery mode to use adb, so let’s use adb to see if the device is ready. If it is, we’ll push the zip file from our Kali over to the device:

Now that we’ve pushed the AOPP zip file to the device, we need to go back to the main TWRP menu. From here we select the “Install” option. Once we select this option we should see a space that lists file names. Among these names should be the AOPP that we pushed to the device. Select this file and follow the confirmation prompts to flash it to the device.

Alright, we’re almost done installing AOPP. There’s only one more thing we need to do. We need to push the SuperSU zip file to the device, let’s get that out of the way:

Now that we have all this in place, we should be able to reboot our device. Only one more step to go until have a fully functional pwn phone!

Step 5: Setup the Pwn Phone Environment

This final step is very easy. All we have to do is boot into our new system and follow the setup prompts. Once this is complete, we will be greeted with the pwn phone home screen. But you may notice something, we don’t have any tools yet!

In order to get the tools we need, we need to setup the Pwnix environment. There should be a notification at the top of the screen prompting us for to setup the environment:

Once we select start, we will be prompted by SuperSU asking us if we want to allow the Pwnix setup root access. Once we grant it root permission, the setup will begin. Once the setup is complete, we’ll be prompted to restart to finish the install:

Once we restart we should have quite a few tools ready for use. But if we want to greatly expand the amount of tools on our device, we need to perform an update. We should have an update prompt at the top of the screen in the same place the setup prompt was. Once we perform this update we should have a fully fledged pwn phone!

There we have it! We successfully built our very own pwn phone. This device is incredibly powerful and I intend to prove it. In the next article we’ll be going deeper into the advantages of mobile hacking. I’ll see you there!

What the Deep Web Is, and How to Access It

2017-08-15T16:28:00.001-07:00

I’m sure by now you’ve heard about the Yahoo! breach which is one of the largest breached ever. For many people breaches like this keep us up at night at first but ultimately end there. Well, the story is usually a much longer one because after these types of breaches occur the sensitive information is then bought and sold within the deep web. It is for this reason that any pentester or anyone in IT Security for that matter needs to understand what it is and how it works. One pentesting tactic that is used among professionals is to go look to see if you can discover credentials that are already out on the web due to a previous breach. There have been many so it is definitely in the realm of possibility, and finding these weaknesses is what the organization would be paying you to do.

Whenever someone mentions the dark net or the deep web, most people’s eyes gloss over with mystified curiosity for the Internet’s innermost circles. And the media doesn’t help, because modern films and television dramas do little to paint an accurate picture of the deep web. Instead, entertainment media paints a picture of clandestine meetings between anonymous silhouettes wearing trench coats and fedoras.

All of this mystique, in my opinion, paints an unfair and inaccurate portrayal of what the deep web really is. It’s not just a place for the world’s most shady and secretive users to lurk around on exclusive “invite only” websites. Even though it may sound like I’m contradicting myself, to be completely honest, there are undoubtedly more than a few of those types of sketchy websites in what most people consider to be the deep web.

While there are plenty of seedy destinations, riff-raff, and unsavory users occupying some portion of the deep web, the vast majority of it isn’t necessarily sketchy or dangerous. But before we dig into what types of content lurk in the deep web, let’s first talk about it’s size.

Search Engines and the Global Internet as a Whole

What exactly is the Internet? Is it Facebook, Google, and your favorite streaming media sites? There are a variety of definitions, but for our discussion of the deep web, I want you to understand one key point. Technically, any device – be it a router, switch, firewall, smartphone, tablet, refrigerator, or automobile – becomes part of the global network when it gains an Internet connection.

Like it or not, there are a variety of paths between any two endpoints, meaning that in some contexts, the computer you’re using right now could technically be classified as a component of the Internet. However, there are a lot of security tools to separate devices, groups of devices, and entire countries into their own isolated networks. The fact remains that you can’t personally connect to the overwhelming majority of devices connected to the public Internet (such as private corporate networks, your neighbors Wi-Fi router, etc.).

When most people talk about the Internet in common speech, they are merely talking about a couple of different protocols out of many hundreds (or perhaps thousands), namely HTTP and HTTPS. For instance, there are other protocols used every single day, such as File Transfer Protocol, Voice over IP, and Secure Shell, among many others. With that understanding, then wouldn’t the entire Internet consist of HTTP and HTTPS web pages? And doesn’t Google, not to mention other search engines, already index all of those pages so we have a means of sifting through all of the web servers to find the information we want?

Well, not exactly. If you go and run a Google query right now, it’ll spit back millions of results in a fraction of a second. And while that may look like it’s every imaginable web page on the Internet that’s related to your search terms, there’s a lot you don’t see. The fact remains that search engines can only index a very small fraction of the entire Internet that is hosted on web servers.

Why Can’t Google Index the Entire Internet?

Despite what most people think, Google does not have supreme authority on the Internet. In fact, it’s completely optional whether or not you want Google to index your site. But how does Google index sites in the first place? The answer is critical to understanding a vast portion of the deep web. You see, Google uses mechanisms called crawlers to hunt around on the Internet and find web pages.

After a crawler has crawled a page and read the content, it feeds the data through a special proprietary Google algorithm that uses a lot of composite metrics to rank the web page, and perhaps place that page on the first page of the search engine results. But how do the crawlers know where to crawl? Well, they don’t call it the World Wide Web for nothing. The vast majority of web pages and domains are intermingled and linked to each other many times over.

If a crawler is crawling a page and notices outbound links, it then follows those outbound links and starts crawling the new pages. If those new pages contain links, the crawler continues to crawl the current page, and crawls the pages of the second set of outbound links as well, and so on, and so on. It’s a very recursive process, and the crawlers work by building a sort of link road-map of the Internet.

But the crawlers don’t have an all-access pass to every page on the Internet. There are many roadblocks in their way that can prevent them from crawling a website. For instance, a web server hosted on a private network may not allow the crawlers private access. Also, consider gated content. What about content sites that require a user to enter login credentials before accessing information? With few exceptions, crawlers are blocked by sites requiring login credentials.

Furthermore, a lot of data hosted on the Internet is used to create dynamically generated web pages. The crawlers simply can’t comb through the secure back-end databases to index the content. Finally, we are starting to touch on the vast majority of content that is genuinely part of the deep web. But also consider that a website administrator can opt out of Google indexing (in fact, you can opt out of it with your Facebook page as well in the Facebook security settings).

Types of Content on the Deep Web

With so much of the Internet left untapped by the search engines, you are probably wondering what types of content actually exist in the deep web. Naturally, there are some truly disgusting websites hosted by people engaged in nefarious and despicable activities. For instance, there’s more than a fair share of stomach-wrenchingly nasty and disgusting porn sites.

Some people have used the deep web to operate sex trafficking circles, and even child pornography. In addition, there’s quite a few sites that are engaged in the trafficking of drugs and illegal contraband, such as weapons. I don’t recommend that you go hunting around on the deep web for these types of websites out of idle curiosity.

Even the act of just visiting one of these sites would look incredibly suspicious should the authorities become aware of your browsing habits. In the modern digital-driven era, you never know who else may be watching your online activities – even with precautions like Tor, VPN tunnels, and anonymity services. Don’t believe me? Well, consider that the Tor network has been infiltrated by the FBI on multiple occasions in the past.

However, I don’t want to pain an inaccurate picture of the deep web. The fact remains that the aforementioned types of unsavory web destinations only account for a small fraction of all the data that could be classified as the deep web. Other types of data that reside on the deep web include, but are not limited to, the following:

Dynamically generated content – dynamic web pages that are based on back-end databases are becoming increasingly common, and that data isn’t typically indexed by search engines.
Limited content – it’s a common practice for some websites to limit access to their websites. A few examples include web servers hosted on a corporate intranet, websites that are gated with login credentials, websites that require user verification via a CAPTCHA security plugin, and other similar types of limitations.
Oddball file formats – not all of the web is written in text. There are a lot of strange file formats that can’t always be indexed by search engines, such as non-HTML based content, voice, podcasts, video, multimedia content, and others.
Private networks – a lot of the Internet is private, such as any home or business network residing behind a firewall.
Content protected by software and digital services – some content simply isn’t accessible unless you have access to the right software. For instance, some web pages and domains aren’t accessible unless you are using I2P or Tor. These types of websites are what most people commonly think of as being the entire deep web.
Disavowed content – some content on the Internet disavows incoming links, or simply isn’t linked to. Furthermore, the website administrator may use software tools to prevent crawlers from linking to the page, as well as break incoming links with redirects.
Archived data – some tools allow people to make historical catalogues of web pages to track changes over time. However, over time, some of the older versions of those web pages may become inaccessible.

How to Access the Deep Web

I know that the deep web sounds like an interesting and curious place, but there’s not that much to it. The easiest way to access what you would think of as the deep web would be to download Tor. You see, Tor is an anonymity network that makes it (virtually) impossible to track users’ online browsing habits. There are a few exceptions, but for the most part, the Tor network is well adept at hiding your identity.

Before we dig into the dirty details of accessing hidden services, I need to first caution you with a warning: proceed at your own risk. There are a lot of dangerous and malicious websites on the deep web, and if you get a virus or end up on governmental watch list for accessing the wrong content, that burden rests squarely on your shoulders.

That said, you want to go ahead and download Tor, and then access hidden services. But how do you know about a website if no one tells you it exists, and you can’t find it in a search engine? I know it seems like a bit of a “chicken and the egg” scenario, but there are a few places you can go to find directories of hidden services.

The following are a few sources for links to the deep web:

Because a lot of these websites aren’t indexed by search engines, they are instead spread by word of mouth. There’s no telling what websites are lurking out there on the deep web, and some may only have user bases of tens or a few hundred people. Some of them are invite only, though these three aforementioned places are a good place to start.

Just glancing at the list, you can begin to get an idea of the types of websites occupying the deep web. There’s more than a few of them I have no desire to visit, such as those that deal with illegal arms trading.

Some of them seem to be pretty black market in nature, and could very well be a scam – such as the fake ID and passport websites. Some of them are simply nefarious online marketplaces, like the infamous silk road, which is a type of Alibaba or Amazon digital vending service that offers a lot of contraband. However, as far as informational content is concerned, there are a lot of hidden blogs as well.

Final Thoughts

The amount of the Internet the average user can see is analogous to an iceberg, whereby you can only see the tiny bit poking above the water’s surface. But deep down below, there’s more than meets the eye. I know that some people are curious by nature, and that you may be one of them.

However, I’d highly caution you against taking a stroll down the back alleys of the Internet. You don’t know what you’re going to find, and it might be pretty ugly. Unless you are specifically trying to access content that you already know about, I wouldn’t spend too much on the deep web.

Windows 10 Privilege Escalation using Fodhelper

2017-08-13T02:24:00.003-07:00

Hello aspiring hackers. Today we will see an exploit which helps us in Windows 10 Privilege escalation. Till now, there was no exploit for privilege escalation in Windows 10. Recently we got one. This module will bypass Windows 10 UAC by hijacking a special key in the Registry under the current user hive and inserting a custom command that will get invoked when the Windows fodhelper.exe application is launched.

Once the UAC flag is turned off, this module will spawn a second shell with system privileges. This module modifies a registry key, but cleans up the key once the payload has been invoked. The module does not require the architecture of the payload to match the OS.

To use the fodhelper module to escalate privileges, we need to background the current session.

Search for fodhelper module using the search command.

Load the module and set the session ID as shown below.

Run the module as shown below.

As you can see, we successfully got a meterpreter session. When I check privileges, its still user privileges but when I run “getsystem” command, I get system privileges on Windows 10.

Happy HAcking.

HOW TO STAY SAFE:

Microsoft had already released patches. Just make sure your system is updated.

Kali Linux Virtualbox Pentest Lab

2017-08-13T02:19:00.000-07:00

The cornerstone to learning how to penetration test and hack is to have your own lab set up. In this scenario we will set up our own Kali Linux Virtualbox lab. If you are serious about learning then it is the very first thing you should do. The reason being is that once you get your lab set up you will be able to start running sample tests to see how they work. Every pentester has one, and reading about how to conduct penetration tests won’t get you anywhere; you will actually need to get your hands dirty.

Initially we are going to quickly put together the most rudimentary network that you can use to learn and sharpen your skills. Simplicity is key. Eventually you can add new machines to attack after we initially get set up together. The idea here is that we don’t want to become overwhelmed, so starting small and expanding is the way to go.

For now we are going to start with three machines: Kali Linux (which will be our attacking platform), Metasploitable 2 and OWASP WebGoat. We want to create a network where we have one platform for penetration testing, one platform that was built to be vulnerable and one web application that was built to be vulnerable.

Kali Linux if you don’t know is the gold standard open source penetration testing operating system created by Offensive Security. Operating systems don’t make the penetration tester, but if you are serious, Kali Linux was developed solely for this purpose and will make your life a whole lot easier. Many of the tools are built right into it.

Metasploitable 2 is a vulnerable Ubuntu Linux operating system created by the Rapid7 Metasploit Team that was designed for training purposes just like this. This will make it much easier for us to find vulnerabilities in the target machine and will allow us to get some good experience in penetration testing. We will also be much less frustrated at the beginning because we weren’t able to find any issues right away.

WebGoat is a project created by OWASP and is in the same vein as Metasploitable 2. The difference is that it allows us to test our skills out on a web application instead of an operating system. It is an amazing application because there are lessons within it and it allows you to run the tests right in the application as well. This will allow us to broaden our skills and be more ready to meet the demands of the increasing need of pentesters that can work on web apps.

After we are done our virtual network will look something like this (note that this is just an example as everyone’s network is unique):

As you can see this is very simple but is all we need for right now. As stated earlier, as our skills improve so will our network.

This tutorial is going to focus on setting up this virtual lab using VirtualBox because it is free and anyone can set it up this way. There are also many other tutorials you should be able to find with a quick Google search on how to install virtual machines on any operating system or virtual setup that you might be using.

The first thing we need to do here is download VirtualBox. You can pick this Oracle product up here: https://www.virtualbox.org/wiki/Downloads

After you have installed VirtualBox we need to create a DHCP server and network within VirtualBox that we will use later.

Browse to where you have virtual box installed at the command line and type: vboxmanage dhcpserver add –netname mydhcpnetwork –ip 10.10.10.1 –netmask 255.255.255.0 –lowerip 10.10.10.2 –upperip 10.10.10.10 –enable

(Note: If you are on windows you have to append the extension “vboxmanage.exe”)

This gives us a DHCP server and 9 other IPs to play with. However, you can increase the number to whatever you like.

Now that you have VirtualBox installed we need to install our platforms (Kali Linux, Metasploitable, OWASP WebGoat).

Kali Linux

You can get your Kali Linux virtual machine from https://www.kali.org/downloads/ I suggest torrenting the download over the direct download as it is faster and I’ve had instances where the direct download was corrupted. If you’ve never torrented just go with the direct download and hope it works. When this finishes make sure that the Sha1sum matches what you see on the Kali Linux webpage. You can check this by:

Microsoft’s tool: http://www.microsoft.com/en-us/download/details.aspx?id=11533

For Mac simply type in the terminal: openssl sha1 <path to file>

Linux: sha1sum <filename>

Going forward you should always check for SHA or MD5 hashes and compare those to what they should be, as this is a prudent step to prevent malware on your computer.

The first thing we will want to do after verifying our hash is to install Kali Linux on VirtualBox. Click on New.

You can make the name of it anything you want, but will need to select Linux as the “Type”. The version you choose will either be Debian (32 bit) or Debian (64 bit) depending on what version of the Kali Linux OS you downloaded. For this example I downloaded the 32-bit version.

Set your memory size. While 512 is the default and you may get away with this, it is possible that you’ll get into some trouble later running certain applications so I suggest you increase it to something higher. Nothing is worse than being right in the middle of something and your Linux platform freezes. However, the beauty of VirtualBox is that you can go back into the settings and simply readjust this at any time.

We will be creating a virtual hard drive so select that and click Create.

For this example we will be using the VirtualBox Disk Image.

We want a Dynamically allocated hard drive for this example.

For the size you probably want to increase it to at least 15GB. I’ve had issues with the installation when going with the standard size of 8GB.

Now that we have created our new Kali Linux virtual machine we need to configure it, so select settings and then Storage.

We now need to add the ISO that we previously downloaded. We do that by highlighting the area you see selected below. At first this should say “Empty”. After “Empty” is highlighted you then need to click the CD where you see the arrow below and browse/select where you have your ISO located.

For Adapter 1 we will be using the DHCP server and network that we created earlier for our internal VirtualBox network.

We also need our Kali Linux platform to reach the Internet, so for that we will be using Adapter 2. Attach it to NAT and then hit OK.

Highlight and now start your new virtual machine.

You could actually use Live below and boot right into the system, but I suggest that you actually install Kali Linux on to the virtual machine. Choose the Install or Graphical Install below and follow the steps.

Depending on how you are installing your system and what version of the install you are using, you may encounter the following error when starting up the install:

If you get this error go back to settings, System, Processor and select “Enable PAE/NX”.

During the setup you will be asked to configure the network as well. Because we created two adapters you will see something like eth0 and eth1 below. What you will need to do here is select the interface that allows you out to the Internet. In my case this is the NAT interface we created earlier and is eth1.

After logging into your fresh Kali Linux install the first thing you will want to do is verify that you can reach the internet by opening up your web browser. If you cannot browse the web you need to enable DHCP from your command prompt with: dhclient -v

Now that everything has been set up properly we need to update Kali Linux so that we KNOW that we have the most recent distribution and tools. You can do that with the following at the command prompt: apt-get update && apt-get upgrade

Metasploitable:

Installing your vulnerable Metasploitable 2 operating system is very similar to how you installed Kali, just with fewer steps.

To start you will need to download the files from here: https://information.rapid7.com/metasploitable-download.html

Again, create a new virtual machine:

Again, set your memory size.

This is slightly different than the Kali Linux setup because we will be using an existing virtual hard drive as you can see below. Just select where you see the arrow and then browse to where you saved the highlighted file.

Like we did for the Kali Linux setup we will need to click on settings once again. We need to make a modification in the network section as we did for our Kali Linux platform.

Start your new Metasploitable 2 virtual machine.

The Default username and password after you run your machine will be:

Username: msfadmin
Password: msfadmin

OWASP WebGoat

To get the latest version of WebGoat just go to https://github.com/WebGoat/WebGoat-Legacy/releases and download the latest release at the bottom of the page.

To get started on this you will have to have the Java Platform installed on your computer first if you don’t already. You can get that here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

You also need Apache Tomcat for this as well. You can find a stable release here: http://tomcat.apache.org/whichversion.html

Copy the latest version of WebGoat to your working directory and in your terminal type: java -jar WebGoat-6.0.1-war.exec.jar
(note that depending on which version of WebGoat you get at the time of reading this it could be slightly different)

To get to the login screen browse to http://localhost:8080/WebGoat with your web browser. On the login screen you will see both the guest login and admin login and password. After you log in you will be able to see all of the lesson plans:

If you installed all three of these platforms then you have plenty to get you started on your journey of learning how to hack in to the information security and pentesting space.

This network is now the perfect venue for a student like yourself to test out their skills and techniques without the fear of permanently damaging or destroying your own network/systems, or someone else’s for that matter.

I’ve provided some bonus content that will help you customize this pentest lab to start the DHCP server every time, creat a share drive to share files between the lab and your computer, enabling sound, securing your kali linux virtualbox machine and few other things.

Click Here to Download

Using Amap on Kali Linux

2017-08-13T02:15:00.002-07:00

There are a lot of different scanning tools on Kali Linux, though they each seem to provide a slightly different function. For instance, NMAP is a great tool for feeling out a local network to identify hosts, open ports, and a few other pieces of key information. On the other hand, Cisco-Torch was created with an emphasis on discovering Cisco devices and network devices, and then to run dictionary attacks on the identified targets.

Today, however, we’re going to be looking at a different scanning tool called Amap. Amap is a next-generation scanning tool that has a massive amount of flags and options in its command syntax, and it can even identify processes and applications when they are running on different ports. For example, if a company decided to host an internal web server that accepted connections on port 1253 instead of 80 (I’m just making that up as an example, no one would ever do that), Amap would be able to discover it.

Furthermore, Amap can find applications and services that aren’t based on ASCII. Amap has a lot of interesting tools, too, such as the ability to send specially crafted trigger packets to generate special responses from servers.

Amap’s Tools and Capabilities

Amap is more than a simple scanner designed to ping a local network to identify active hosts. More specifically, we need to identify two main components and features of the Amap program. First off, Amap comes with a module called amapcrap, which sends random and bogus data to a port.

The port can be TCP, UDP, or even SSL, but the idea is to generate a response from the target port.

The second component is the actual Amap core functionality, which is an Application MAPper.

A Tip for Those of You Who Are Curious

If you’re a Linux newbie, you probably don’t know what verbose mode is. If you’re a Linux veteran, feel free to skip this section to avoid any inherent eye-rolling. Nevertheless, verbose mode is a common option for the vast majority of command line programs and tools.

Verbose mode basically allows you to peek under the hood to understand the inner workings of a command. Typically, after entering a command, you’ll wait for a few moments while it ‘does its thing’ in the background, and it will either return a message indicating success or failure. But with verbose mode, the tool will tell you what it’s doing step-by-step.

I’d highly recommend using the -v option with scanners just so you can see how they operate. For instance, you’ll find that NMAP host discovery scans simply have a looping function, whereby they ping one address after the next and increment the host value by one with each iteration.

Amap Command Syntax and Options

Amap seems to be a rather complicated tool when you view its help screen for the first time, but it isn’t as intimidating as it looks. However, I will say that it has a lot more options and flags than most other commands, though you won’t necessarily use them all.

First off, let’s take a look at the amapcrap options and syntax as follows:

Syntax: amapcrap [-S] [-u] [-m 0ab] [-M min,max] [-n connects] [-N delay] [-w delay] [-e] [-v] TARGET PORT

Options:
-S use SSL after TCP connect (not usable with -u)
-u use UDP protocol (default: TCP) (not usable with -c)
-n connects maximum number of connects (default: unlimited)
-N delay delay between connects in ms (default: 0)
-w delay delay before closing the port (default: 250)
-e do NOT stop when a response was made by the server
-v verbose mode
-m 0ab send as random crap:0-nullbytes, a-letters+spaces, b-binary
-M min,max minimum and maximum length of random crap
TARGET PORT target (ip or dns) and port to send random crap

/*This tool sends random data to a silent port to illicit a response, which can
then be used within amap for future detection. It outputs proper amap
appdefs definitions. Note: by default all modes are activated (0:10%, a:40%,
b:50%). Mode ‘a’ always sends one line with letters and spaces which end with
\r\n. Visit our homepage at http://gwww.thc.or */

Next, let’s take a look at the options and flags for the actual Amap portion of the tool. Be forewarned, there are more options for this tool than most other applications:

Syntax: amap [-A|-B|-P|-W] [-1buSRHUdqv] [[-m] -o ] [-D ] [-t/-T sec] [-c cons] [-C retries] [-p proto] [-i ] [target port [port] …]
Modes:
-A Map applications: send triggers and analyse responses (default)
-B Just grab banners, do not send triggers
-P No banner or application stuff – be a (full connect) port scanner
Options:
-1 Only send triggers to a port until 1st identification. Speeeeed!
-6 Use IPv6 instead of IPv4
-b Print ascii banner of responses
-i FILE Nmap machine readable outputfile to read ports from
-u Ports specified on commandline are UDP (default is TCP)
-R Do NOT identify RPC service
-H Do NOT send application triggers marked as potentially harmful
-U Do NOT dump unrecognised responses (better for scripting)
-d Dump all responses
-v Verbose mode, use twice (or more!) for debug (not recommended :-)
-q Do not report closed ports, and do not print them as unidentified
-o FILE [-m] Write output to file FILE, -m creates machine readable output
-c CONS Amount of parallel connections to make (default 32, max 256)
-C RETRIES Number of reconnects on connect timeouts (see -T) (default 3)
-T SEC Connect timeout on connection attempts in seconds (default 5)
-t SEC Response wait timeout in seconds (default 5)
-p PROTO Only send triggers for this protocol (e.g. ftp)
TARGET PORT The target address and port(s) to scan (additional to -i)
amap is a tool to identify application protocols on target ports.
Note: this version was NOT compiled with SSL support!
Usage hint: Options “-bqv” are recommended, add “-1” for fast/rush checks.

Usage Example

The command syntax looks pretty hairy, but it isn’t after you’ve played around with the tool for only a couple hours. We’re going to go through a short demonstration to highlight applicable command syntax, but first please heed a warning. If you want to test out this tool, only do it on your home network or on devices that you own.

Don’t run around in public or connect to a Wi-Fi hotspot to start scanning other people’s computing devices. It’s illegal and immoral. That said, let’s take a look at an example that scans a single host that is presumed to be a web server:

amap -bqv 10.1.1.54 80

This command will scan the 10.1.1.54 host on port 80 (HTTP), and will print ASCII banner response, omit closed ports, and print the process in verbose mode.

Final Thoughts

There are a myriad of other options that can be used with Amap, and I encourage you to test it out. However, for simple host discovery and scanning for open ports, I still prefer to use NMAP. It’s just easier to use in my opinion, or perhaps it’s simply because I feel more comfortable using it. At any rate, Amap is another great scanner that can be used to identify hosts and fingerprint systems.

How to Restrict Virus or Trojan Attacks

2017-08-12T14:59:00.001-07:00

Most of you are already aware of basic ways to protect your system from becoming infected. For the knowledge of new users,we will try to cover almost all techniques through which viruses infect your system and then methods to protect your system against these attacks.

Prevent PC or Laptops from Viruses or Trojans

If you want to know if your system is infected by either viruses and trojans then there are certain techniques, symptoms, and guidelines which will help you identify the problems. Similar to the human body being infected with a virus, a computer will also demonstrate symptoms to tell you that something is wrong. Here are some symptoms of a computer virus:

1. Your computer might be running slower than normal (decreased efficiency means slow processing, sometimes system lags, etc.).

2. Some programs might open without your permission.

3. System start up takes too much time to boot.

4. Various error messages appear on the screen when you open something.

5. System registry or task manager has been disabled or folder options is missing.

6. The most important: antivirus shows messages of detecting viruses, or in some cases unable to update antivirus, or sometimes not even able to install any new antivirus or security software.

7. While scanning your system with antivirus or anti spyware tool, it shows viruses but they’re not deleting.

Have you ever tried to understand how your system gets infected? What has infected your system? Is it because of your friend? A USB? Or maybe your online activity somehow resulted in infection of your PC or laptop? Today I will share each and every thing that can infect your system and how you can fix your PC or laptop if it’s already infected.

Did a system got infected because of your negligence or lack of awareness?

1. Using Cracked Versions of software, especially security ones like antivirus and anti-spyware

This is the primary cause of infection on a device. Hackers know that users often look for cracked versions, and are willing to exploit that. If we attach a trojan or a virus, and you receive an alert but you ignore, then you have not gotten rid of the trojan.

NOTE: If your antivirus doesn’t show any keygen or crack as a virus DON’T ASSUME THAT IT’S NOT A VIRUS. Most likely it’s a more advanced virus and you have been infiltrated. Please do not use cracked software.

2. Pen drive or USB drive :

The next biggest cause of infection to your system is USB and external hard disks.

Now how a virus enters into your system using USB drives. You have connected your USB drive to your friend’s computer and by chance your friend’s system is infected by a virus or Trojan, one with the property to replicate itself using memory. You take your USB back, plug it into your computer, and now your system is infected as well. If you are using good antivirus software, your antivirus will send you warning and alert messages – don’t ignore those.

3. Downloading things from unknown sites:

Users frequently search for files over the internet to download. Hackers know that certain icons have huge followings, and often they will bind malicious codes to files so that when users download wallpapers or other files to their system, the virus comes with it.

Now after discussing these things, you know your system was infected through negligence. It’s time for you to learn how to protect and defend your system from viruses and trojans.

HOW TO STOP VIRUS OR TROJANS

1. Using A Good Antivirus:

There is a common misconception that the best anti-virus softwares require payment. This is one of the reasons that people go for cracked software. Here is one of the best free anti-virus softwares I have ever found.

Best Free Antivirus : Avira Personal Antivirus i.e Antivir. Avira is still the best free antivirus available on the internet because of its expert configuration ability.

You can download avira for free from:

http://www.filehippo.com/download_antivir/

After downloading the antivirus, you need to make it as good as a paid antivirus.

a. Install the antivirus and update it. Note updating antiviruses regularly is compulsory. Don’t worry, it will update itself automatically whenever an update is available.

b. After installation, at the top right-hand corner you will see a “CONFIGURATION” button. Just click on it and a new window will pop up.

c. At the top left-hand corner you will see a click box. Click on that. Now you will see several things in it.

1. Click on “Scanner.” Click on all files and set the “Scanner Priority” to high and click apply.

2. Click on “Guard” and click on all files and click on “Scan while reading and writing” and then click apply.

3. Click on “General” and click on select all and then apply. In “General,” tab to the WMI section and click on advanced process protection and then click apply.

4. After doing that, restart your PC.

Now you have made your free antivirus equivalent to a paid one.

Best Free Anti-Spyware: Spyware Terminator with crawler web security toolbar.

Download it for free :

http://www.filehippo.com/download_spyware_terminator/

Install spyware terminator with web security tool bar. Now the following problems are solved:

1. No Trojan can attack you.

2. Protection from malicious websites.

2. Solution for cracked versions of software:

As I mentioned earlier, never download cracks and keygens directly to your system. Several other methods are available. First, try to search for a Serial Key. If you didn’t find one then follow the next steps.

Before downloading any Crack and Keygen, go to the Website:

;

Now copy the download link of the Keygen or crack in the URL box provided on the website. This website contains all the world famous antiviruses and will scan files for you.

3. Pen drive or USB drive solution:

For windows 7, read my last article:

For windows XP, follow these steps:

How you can protect your system from being infected from the pen drive. Do the following three things, the rest is being cared for by your antivirus.

1. Turn off Auto Play Devices:

To do it, go to Start Menu–> RUN–>type gpedit.msc and press enter–>User Configuration–>Administrative templates–>System–>Turn off Autoplay–> click on enable and then select all drives.

2. Turn off Computer Browser service:

To do it go to Start Menu–> RUN–>type services.msc and press enter–>then Find Computer Browser service, disable it and then restart your system.

3. Most importantly, always scan pen drives or external hard drives after connecting them.

The best alternative is to use Linux, as there is no autorun or autoplay concept in Linux operating system.

4.Downloading Stuff from Unknown Sites Solution:

The solution of this problem is already provided. The web browser security toolbar will help you while surf only secured and genuine websites.

For Hackers

1. Use Deep Freeze on C drive: Always use deep freeze for testing hack tools. After the next restart, your system will be in same position it was previously, so this is a safe place to test tools.

2. Install Virtual Box, and over virtual box install another windows and test all hack tools using virtual windows. This will protect your system from being infected. It will also give you more knowledge about handling the viruses and other situations.

3. Use Sandbox browser to test run the downloaded files.

4. Create two to three fake email IDs and use them for testing Keyloggers and other fake email hacking software.

HASHFLARE Cloud Mining

2017-08-12T04:33:00.000-07:00

HashFlare is a new range of cloud mining services brought to you by the HashCoins team of cryptomining experts. Let me talk of Hashcoin Team first; This team consists of top specialists; among them are engineers, programmers, designers, editors, etc, with many years of experience in various global projects, their passion for cryptotechnologies is unparalleled.

Their team has been involved with cryptocurrencies since the inception of Bitcoin and has over 3 years of experience in the field of mining cryptocurrencies.

Hashflare goal is to make mining accessible to all users regardless of age, location, investment, technical know how or experience. They give their customers an opportunity to try out cryptocurrency mining and earn Bitcoin as a reward. This has really won them a name in the crypto-currency industry because their business model and engagement has attracted so many people into the cryptocoin world. This is a great contribution to the development crypto-mining. Hashflare is one of the most secure, trusted and lasting cloud mining company around. Transparency is their norm.

More Info

• Clear Dashboard
• Extremely Low Maintenance Fees that is fixed
• Selectable Mining Pool that you prefer
• Consistent Payment and instant withdrawal whenever you want: Minimum Bitcoin withdrawal amount is 0.0004 BTC (incl. commission fees). Withdrawals for ETHASH contracts are available in Ethereum only. Minimum Ethereum withdrawal amount is 0.0007 ETH (incl. commission fees).
• Good Roi: 240% Per Year
• Instant Connection
• Unlimited Term Contract
• Detailed Statistics: Real-Time Mining Monitoring

Types Of Contracts

Why Work With Hashflare?

As a miner on the Hashflare plartform, you are given the opportunity to earn a passive income with the company when you become a partner.

https://hashflare.io/r/B21ED842

Using Cisco-Torch on Kali Linux

2017-08-11T21:40:00.001-07:00

Kali Linux comes preloaded and chock-full of a myriad of useful penetration testing and scanning tools. Some might even argue that it comes with too many, because it can be hard finding the right tool that you want to use – especially if you’ve never heard about it before. Nevertheless, today we’re going to be looking at a tool called Cisco-Torch, which has a variety of applications.

In addition to being an exploitation tool, it can also be used for fingerprinting and reconnaissance. And to be fair, a few of its functions overlap with the functions of other tools. That is, you’ll find that most reconnaissance tools are going to provide some similar mechanisms to scan the local network.

However, I don’t want you to think that this program is identical to another scanner, such as NMAP. In addition to having more features and exploitation tools, Cisco-Torch varies from other simple scanners in that it can launch multiple simultaneous scanning functions at the same time for greater speed and efficiency. It also works well in the Application layer of the OSI model for fingerprinting systems, which is something that NMAP lacks.

And while NMAP is well adept at scanning networks for individual ports and services, Cisco-Torch takes things one step further. Not only can it scan a network for devices accepting Telnet, HTTP, and SSH (these services would likely identify networking devices like routers, switches, firewalls, servers, etc.), but it can even run dictionary attacks against discovered hosts – depending on the device type, OS version, and so on.

What Are Cisco-Torch’s Capabilities?

Sometimes it’s hard to pin down exactly what a tool can be used for – as well as what it can’t be used for. However, Cisco-Torch is pretty straightforward because it has some specific applications. First off, note that Cisco-Torch can scan for the following types of services to better identify hosts that can be attacked:

Telnet
SSH
SNMP
NTP fingerprinting
TFTP fingerprinting
Cisco webservers
Cisco IOS HTTP Authorization Vulnerability Scan
Cisco Webserver with SSL support scan

The bottom line is that Cisco-Torch, as the name implies, is tooled to scan for and identify Cisco hosts, though it can also discover other vendors’ networking devices that are accepting certain connections.

And though host identification is a necessary first step in many attacks, it isn’t always the most important function of a tool. After a host has been identified, Cisco-Torch can then launch password attacks against that host.

Cisco-Torch Command Flags and Syntax

Like just about every other command on Linux systems, Cisco-Torch has a help screen. However, unless you have quite a bit of experience in the I.T. industry, some of the options’ functions may not be readily apparent, and bear further discussion. The following outlines the command syntax and available options:

usage: cisco-torch <options> <IP,hostname,network>

or: cisco-torch <options> -F <hostlist>

Available options:

-O <output file>

-A All fingerprint scan types combined

-t Cisco Telnetd scan

-s Cisco SSHd scan

-u Cisco SNMP scan

-g Cisco config or tftp file download

-n NTP fingerprinting scan

-j TFTP fingerprinting scan

-l <type> loglevel

-c critical (default)

-v verbose

-d debug

-w Cisco Webserver scan

-z Cisco IOS HTTP Authorization Vulnerability Scan

-c Cisco Webserver with SSL support scan

-b Password dictionary attack (use with -s, -u, -c, -w , -j or -t only)

-V Print tool version and exit

Usage Examples

First and foremost, I’d like to point out how powerful this tool is. When you use NMAP, you have to specify each and every type of scan you’d like to do perform. For instance, you might specify the subnet, host, range of hosts, type of scan, port ranges, and other parameters before running a scan.

While you still need to specify the target(s) as a parameter with Cisco-Torch, there is one simple flag that will run all available scans against a host or range. For instance, the following command will run all fingerprint and scan types against the desired host:

cisco-torch -A 10.1.1.54

The above command scans a single target host. Now let’s pretend that the host was accepting Telnet connections. If you wanted to run a dictionary attack against the host, you could issue the following command:

cisco-torch -t -b 10.1.1.54

Now, however, let’s pretend that you were doing a real-world host discovery, and not testing tools on your local network (as you should be doing). If you wanted to scan an entire network or subnet, you would simply append the subnet mask to the end of the host, being sure to remember your binary math to appropriately lable the subnet as follows:

cisco-torch -A 10.1.1.0/24

This command will, of course, run a fingerprint scan types combined against the 10.1.1.0/24 subnet, which is 256 addresses in total. Also note that the result won’t be instantaneous, so babysit your process patiently. Lastly, I’d like to point out that it isn’t possible to run this type of scan using other scanners, such as NMAP.

You’d have to run multiple scans independently, instead of all at once. Doing them individually could take hours, so there is a lot of power in the multi-threaded scan used in Cisco-Torch.

Final Thoughts

I think that NMAP is a more robust scanning tool with more general and flexible options. However, I think that Cisco-Torch is more sophisticated and specialized to identify Cisco hosts (though it can identify other vendors’ equipment) and run fingerprint scans and password attacks against them. And you might be thinking that this tool isn’t worth very much since it specializes in attacks against only one vendor.

But I digress. You see, Cisco Systems is the largest producer of telecommunications and Internet equipment in the Western world. You’re going to find Cisco products (routers, switches, ASAs, etc.) more often than you’re going to find their competitors’ equipment, such as Juniper, Dell, or other runner-ups in the networking world.

And lastly, while I don’t recommend snooping around a corporate network or launching attacks against your ISP, I do highly encourage you to try this tool out on your home network. Remember to use Kali responsibly, because I don’t advocate breaking the law.

How Hackers Steal Passwords using the SEToolkit

2017-08-11T12:37:00.003-07:00

Welcome back my fellow hackers! In the past few articles we’ve been preparing to steal credentials from users on our local network, and today we’re going to be performing this attack. We’ll start by explaining the anatomy of the attack, and then we’ll perform the attack for ourselves. We’re going to be using a Man in the Middle Attack and a DNS spoofing attack, so you should read up on those attacks if you haven’t already. So, without further adieu, let’s get started!

The Anatomy of Credential Capturing

First, we’ll be discussing the basic anatomy of credential capturing. First, we’ll take a quick look at Man in the Middle attacks and DNS spoofing. Since we’ve already covered this we won’t be going too far into detail. If you need a refresher on these attacks, see the links above.

Man in the Middle attacks are very simple. An attacker simply places themselves between two parties so that all traffic flows through them. This way, the attacker can read all unencrypted traffic. The Man in the Middle in and of itself isn’t very powerful. But it opens the gateway to many other kinds of attacks. A MitM attack can be seen in the diagram below.

Next up, we have DNS spoofing, which we’ve also covered before. These attacks are also rather simple. The attacker (us), listens for DNS queries for a certain host, and spoofs the response to that request with whatever address they want. This way they can redirect the victim to whatever address they wish. DNS spoofing can be seen in the following diagram.

Alright, now that we’ve reiterated all of the attacks we’ve already done, it’s time to move on to the interesting stuff, stealing passwords! We’re going to be using something call the Social Engineering Toolkit, or SEToolkit (SET) for short. This toolkit is something that any hacker should be at least a little familiar with. This allows us to perform many different social engineering attacks. One of these social engineering attacks is the credential harvester, which will clone whatever website we give it and save a copy of it to our local machine. This lets us set up a server on our attacking machine and server the page just as the legitimate web server would. That’s about it for the anatomy of this attack, so let’s move on!

Performing the Attack

Step 1: Use the SEToolkit Credential Harvester Module

First, we’re going to clone the site with SEToolkit to get that out of the way. To start SET we just use the setoolkit command.

After a little while, and maybe a prompt or two, the SET should be ready to go. Once it boots up, we should see a menu that looks something like the screenshot below. We’re going to be choosing the first option, social engineering attacks.

Now we should be presented with another set of numbered options, we’re going to be selecting the second option, website attack vectors.

Guess what we have next! That’s right, more number menus! In this next menu we’ll be selecting the third option, the credential harvester attack method. Don’t worry about all these other options, we’ll get to them in due time.

Now all we have to do before putting in our attack details is select the site cloner, which is the second option.

Alright, now that we’re in the correct area of SET to enter our attack information, we need to get some information to enter! To start, we’re going to get our local IP address, which we’ll need to give to SET. We can get this by using the ifconfig command.

Now that we have our local IP address (10.0.0.16), we can hand it to SET in the first site cloner prompt.

Next, it will ask for the URL of the site we want to clone. This will clone the website and save it to our machine. We’ll be stealing an unsuspecting Twitter user’s password, so we’ll be cloning the Twitter website.

It should go on to clone the Twitter login page. Once its done cloning, it should ask us if we want to start the Apache web server process, go ahead and say yes to this prompt in order to avoid having an extra step.

You may need a little patience as this can take some time depending on your connection speed, but after some we should get confirmation that the site has been cloned into the Apache location and that the Apache service has been started.

Step 2: Start the Man in the Middle Attack

In order to perform DNS spoofing, we need to be able to see the victims traffic, so we’re going to use a man in the middle attack to place ourselves between the victim and default gateway. First, we need to find the address of the default gateway, which we can get using the route command.

We can see that the address of our gateway is 10.0.0.1 (remember to enable IP forwarding before continuing. You can enable it with this command: echo 0 > /proc/sys/net/ipv4/ip_forward). In order to make our job easier, we already have the address of our victim, 10.0.0.13. Now that we have this information, we can start the MitM with the arpspoof tool.

Now that the MitM is started, we can move on!

Step 3: Start the DNS Spoofing Attack

In order to perform our DNS spoofing attack we need to edit the file at /etc/hosts. This will tell the DNS spoofing tool what sites we want to spoof replies for. Since we’re pretending to be Twitter, we’re going to add the following line to the /etc/hosts file.

Now that we’ve added this line, the DNS spoofing tool will know that we want to spoof replies to responses for Twitter. Now we just have to start the dnsspoof tool and we’re good to go!

Step 4: Capture the Credentials

Now that we have all our attacks running, we can capture the credentials of our victim! From our victim PC, let’s point the browser at Twitter and try to log in.

Seems legit, huh? The biggest give-away for this attack is the message of using the mobile version of Twitter.

I’ve entered fake credentials for a fake user named victim_user and I’ve also entered a fake password. When we try and log in it will fail and we’ll be redirected to the real Twitter. It is at this point that we should cut all the attacks that way to we don’t raise any suspicion by playing with the victims traffic when we don’t need to.

Now that we’ve tricked our victim into logging in, let’s go to the Apache service files and see if anything new has shown up.

We can see that a new text file has appeared with the harvester name. This file should contain the captured credentials of the user, so let’s crack it open and find out!

There we have it! We were able to use MitM and DNS spoofing attacks in order to perform a credential harvesting attack! This is more than just a step-by-step on stealing passwords, it’s a proof of concept. By learning the in’s and out’s of these smaller attacks such as Man in the Middle and DNS spoofing, we can combine them together to make for a much more powerful attack. There’s a deeper message here, and that message is this: hacking is more than just technical skills. Hacking is just as much about creativity as it is about knowing your way around a computer, and today we’ve proven that.

Kali Tools: SSLStrip

2017-08-11T12:35:00.001-07:00

Today we’re going to be taking a closer look at a useful Kali Linux tool called SSLStrip. As the name implies, it is useful for hijacking HTTP traffic and monitoring HTTPS traffic. Basically, it serves as a type of proxy that makes standard non-encrypted HTTP connections mirror the appearance of encrypted HTTPS sessions.

Using this tool, it’s possible to “strip” the security off of HTTPS, and turn an HTTPS link into a regular, plain-vanilla HTTP link, or even change an HTTPS link to an HTTPS link with a private key that the attacker already knows. This tool is rather tricky, too, because it will even send the padlock icon to a browser to give the appearance that the connection has been secured.

Essentially, this is a sophisticated version of an MITM attack. MITM attacks are really a rather large umbrella term do describe any attack that collects user data before sending it on the appropriate destination host. And since you control that data, it’s possible to edit it and change the details before sending it on its merry way.

Installing SSLStrip and Running It

If it’s not already installed on your system, you can grab it at the usual github location. It is a Python tool, so it’s dependent upon Python 2.5 and later. I always recommend running an update before installing code, too. Not only will that ensure that all of your other packages and modules are up to date, but it will help avoid future headaches caused by contrived package dependency problems.

After that, you’re going to need to make a few configuration changes on your system as follows.

Ensure your computer is in forwarding mode. Simply login as root and run the following command: echo “1” > /proc/sys/net/ipv4/ip_forward
Edit iptables to ensure that it can intercept HTTP requests. Once again, you’ll need to be logged in as the root user. Issue the following command: iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-port [DESIRED-LISTENING-PORT]
Issue the sslstrip command from the BASH shell.
Finally, you’ll need to run arpspoof to facilitate the MITM attack with the following syntax: arpspoof -i [YOUR-IP-ADDRESS] -t [TARGET-IP-ADDRESS] [ROUTER-IP-ADDRESS]

SSLStrip Command Syntax

The command syntax for SSLStrip is actually rather simple when compared to some of the more advanced Kali tools, such as Metsploit. The following will serve as a reference of the command’s various options and syntax:

Usage: sslstrip <options>

Options:

-w <filename>, –write=<filename> Specify file to log to (optional).

-p , –post Log only SSL POSTs. (default)

-s , –ssl Log all SSL traffic to and from server.

-a , –all Log all SSL and HTTP traffic to and from server.

-l <port>, –listen=<port> Port to listen on (default 10000).

-f , –favicon Substitute a lock favicon on secure requests.

-k , –killsessions Kill sessions in progress.

-h Print this help message.

SSLStrip Usage Example

In this example, we’re going to write the results of SSLStrip to a log file. After the data is logged, you can use it as an input parameter for other hacking tools. SSL runs on port 443, but for the sake of simplicity, it’s pretty standard in the industry to setup listening ports for HTTP/HTTPS traffic on port 8080.

All of the well-known service typically run on ports below 1024, but past that, there are a lot of open ports. For that reason, it’s pretty safe to assume that port 8080 isn’t going to be used by a different service. The following is an example of using the SSLStrip command to log data after spoofing the ARP protocol:

sslstrip -w mylogfile.log -l 8080

Note that you’ll want to be the root user when running this command. Naturally, the -w option tells sslstrip to write the data to a file, and the -l option tells it what port to listen on.

Final Thoughts

There are a myriad of MITM tools, and some of them even allow an attacker to steal live sessions with the click of a button. Though it is old and outdated, you can still find the FireSheep code online and install it in a web browser, allowing you to hijack session cookies. Last but not least, remember to abstain from using these tools in the real world for a malicious attack. Not only is it immoral, but you could wind up facing tough legal consequences should you get caught.

How to Solve the Crackme Challenge (A Small Reverse Engineering Puzzle)

2017-08-10T01:14:00.002-07:00

Welcome back my fellow hackers! Recently, I’ve been delving into the incredibly interesting world of reverse engineering! I hope to write more about this topic some time in the future, but for now we’ll just start with something simple. I took a few days and made a small reverse engineering challenge. Today, we’re going to go through this challenge and solve it with all 3 intended solutions (if you can find more, leave them in the comments!).

We’ll start with downloading and compiling the challenge, then we’ll start solving it. Our first solution will be a buffer overflow vulnerability intentionally coded into the challenge, then we’ll hunt down and execute a secret function to solve the challenge, and finally we’ll execute the program instruction to instruction until we can read the solution straight out of the computers memory! Now that we know what we’ll be doing, let’s get started!

Downloading and Compiling the Challenge

First, we need to download and compile the code of our challenge. Let’s download the challenge code from pastebin using the curl command:

We’ve written the code to a file named crackme.c. Now that we have our code, we need to compile it. We’ll be using the GCC (GNU Compiler Collection) to compile our code. Pay close attention to the flags used when compiling our code, as they are important to the challenge functioning properly:

You may get a warning out of the compiler but don’t fret, the code will still work (this warning is related to the buffer overflow vulnerability, which is intentional). Let’s test our executable just to make sure it works:

Now that we have our code compiled and working, we can start cracking this challenge! We’ll start with the buffer overflow vulnerability.

Cracking the Challenge

Solution 1: Buffer Overflow

Buffer overflows are very common vulnerabilities. A “buffer” is simply an area of memory designated for storing data to be processed or used in processing. If we can fill a buffer with more data than it can handle, we “overflow” it, and can then store data in areas of memory where we shouldn’t be able to. This can lead to code execution, which is how a lot of buffer overflow exploits work. But, in our case, we’ll be overflowing a buffer simply to change the value of the data being held in another.

Let’s perform this attack, and then we’ll take a look at the code that makes this possible:

We can see here that by entering a large amount of text, we can successfully login even when this is obviously not the correct password. Now that we’ve exploited our buffer overflow, let’s take a look at the code that made this happen:

We can see here that we make a character array that holds 30 characters. So, if we input more than 30 characters, that will overflow this buffer, which will change the value of the “valid” integer. This integer is then evaluated later in the program and, since the overflow changed it to a non-zero number, it equates to true and logs in without a problem. Next up, we’ll be hunting for a hidden function in our program!

Solution 2: Using the Hidden Function

If you read the code of our challenge, you’ll that there is a function named “secret.” This function is never used, yet it still exists. If we can force this function to execute somehow, we could get the password we need. Well we have just the tools to do that! First, we need to use a tool called objdump (object dump) to disassemble our executable into assembly. Then we’ll be able to see where our secret function is:

Now that we have our new assembly code in a text file, we can sift through it until we find our secret function. It should be just above the main function, and looks something like this:

Now, don’t panic, this looks way more complicated than it is. The only part of this assembly we need to pay attention to is the string of characters next to the word “secret.” Specifically, we need to remember the last 7 characters, as this is the entry address for this function. Now that we have this 7 character string, let’s start our program in GDB and do some magic:

No need to pay attention to this large chunk of text, it’s mostly just information about GDB. But here’s the important part: when GDB starts up, we need to use the start command in order to start our program. Now, remember that 7 character string? This is where we’ll be using it. If we can change where the instruction pointer is pointing, we can force it to execute our secret function. Luckily for us, GDB allows us to do just that:

We need to precede our string with a “0x” as this specifies it as a memory address. Now that we’ve wrapped up this solution, on to the next, reading the password out of memory!

Solution 3: Reading the Password out of Memory

SIDE NOTE: For this solution to work you may want to re-compile the program with the -m32 flag to compile a 32-bit version of it.

Our final solution is the most complicated. When we enter a password into the program, it needs to be stored in memory so it can be evaluated later. If we can catch it while it’s stored in memory, we can read it! We can also use GDB for this. So, let’s start up GDB again:

I’ve cut out the large chunk of text shown by GDB for the sake of organization. Now, we need to start the program with the start command. Once we do, we display current number of the EAX register. This is the register that our password will be in once we enter it. After we display the current contents of EAX, we use the ni command (next instruction) to move on to the next instruction in the program.

As you can see by the output above, once we used the ni command, it displayed the value of EAX again. We can use this to tell when the value in EAX changes, if the number changes, the contents changed. Now we just need to repeatedly press return to re-execute the ni command and step through our program. Once we reach the prompt for a password, enter something random:

We can see that a few instructions after we entered an incorrect password, the value of EAX changed. Now we can use x/s to read the contents of EAX as a string which, in this case, is the correct password to our program!

This concludes our small reverse engineering article. I’d like write more about this in the future, but since I’m still learning myself, we’ll have to save it for another time. Just know that this idea is on the back-burner for now!

The Ultimate Penetration Testing Command Cheat Sheet for Linux

2017-08-09T16:38:00.002-07:00

Have you ever learned a new command, application, or tool, only to find that one week later you’re struggling to remember the exact syntax? Sure, Linux command line tools have help features, but they can be pretty cumbersome. That’s why cheat sheets exist, folks, and they can be a real life saver. Well, maybe a cheat sheet won’t save your life, but it can certainly save you oodles of time, headaches, frustration, and invalid commands.

That’s why I’ve compiled some of the most popular and frequently used penetration testing commands in three sections: general Linux usage, NMAP scanning, and Metasploit. It should be noted that this list isn’t comprehensive by any means, but will serve as a good reference for some of the most commonly used commands to help put you on the fast track to penetration testing in a Linux environment.

Even though experienced Linux users feel comfortable working with these commands on a nearly daily basis, there are some that slip through the cracks and become forgotten. Even some of the basic hotkeys and shortcuts, which can really help save a lot of time at the command prompt, are forgotten by experienced Linux users from time to time. Also, if you just want to initiate some network scans on your home network, I’ve included NMAP references as well.

Most of these commands will become internalized if you’ve had a chance to work with them for a few months. But every once and a while, it’s nice having a reference to rely on. So, let’s start the cheat sheet off with standard Linux BASH shell commands.

Linux BASH Shell Command Reference

BASH Shell Shortcuts and Shorthand:

Knowing your way around the BASH shell is what separates the seasoned Linux veterans from the wannabes and newbies. Though it may seem trivial at first, there are a lot of handy hotkeys that simply working from the shell. Some of them are just for convenience, some are practical, and some are functional.

The bottom line is you need to know how to save yourself the hassle of re-entering and extremely long command that is nearly identical to the last command you ran, and you had better darn well know how to terminate an active shell process. Use the following hotkeys within the Linux shell:

ctrl + c – terminate the currently running command
ctrl + r – search the current terminal session’s command history
ctrl + a – go to the start of line (useful if you need to correct a typo at the beginning of a very long command)
ctrl + e – go the the end of line
ctrl + z – sleep program
!! – reissues the last command that was run
![command] (i.e. !ping) – reissues the last command starting with the supplied parameters, which is the last ping command in this example
Up arrow – search through the cached history of previously run commands
Down arrow – sort through the history of used commands to the most recent command
Tab – the tab key is useful for auto-completing file and directory names within the current working directory, which save you the trouble of having to type them out

Basic Shell Commands:

mount – displays mounted media and file systems
uptime – displays how long the system has been active
clear – if there is too much information printed to the current terminal screen, you can wipe it all clean with the clear command
date – displays the time and date that is configured within the operating system
whoami – displays the current active user in the shell
su root – prompts you for a root password to login and run commands with root privileges
pwd – prints your current working directory, which is your current location in the file system
ls – this is the list command, which prints the files and directories within your current working directory
ls -l – this option is known as a “long listing,” and shows detailed information about the files and directories in your current working directory
ls -la – this command will show you a long listing, and the -a option shows you all files; by default, hidden files that start with the “.” character are omitted
cd [directory] – the cd command is useful for navigating the Linux files system; simply perform an ls command to see directories accessible in your current working directory
cd ../ – this command will set you one level higher in the current working directory tree
[command] | grep [parameters] (i.e. ls | grep myfile.txt) – piping command output to grep and supplying it with parameters will filter the output based on your criteria
ps aux – displays a list of running processes; the output is long, so it’s best to pipe it to less, more, or search through it with a tool like grep
kill [process_number] – kills a process based on it’s process ID identified with the ps auxcommand

Network Interface and IP Commands:

ifconfig – the same as the ipconfig on Windows systems; this command will display interface information, such as MAC address, IPv4/IPv6 addresses, interface status, transmitted and received data, and so on
ifconfig [interface] down (i.e. ifconfig eth0 down) – shuts down an interface, such as a wireless, Ethernet, or tunnel interface
ifconfig [interface] up (i.e. ifconfig eth0 up) – enables an interface that has been shut down; taking an interface down and then up again (sometimes called bouncing an interface) can be a useful troubleshooting or reset procedure
route – displays the current routing table, including the default route

Port and Service Commands:

In days of yore, most Linux systems used a tool called ipchains. However, these days, ipchains is obsolete, defunct, deprecated, and antiquated. Instead, you want to use the netstat command. Use the following commands to check and edit port settings on your Linux machine:

netstat -l – shows ports that are in a listening state
netstat -a – shows all ports (sometimes called sockets) that are in use
netstat -u – shows all UDP connections and ports that are open
netstat -t – shows all TCP connections and ports that are open
netstat -a | grep [protocol] (i.e. netstat -a | grep http) – searchs all open connections and ports for any that contain the characters “http”

NMAP Command Reference

In this section we’re going to be going over all of the most common NMAP commands. I’ll start with a brief reference and explanation of each command, and then delve into greater details and explain the most important command options.

It’s also worth noting that NMAP commands are incredibly versatile. Not only is NMAP a widely used shell program on a variety of Linux distributions, but the data it generates can be “plugged in” to other programs as input. For instance, within the Metasploit framework (discussed in the next section), you can actually build a database of hosts and targets using NMAP scans.

The syntax for NMAP commands within Metasploit varies only slightly, and the options are the same. So what you learn in this section can be applied to other penetration testing tools. Use the following data as a reference for the NMAP help guide, which shows you most of the options and correct syntax:

Usage: nmap [Scan Type(s)] [Options] {target specification}

TARGET SPECIFICATION:

Can pass hostnames, IP addresses, networks, etc.

Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254

-iL <inputfilename>: Input from list of hosts/networks

-iR <num hosts>: Choose random targets

–exclude <host1[,host2][,host3],…>: Exclude hosts/networks

–excludefile <exclude_file>: Exclude list from file

HOST DISCOVERY:

-sL: List Scan – simply list targets to scan

-sn: Ping Scan – disable port scan

-Pn: Treat all hosts as online — skip host discovery

-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports

-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes

-PO[protocol list]: IP Protocol Ping

-n/-R: Never do DNS resolution/Always resolve [default: sometimes]

–dns-servers <serv1[,serv2],…>: Specify custom DNS servers

–system-dns: Use OS’s DNS resolver

–traceroute: Trace hop path to each host

SCAN TECHNIQUES:

-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans

-sU: UDP Scan

-sN/sF/sX: TCP Null, FIN, and Xmas scans

–scanflags <flags>: Customize TCP scan flags

-sI <zombie host[:probeport]>: Idle scan

-sY/sZ: SCTP INIT/COOKIE-ECHO scans

-sO: IP protocol scan

-b <FTP relay host>: FTP bounce scan

PORT SPECIFICATION AND SCAN ORDER:

-p <port ranges>: Only scan specified ports

Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9

-F: Fast mode – Scan fewer ports than the default scan

-r: Scan ports consecutively – don’t randomize

–top-ports <number>: Scan <number> most common ports

–port-ratio <ratio>: Scan ports more common than <ratio>

SERVICE/VERSION DETECTION:

-sV: Probe open ports to determine service/version info

–version-intensity <level>: Set from 0 (light) to 9 (try all probes)

–version-light: Limit to most likely probes (intensity 2)

–version-all: Try every single probe (intensity 9)

–version-trace: Show detailed version scan activity (for debugging)

OS DETECTION:

-O: Enable OS detection

–osscan-limit: Limit OS detection to promising targets

–osscan-guess: Guess OS more aggressively

There are many more options in the NMAP syntax, but this is more than enough to get you started. Now, let’s take a look at some of the most common command references that will enable you to scan networks and hosts:

Host and Subnet Target Syntax:

nmap [host] (i.e. nmap 10.10.10.1) – tells NMAP to target a single IP address
nmap [domain] (i.e. nmap www.myserver.com) – tells NMAP to target a specific host, but that host needs to be resolvable with DNS
nmap [range] (i.e. nmap 10.10.10.1-5) – specifies a range of IP addresses for NMAP to target
nmap [subnet] (i.e. nmap 10.10.10.0/24) – tells NMAP to scan an entire subnet with a variable length subnet mask
nmap -iL [import_host_list.txt] (i.e. nmap -iL myhostlist.txt) – allows you to import a list of hosts from other sources

Port Scanning Target Syntax:

nmap -p 80 10.10.10.1 – scans a host to see if it is accepting connections on a specific port (port 80 in this case)
nmap -p 80-100 10.10.10.1 – scans a host to see if it is accepting connections on a range of ports (port 80 in this case)
nmap -F 10.10.10.1 – the -F options stands for “fast,” and will scan one hundrede of the most commonly used ports on a host
nmap -p- 10.10.10.1 – scans all ports on a host, but is rather slow

Port Scanning Options Syntax:

nmap -sT 10.10.10.1 – initiates a scan using TCP connections
nmap -sU 10.10.10.1 – initiates a scan using UDP connections
nmap -Pn 10.10.10.1 – initiates a port scan using selected ports, and omits the active port discovery process
nmap -sS 10.10.10.1 – initiates a TCP SYN scan

Verbosity

I also wanted to add a section concerning the verbose option, which can be added to any of the previous commands. The problem with some NMAP scans is that they can seem to take forever, and the terminal won’t show you what’s happening behind the scenes by default. That can make waiting for your scan to finish nearly unbearable.

However, you can easily tell NMAP to print it’s completion rate with various tasks to the terminal. Not only is verbosity useful for keeping an eye on your NMAP scan and tracking its progress, but it’s also useful for seeing how different hosts and targets react to your scan. With verbosity enabled, you’ll be able to see error messages or hosts that didn’t reply to probes, which helps troubleshoot why the host isn’t responding.

The verbose option in NMAP syntax is simply -v. You can add the -v flag to almost any NMAP scan. For instance, if I wanted to track the progress of an NMAP scan on my local network, I would issue the following command:

nmap -v -Pn 10.10.10.0/24

This command will run through a host and port scan for all 254 IP addresses on the 10.10.10.0/24 subnet. Furthermore, it will print information in the prompt regarding which address it is currently probing, giving you and accurate idea of how much more time is left in the total scan.

Identifying Hosts’ Operating System and Active Services

If you’re using NMAP from a Metasploit perspective, it would be highly useful to know what version, service pack, services, and operating system a host is using to probe for vulnerabilities. Fortunately, NMAP comes equipped with tools to scan a remote host’s operating system fingerprint and active services. Use the following commands:

nmap -sV 10.10.10.1 – basic service scanning and detection
nmap -sV –version-intensity [0-9] 10.10.10.1 – sometimes a probe won’t be able to identify a host’s operating system, so you can turn up the probing intensity with a value between 0 and 9. 9 is the most intense scan, which will try all available NMAP probes, but will also take longer
nmap -sA 10.10.10.1 – NMAP will scan the specified host to identify its active services and operating system

NMAP Output

As mentioned previously, NMAP can be piped into various types of output format and imported into other applications. It’s possible to save the output in formats such as text files, XML, grep-readable formats for fast and easy searching, and a general “all format” type. Instead of simply printing output to a terminal or copying/pasting it into a text file, you can use the following commands to manipulate how the output is stored.

Nmap -oX MyOutputFile.xml 10.10.10.1 – save output in an XML format
Nmap -oG MyOutputFile.txt 10.10.10.1 – save the default output to a text file
Nmap -oN MyOutputFile.txt 10.10.10.1 – save output in a GREP readable format (which can be accessed, searched, and filtered with the grep command)
Nmap -oA MyOutputFile 10.10.10.1 – save output in all formats

Metasploit Command Reference

Core Metasploit Commands:

Metasploit is always changing, growing, and evolving. With each new vulnerability that’s discovered and added to the Metasploit framework, there are a myriad of new patches and operating systems as a response. As such, you need to know how to search through all of the exploits, vulnerabilities, and modules. The following is a cheat sheet of the core Metasploit commands:

msfupdate – runs the automatic update function, and looks for any new exploits and vulnerabilities; note that this is run from the standard command line
msfconsole – this command is how to enter the Metasploit environment and receive the msf >prompt in the terminal
show exploits – displays all exploits in the terminal (should be piped to another command or filtered for better results)
show payloads – prints all currently known payloads to the terminal (should be piped or searched with a command like grep)
show auxiliary – displays all auxiliary modules that are contained in the Metasploit framework
help – shows the main help page for Metasploit
search [name] – searches through the exploits and modules for any labeled with strings matching the supplied name
info – displays information about a certain module or exploit
use [name] – loads a module or exploit
lhost [IP_address] – this should be set to your interface’s local IP address, especially if you’re currently on the same subnet or network as the target
rhost [IP_address] – use this command to set the IP address(es) of the target(s) you wish to target with the exploit
show options – displays all of a modules or exploits parameters that can be set; essentially a sub-help menu for an individual module that lists all of its commands
show targets – displays which targets and systems can be targeted for a given module
check – checks to see if the currently set target is vulnerable to the attack or exploit

Database Commands:

I had mentioned earlier that NMAP commands can be used in the Metasploit database. Metasploit comes with a lot of handy tools to build lists of hosts and run commands against those targets using NMAP commands as follows:

db_nmap [nmap_command_syntax] – the basic syntax of NMAP commands within Metasploit
db_nmap -v -Pn 10.10.10.0/24 – scans the 10.10.10.0/24 subnet with a basic port scan in verbose mode, and adds those hosts to the database
db_export – exports your current database to a file and location of your choosing
db_import – imports a database from another source
db_status – displays the status of the database; if everything is in working order, this command should return a status of “connected
hosts – prints a list of all the discovered hosts in the database, which could have been discovered from NMAP commands
hosts -a [ip_address] – adds an IP address, range, or subnet to the hosts database list
hosts -d [ip_address] – deletes an IP address, range, or subnet from the hosts database list
hosts -u – prints all of the hosts that are known to be up

Cheat Sheet Conclusion

Lastly, I would like to point out that this cheat sheet shouldn’t serve as a shortcut to learning an entirely new operating system or penetration testing skills. If you think you can breeze through by reading a cheat sheet, think again. If you’ve never worked from the terminal before, you’re going to have a tough time using any commands in Linux.

If that’s the case for you, I’d recommend starting with some basing Linux tutorials, learning the Linux file system, and how to run basic shell commands. You may even want to dig into the course materials for the Comptia Linux+ exam. Having said that, this should be a solid reference for the most common commands (some of which you may have forgotten).

Cracking WPA/WPA2 – PSK Encryption

2017-08-09T01:39:00.000-07:00

A little Disclaimer – The contents of this post are solely for ethical and educational purposes. You may not use it for unethical purposes. The Author or the Website is not responsible for any damage to yourself, your network, or the computers in you network, should something go wrong. (Basically guys, be careful where you use this and please don’t do anything stupid.)

We’re going to start with a little introduction to Kali Linux, because that is the OS I prefer, is the easiest for this task and comes with all the tools we need. “Kali” is a Linux distribution and is the successor to the much acclaimed Backtrack, which many of you reading this article will probably know of. Now, there are many ways of installing and using Kali, if anyone needs any help, leave in the comments, and I will probably write another post about installing and its basics in the future.

In this tutorial, I’m going to hack into a Wi-Fi hotspot that I just set up, named – Anonymus.
Now, given that we have Kail Linux, open up a terminal window, type in “ifconfig “. This is going to list all the networking interfaces connected to your device.

Here, we only need (wlan0) which is our Wi-Fi card, so we can disable the others by doing “ifconfig <name of the interface> down”.
(“lo” does no matter)…

Now, we type “airmon-ng start wlan0”

(airmon-ng is just a tool for monitoring air traffic, “start” basically starts the tool, and “wlan0” specifies the interface we are using for monitoring)
It’ll probably show “some processes that could cause trouble”, we’ll simply kill those processes by entering “kill <process ID>”.

Now if we do “ifconfig”, it should show us the newly made monitoring interface “mon0”.

Then, put in, “airodump-ng mon0”.
In the screenshot below, the highlighted bssid is our target (and it is my own), named “Anonymus”, the channel is 13 as we can see under the “CH” column.

For our next step we type in, “airodump-ng –c <channel> -w <name> –bssid <bssid> mon0”.

Let me explain a few things here, “airodump-ng” is a tool for capturing Wi-Fi packets, “<channel>” means the channel your target is running on, “-w” basically writes a file by the name that succeeds it in “<name>”, (I did “handshake” just for the convenience of it) bssid is a string of numbers specific to a hotspot.

Now, open up a new terminal and type in “aireply-ng -0 0 –a <bssid> mon0”, this command send a deauthentication signal (usually called a deauth packet) to all the devices connected to that hotspot. Then after a few seconds we stop it by “Ctrl+C”. Now, as we can see, the other terminal shows that the WPA Handshake was successfully captured.

We can close both windows at this point, and open a new one. Type “ls”; that should list the files in the current directory. We can clearly see that the files from the above operation are present. But we only need the file ending with “-01.cap”.

Then we do, “aircrack-ng –w <full location of the wordlist> <the file name>”.

You may be asking what wordlist? What is that sh*t?
A Wordlist is a file containing thousands of known and possible passwords, which you can download from the internet (“specifying from the internet” – We ain’t dumb, boy! :P). The one I used can be found here. The list contains 982,963,904 words exactly all optimized for WPA/WPA2. Would also just like to point out that this is not my work, I got it from forums.hak5.org. It was a guy who compiled a whole load of useful lists, including his own to come up with 2 lists (one is 11gb and one is 2gb) I will be seeding this torrent indefinitely since it is shareware and awesome!

It will then start searching for matching keys in the word list. Now the time that this will take is solely dependent on the strength of the password. The stronger the password the more time will it take. For very strong passwords, check this out. For tips on creating your own strong password – Top 10 Tips to Create a Strong Password
After completion it looks something like the screenshot below. In it, you can see that it tested 45688 keys and my key was the 45689th. I purposely put futurama because frankly, futurama is awesome! Also it is a very weak password (People reading this, if your password is “futurama”, you’re cool! The Hell? Change it right now!)

Now that we know the password, lets test it…

Annnnd… Voila! it works!

Knowing this you will be…

But beware, don’t use it on a Lannister… (Because a Lannister always pays his debts :P)
For those of you who didn’t understand that reference, #GameOfThrones!

How Amazon Employee bought 'Google.com' Domain for Only $12 from Google

2017-08-09T01:36:00.000-07:00

Difficult to believe this, as we hardly come across such news.

But trust me, a person managed to buy no ordinary .com domain, but — Google.com and that too for one whole minute.

Sanmay Ved, an ex-Google employee and current-Amazon employee, experienced something of a shock when he found that the world's largest search engine website, Google.com, was "available" for purchase.

What's Even More Shocking?

It's the cost of the most-trafficked domain in the world — Only $12.

Expecting to get an error message, Ved added the domain to his shopping cart and made payment. The entire purchasing process went through without any difficulty.

Within moments, his inbox and Google Webmaster Tools were flooded with webmaster related messages confirming his ownership for Google.com.

"The scary part was I had access to the webmaster controls for a minute," Ved said.

However, soon he received an order cancellation email and refund from Google Domains, as Google personally owns Google Domains, so it can still control all purchases made through it and revoke them if needed.

Google Forgot to Renew Ownership. Really?

It is still unclear what exactly happened – if it was due to a bug in Google Domains or the company really "forgot" to renew ownership of its address using its own domain service.

Whatever the reason, the experience of owning the search engine giant Google.com does indeed sound great.

Ved has posted all the ordeal along with screenshots on his LinkedIn account blog post.

Windows 10 Wi-Fi Sense Explained: Actual Security Threat You Need to Know

2017-08-09T01:31:00.000-07:00

Just one day after Microsoft released its new operating system, over 14 Million Windows users upgraded their PCs to Windows 10.

Of course, if you are one of the Millions, you should aware of Windows 10's Wi-Fi Sense feature that lets your friends automatically connects to your wireless network without providing the Wi-Fi password.

Smells like a horrible Security Risk! It even triggered a firestorm among some security experts, who warned that Wi-Fi Sense is a terrible and dangerous feature and that you should disable it right away.

Even some researchers advised Windows 10 users to rename their Wi-Fi access points.

Before discussing the risks of Wi-Fi Sense, let's first know how it works.

How Windows 10 Wi-Fi Sense works?

Windows 10 Wi-Fi Sense feature allows you to share your Wi-Fi password with your friends or contacts, as well as lets you automatically connect to networks that your friends and acquaintances have connected to in past, even if you don't know the password.

Now, when those friends are within the range of your Wi-Fi network, Windows 10 automatically joins the network with that saved password you just shared with your friends and logs them in, without prompting them for a password.

Enabled by Default, but It's not the actual Security Threat, Here's Why:

Wi-Fi Sense feature is enabled by default in Windows 10 to make it easier for users to receive instant access to the Shared Networks by their Friends or Contacts.

But, But, But… did you notice that the feature says "For networks I select..."?

"Enabled by default" doesn't mean your Wi-Fi passwords are automatically going to be shared with your Facebook or Skype contacts by default, unless you won’t manually configure your Wi-Fi Sense settings to share selected network access with any contact group.

Under "For networks I select..." option, you can explicitly control which group of contacts from which social networks get access to which Wi-Fi Network.

Until or unless you do not offer your Wi-Fi password to Wi-Fi Sense, it will not let selected contact group to connect to your network.

This means Wi-Fi password sharing option is OFF for every social network by default.

And of course even if you choose to share your Wi-Fi network with your contacts, Wi-Fi Sense only shares Internet access and not your actual Wi-Fi password.

Why You Should be Scared of Wi-Fi Sense (Actual Security Threat)

Microsoft promoted Wi-Fi sense as:

In simple words, now you don't need to read out loud your Wi-Fi password, character by character when your friends are at your home and want to use The Internet. So similarly, you don’t need to shout across the office or your friend’s house "What’s the Wi-Fi password?"

However:

"If you choose to share with your Facebook friends, any of your Facebook friends who are using Wi-Fi Sense on a Windows Phone will be able to connect to the network you shared when it's in range, You can't pick and choose individual contacts." -- Microsoft FAQ says.

As a general Internet user, I used to accept almost every friend request on the Facebook and also communicate with lots of people on Skype or Outlook. In short, the majority of people in my contact list are whom I don't know personally or trust.

So, If I can't choose any individual contact from my list, then enabling "Network password sharing feature" will share my network access with all my contacts in the selected social network.

Microsoft also Argued:

Neither it allows anyone to access your local resources so that nobody can hunt through your personal files.

However, We know that...

The biggest threat of sharing your Wi-Fi access with everyone on a list is just like you are allowing hackers to position themselves between you and the connection point i.e. Man-in-the-Middle attack.

In such attack scenarios, the hacker can access every piece of information you're sending out on the Internet, including important emails, account passwords or credit card information.

Sitting on the same network, an attacker can also target your machine directly using Metasploit or any other hacking tool.

Ultimately, Windows 10 Wi-Fi Sense probably is not the most secure feature in the world, but it is not that bad either, if in future, Microsoft could allow Windows 10 users to choose individual contacts from a group.

For Now… Should You Stop Using It?

Like many things in life, we have to make a choice between things that make our life comfortable and that provide us absolute security.

AND, if you are concerned more about security, just turn Wi-Fi Sense OFF.

How to Turn Windows 10 Wi-Fi Sense OFF?

To disable Wi-Fi Sense, go to Windows Settings, then Network & Internet and then click "Change Wi-Fi settings," and then "Manage Wi-Fi settings."

From there, you can change a variety of settings. Turn OFF everything under the Wi-Fi Sense heading; disable WI-Fi password sharing with Facebook, Outlook, or Skype; and have Wi-Fi Sense forget the list of known Wi-Fi networks.

How Spies Could Unmask Tor Users without Cracking Encryption

2017-08-09T01:29:00.000-07:00

The Onion Router (Tor) is weeping Badly!

Yes, Tor browser is in danger of being caught once again by the people commonly known as "Spies," who's one and only intention is to intrude into others’ network and gather information.

A team of security researchers from Massachusetts Institute of Technology (MIT) have developed digital attacks that can be used to unmask Tor hidden services in the Deep Web with a high degree of accuracy.

The Tor network is being used by journalists, hackers, citizens living under repressive regimes as well as criminals to surf the Internet anonymously. A plethora of nodes and relays in Tor network is used to mask its users and make tracking very difficult.

Any user when connects to Tor, the connection gets encrypted and routed through a path called a"circuit." The request first reaches an entry node, also known as a 'Guard' that knows the actual IP address of the user, and then goes through every hop in the route and finishes off a communication circuit via "exit nodes."

However, in some cases, an attacker could passively monitor Tor traffic to figure out the hidden service accessed by a user and even reveal the servers hosting sites on the Tor network.

Revealing identities without decrypting the TOR Traffic

Recently, Net Security team from MIT and the Qatar Computing Research Institute claimed to find a new vulnerability in the Tor's Guard gateway that can be exploited to detect whether a user is accessing one of Tor's hidden services.

They explained, Tor's Guard Gateways could be masqueraded and the packets coming from the user could be made to travel through attacker’s malicious ‘setup’ node acting as an Entry node.

In a proof-of-concept attack published this week, the researchers described this technique as "Circuit Fingerprinting,"...

...kind of behavior biometric, which includes series of passive attacks, allowing spies to unmask Tor users with 88 percent accuracy even without decrypting the Tor traffic.

This new alternative approach not only tracks the digital footprints of Tor users but also reveals exactly which hidden service the user was accessing; just by analyzing the traffic data and the pattern of the data packets.

"Tor exhibits fingerprintable traffic patterns that allow an [enemy] to efficiently and accurately identify and correlate circuits involved in the communication with hidden services," says the team.

"Therefore, instead of monitoring every circuit, which may be costly, the first step in the attacker's strategy is to identify suspicious circuits with high confidence to reduce the problem space to just hidden services."

The technique nowhere breaks down the layered encrypted route of Tor network, so being encrypted doesn't make your identity anonymous from others.

Does the vulnerability Really utter Truth?

The Tor project leader Roger Dingledine raises a question to the researchers asking about genuineness of the accuracy that the Traffic fingerprinting technique delivers....

... leaving the researchers and the users confused.

As for the Tor, it is considered to be a popular browser that protects your Anonymity while accessing the Internet. However, with the time and successful breaches, it seems that this phenomenon of the Tor network could get depleted.

According to the MIT News article, the fix was suggested to Tor project representatives, who may add it to a future version of Tor.