Info Sec Research Hub

Using Dynamic IP as Static IP

2012-04-14T04:21:00.001-07:00

As we all discussed in the previous tut that a hacker needs a static IP which is really very expensive for a normal person to have. Here we will discus how we can counter this problem. Please note that this solution is temporary and can never really take place of static IP but for now it will work.

For this we will use DNS redirect service from www.no-ip.com alternatively you can also use www.dyndns.com.

First of all register with www.no-ip.com by clicking on “No-IP Free” on home page. After you complete registration form hey will send you an confirmation e-mail, once confirmed, then you can log in to your account.

Now click on “Hosts/Redirect”, then type the host redirect name you want to which Dynamic DNS will redirect traffic after associating your IP. Let other options remain as it is if you don't know what they do.

Now create your host name. Now download “Download Client”. After installing DUC client type your e-mail address and password.

To check its working or not, type www.whatismyipaddress.com and check your IP address now ping the host name you created both will have same IP address.

Note: Most of you might be thinking what is use of this setup, you'll know its use when we will talk about Trojans and Spywares. Also note that there are several free as well as paid Trojan Clients and Spywares. But free tools are prone to get detected by anti-virus program so better opt for paid ones.

Lab Setup For Hacking

2012-04-14T04:14:00.001-07:00

Hey awl in this tutorial we will discus how you can setup a lab for yourself to practice hacking on your system. At very basic level a hacker is in need of 2-3 systems with a Wired LAN or Wireless LAN. But if you are the one who has started just like me with just one laptop or computer then possibly there's no way you can match this setup. So following was my solution to start practicing with only one laptop or PC meeting above criteria of multiple computers connected in LAN. At most basic level following are your requirements.

Requirements:

A Computer:
First of all a computer which must have minimum following configuration.
A processor with 1.7GHz clock speed,
120GB + Hard disk
2GB RAM, Please note than your RAM must be above 1GB for practicing. If your RAM is less than 1GB or 1GB I 'll highly recommend you buy 512MB module extra or 1GB gigs for you.

A Virtual PC Emulator:

A virtual PC emulator is needed since I assumed you don't have multiple PC's to setup your lab, even if you have it I would prefer to advice you to use a Virtual PC Emulator. There are several options to pick from but our pick is “Oracle's Virtual Box”. Reason its open source means free, low on resources, supports all kind of network types, no problem to setup screen options, it automatically setups resolution once you install guest installation and have nearly all that features that a professional virtual

PC emulator may have.

A professional choice is VM-Ware. Though VM-Ware have several advantages over Virtual Box, virtual box is just good to go. Prefer it if you want to shed money.

An Online Synchronization Service:

If you think even that needs shedding money, then I want to assure there's again a free alternative available, its name is Drop Box. Go to www.dropbox.com and create your personal free account then download its setup file and install for synchronization.

A Static IP Address:

Now that will be problem to get a static IP address since a static IP Address may cost you nearly $100 I.e approximately Rs.5000. But don't worry about it we have a free alternative solution to counter problem of static IP. So when there'll be need I 'll clear how to tackle it else even if you have money to shed I will not recommend it.

A PC restore utility:

There are no free alternative to PC Restore Utilities so we will work out on evaluation version. Download Farconics Deep Freeze from following link
http://www.faronics.com/en/DownloadEvaluationEditions.aspx

IP Address Hiding Utility:

Proxy Servers, Anonymizors and VPS are some IP address hiding options. We will discuss them when their need will come in to play.

High Speed Internet Connection:

Of course when you want to learn hacking you need a high speed Internet connection. Opt for a USB dongle by BSNL, TATA, Reliance as mobile broadband and BSNL land-line broadband is just much better option. If you don't have high speed connection and you work on slower connection like GPRS and dial-ups its hard to learn hacks done over Internet.

Procedure:
Before you proceed create a separate partition for installation of Virtual system, the partition must be at least 15GB in size. First of all download latest version of Oracle's Virtual Box and install it on your system. While installation it'll ask several times about installing various components just press OK for all of them because you'll need them all.
I think KUMAR had already made a tutorial on that
The video is :

Once installation is done virtual box will come up with several pop ups when you'll be using it, please read each pop up because they are your tutorials to master “Virtual System Environment”. Please please please, don't skip any of those pop ups. When your installation will be over you'll see virtual system isn't really working in full screen. To tackle it run virtually installed system click on devices and “Install Guest Additions”. From next time it will run in full screen and will add some good features for you :)

Steps Involved In Hacking

2012-04-14T03:57:00.001-07:00

As mentioned earlier ethical hacker takes same steps as malicious hacker. Following are different steps that are performed during hacking.

1.Reconnaissance:
This step involves gathering potential information about target system. In fact hacker spends 90% of time for this phase only and next 10% time for rest of the steps.

2.Scanning:
During this phase network is scanned for vulnerability.

3.Gaining Access:
This is the step where real hacking takes place. Hacker takes advantage of vulnerability found in scanning phase and penetrates the victim system.

4.Maintaining Access:
After gaining access hacker makes provision to come back by planting root-kit and backdoor.

5.Covering Tracks:
In this phase hacker removes all traces of his/her presence in system by removing log files and event logs.

Skills Required For Hacker

2012-04-14T03:35:00.001-07:00

Skills Required For Hacker

As a hacker you must have upper hand skills in Operating systems Windows, Linux and Unix. Once you master Linux and Unix you'll hardly face problem getting yourself on MAC. As we'll move further we will cover both of them in short and then slowly move our level to advanced.

Networking:
A hacker must have expertise in field of networking even if you don't have them you must be knowing about some basic terms used in networking.
OSI Model/Internet Protocol Stack
Network Topology

The reality is that a hacker should know networking to best level. Just knowing above terms is not sufficient though you'll not encounter that much problem while learning. We still recommend you buying a book on networking that should cover networking to level of pin points.

Knowledge About Setting Up And Configuring Servers:
Yes that is necessary for a hacker so when we will move ahead with flow. We will cover configuring IIS 7, Apache, Vertrigo on Windows and Apache on Linux. Both HTTP and FTP servers will be covered.

Programming:
Absolutely no one can deny all best hackers in world have master hand in programming. Following are must know programming languages but you can even make things work even if you don't know them. In any case I would recommend you learn programming.
HTML, C, C++, Java, SQL, Python, Perl, PHP and Ruby.
At most basic level my advise will be you must know HTML, C, SQL, PHP and ruby.

Tools:
Backtrack is platform which is specially crafted and designed for penetration testing. Metasploit is framework that is used to create and experiment with exploits and payloads. Both are must for a hacker today. Alternative to Backtrack is Knoppix Security Edition and Mautrix, if you master Bactrack you'll easily master both of them.

Ethical Hacking An Introduction

2012-04-14T03:20:00.000-07:00

Ethical Hacking An Introduction

Whenever term hacker comes before many people consider it as a guy sitting inside a room or garage with a bottle or beer and a Laptop or Desktop doing wonders on click of buttons. But the reality check is hacking is not that easy as portrayed in movies and television and term hacker doesn't mean a computer criminal.

So here first of all we'll clear all our misconceptions related to words hackers and hacking.

From Where This Word Came:

The word hacking has history in late 1960's, the time when computers were nothing but mighty pieces of machines and a computer just meant a machine that can compute. Electrical and Electronics geeks used to optimize circuits to make any system/circuit work faster, better and reliably. The job they used to do on circuits was known as hack. With time computer geeks also started finding way out to optimize their system to work better so in fact hacking was nothing but always a kind of reverse engineering. With time in professional world a word hacker got meaning, a person who is highly skilled in hardware, software and networking components. Then movies started portraying hackers do only dirty works and hence today the word hacker has a negative face according to people. No matter how the word met to a dreadful end a hacker always had all qualities that was first put forward in its definition may the be criminal or ethical. Criminal hackers are also known as Crackers.

Types Of Hackers:

White Hats: White hat hackers are good guys who use their hacking skills for defensive purposes. Organizations and industries pay them high salaries to protect their systems and networks from intrusion.

Black Hats: Black hats are actually bad guys in filed. Their main job is to breach security and make money. They make money by using their hacking skills for offensive purposes.

Grey Hats: Gray hats are hackers who work for offensive and defensive purposes depending on situations. They are hired by people to intrude and protect systems.

Hactivist: A hacktivist is kinda hacker who thinks hacking can bring out some social changes and hacks government and organizations to show his discomfort over some trivial issues.

Suicide Hackers: Suicide hackers are those who hack for some purpose and even don't bother to suffer long term jail due to their activities. They can be bad as well as good.

Script Kiddie: A script kiddie is a person who boasts breaking system using scripts and codes written by others though he hardly knows what the code does.

Phreak: It is a person who tries to intrude systems for fun or malicious personal activities. Mostly they are children of age 12-15 who don't even know wrong consequences of hacking.

Types Of Hacking:

Local Hacking: This type of hacking is done when a hacker has full access to the system to implant a virus, keylogger and RATs

Remote Hacking: Remote hacking is done on a remote system using Internet.

Social Engineering: Social Engineering is kinda interacting skill that a hacker uses to manipulate people giving out sensitive information. Its kinda trick done using good verbal, social skills and understanding.

Terminologies Used Under Hacking:

Threat: A threat is an environment or situation that could lead to a potential breach of security. Ethical hackers look for and prioritize threats when performing a security analysis.

An Exploit: An exploit is a piece of software that takes advantage of a bug, glitch, or vulnerability, leading to unauthorized access, privilege escalation, or denial of service on a computer system.

Vulnerability: A vulnerability is an existence of a software flaw, logic design, or implementation error that can lead to an unexpected and undesirable event executing bad or damaging instructions to the system. In easy word vulnerability is weakness in system.

Payload: Payload is agent that helps in taking advantage of vulnerability in remote hacking.

Attack: An attack occurs when a system is compromised based on a vulnerability.

Types Of Attack:

1.Operating System Attack

2.Application level Attack

3.Shrink Wrap Code Attack

4.Misconfiguration Attack

Operating system attack is attack done on specific type of OS. Such attack is done using flaws in programs and services shipped with OS. Application level attack is done over faulty coding practices done over software during its development. Shrink Wrap Code attack are attacks done over UN-refined scripts used for making task simpler. Last is misconfiguration attack, it is kinda attack which is done over mis-configured system or a system with default settings.

Work Of An Ethical Hacker:

Job of an ethical hacker is to use all his skills and tools used by malicious hackers to find vulnerabilities in system and then provide it security against those vulnerabilities.

Conclusion: At last what I want to tell, nothing happens in clicks of buttons. A hacker is highly skilled person in field of computing who usually have ample knowledge about software, hardware, OS, networking and programming. A hacker may it be criminal or ethical has immense patience, determination, organization, discipline and persistence. An attacker may spend months of time planning, analyzing and executing an attack. This shows his level of dedication to achieve whatever goal he/she has set. A person can never become a good hacker unless he have all above qualities.

Hacking Email Accounts by using SET

2012-04-13T22:27:00.000-07:00

Hacking Email Accounts by using SET

hey awl :) h0wz yuh <?>_________Well in diz tut m gnna tell uhh awl abt hacking email accounts using SET(Social engineering tool) in Backtrack _______!!!!!

So lets start :D

things require:
1-->Backtrack
2-->Little brain :P

f0ll0w me step by step

!--> firstly open terminal and type cd /pentest/exploits/set and hit enter
after dt type ./set den hit enter________!!!!!!!!

2nd--> After dt open social engineering tool(SET) by selecting option 1

3rd--> Den select option 2 (Website Attack Vectors)

4th--> after dt select 4(Tabnabbing Attack Method)

5th--> after dt select option 2 (“Site Cloner”)

6th--> after dt enter the URL of the site you want to clone. In this case http://www.facebook.com and hit enter. SET will clone up the web site. And then press return to continue.

7th--> den again open new terminal n type ifconfig n note ur ip n den go to goo.gl and den type http://xxx.xxx.xxx.xxx(where xxx.xxx.xxx.xxx is ur ip :D) and shorten ur link

8th--> aftr dt send diz link 2 d victim .When victim open in their browser it should be a message that the page is still loading. so victim start to open another tab. As soon as victim open new tab, our fake website start working. That script will redirect the victim to the phishing page your derivedafter dt u will get d id n pass in ur terminal where u have opened SET

NOTE= Untill d victim login thrugh ur link dnt turn off ur system or net otherwise it will not work :)

If you have any problem den feel free to ask :D n you liked this tutorial then LIKE n SHARE it.THANK YOU

Using w3af to scan the website for vulnerabilities .

2012-04-13T08:10:00.000-07:00

Hey guys ,well moving forward. This post is about w3af .
I get many queries regarding how to hack a website .So first step should be gathering information and second step must be finding vulnerability in that site so that you can exploit that vulnerability to gain access.

FOR EDUCATIONAL PURPOSE ONLY !

If you using BackTrack then it'll be much easier for you cause in BT w3af is already installed so lets get started !

For BackTrack users

Go to Application > BackTrack > Exploitation > Web Exploitation tools => w3af gui .
Click on w3af gui , a window will apear and there is your w3af.

For Windows

You have to install in manually if you using windows .
You can download it from HERE
When download is completed extract it and you'll find the installation file there. Install it

Using w3af

Now its time to use w3af , its pretty easy. When you start w3af you'll see a window like :

There is a Target text field , you have to enter the URL of the target website there . Below that there is a Plugin and Active tabs . After entering the URL of the website , you have to select the Scan type by selecting those plugins . More plugin you select , more will be the time to scan.

Select the Scan type and press the play button above .

Getting the results

When the scan is running or finished , you'll see a window like :

Can you see the lower right corner , there are 3 pointers with some signs and with numbers 2 0 0 . Those are vulnerabilities no. . If you get numbers on 2nd pointer then you'll have a high rate of success.

Now go to Results . There you'll find the result of the scan .
Above window is Exploits window , if you see anything on middle panel then the site is more vulnerable. Now when you have the vulnerabilities , you can exploit that according to your choice .

Guys plz comment and share and like .... thanks
Stay Tuned !!!!

NETWORK TOPOLOGY

2012-04-13T06:05:00.000-07:00

NETWORK TOPOLOGY

hey awl its smarty ujjwal :) well its mah frst post :D. Today i will tell you awl d basics of NETWORK TOPOLOGY.

What is a Network topology?

A network topology is the geometric arrangement of nodes and cable links in a LAN,

There are two types of topology: physical and logical. The physical topology of a network refers to the configuration of cables, computers, and other peripherals. Logical topology is the method used to pass the information between workstations. Issues involving logical topologies are discussed in the section on
protocols

The following section discuss the physical topologies used in networks

Main Types of Physical Topologies

    Linear Bus
    Star
    Star-Wired Ring
    Tree

LINEAR BUS TOPOLOGY

A linear bus topology consists of a main run of cable with a terminator at each end. All nodes (file server, workstations, and peripherals) are connected to the linear cable. Ethernet and LocalTalk networks use a linear bus topology.

Advantages of a Linear Bus Topology

Easy to connect a computer or peripheral to a linear bus.
Requires less cable length than a star topology.

Disadvantages of a Linear Bus Topology

Entire network shuts down if there is a break in the main cable.
Terminators are required at both ends of the backbone cable.
Difficult to identify the problem if the entire network shuts down.
Not meant to be used as a stand-alone solution in a large building.

STAR

A star topology is designed with each node (file server, workstations, and peripherals) connected directly to a central network hub or concentrator.

Data on a star network passes through the hub or concentrator before continuing to its destination. The hub or concentrator manages and controls all functions of the network. It also acts as a repeater for the data flow. This configuration is common with twisted pair cable; however, it can also be used with coaxial cable or fiber optic cable.

The protocols used with star configurations are usually Ethernet or LocalTalk. Token Ring uses a similar topology, called the star-wired ring.

Advantages of a Star Topology

Easy to install and wire.
No disruptions to the network when connecting or removing devices.
Easy to detect faults and to remove parts.

Disadvantages of a Star Topology

Requires more cable length than a linear topology.
If the hub or concentrator fails, nodes attached are disabled.
More expensive than linear bus topologies because of the cost of the concentrators.

Star-Wired Ring

A star-wired ring topology may appear (externally) to be the same as a star topology. Internally, the MAU (multistation access unit) of a star-wired ring contains wiring that allows information to pass from one device to another in a circle or ring . The Token Ring protocol uses a star-wired ring topology.

TREE

A tree topology combines characteristics of linear bus and star topologies. It consists of groups of star-configured workstations connected to a linear bus backbone cable. Tree topologies allow for the expansion of an existing network, and enable schools to configure a network to meet their needs.

Advantages of a Tree Topology

Point-to-point wiring for individual segments.
Supported by several hardware and software venders.

Disadvantages of a Tree Topology

Overall length of each segment is limited by the type of cabling used.
If the backbone line breaks, the entire segment goes down.
More difficult to configure and wire than other topologies.

Computer Networks: Chapter 3

2012-04-11T09:49:00.001-07:00

COMPUTER NETWORKS :CHAPTER 3- Understanding the OSI model

Hello guys, here we are on chapter 3 0f computer networks.Sorry i was
out of town so i coudnt post , anyways in this post i will be
discussing about THE OSI MODEL.
some of you might have heard OSI model.Or you may have heard "this
is a layer 4 function or this layer deals with data packets etc etc".
Anyway its a model and it has layers , each of the layer do things.

m gonna walk you through what OSI model is and wats the concept behind
this and how it is usefull to us in this chapter and next few chapter .

LAYERS

Ok here is the mythical OSI model :

Application

Presentation

Session

Transport

Network

Data link

Physical

(I RECOMMEND YOU TO MEMORIZE THESE LAYERS)

FUNCTION :
suppose you building a house, you just dont get everything and try messing with it.
You have to do it in a ordered way or in phases, and you have specialized people , specialized
equipment to complete it,
in same way OSI model helps us to break down network functions , it helps to understand how network
works.
creates standard for equipment manufacturing.Like in physical layer we deal with hardwares,hubs,
switches,routers,cables.. so manufacturer have to concentrate on physical layer and works according to
standard, dont worry u will understand :)

LAYERS INDIVIDUALLY

Application layer

ok this is the top layer of the OSI model, now this layer is the most familiar layer becoz this is wat you see.
Any application you use which communicate through ur network like browser , e-mail client or COUNTER STRIKE ..these
all application deals with application layer .
AS SOON AS it starts sending data it passes through presentation layer

Presentation layer

Accd. to cbt "presentation layer generi-fies the data", this means it formats ur data such that any server you are communicating
with understands your request.
Also this layer has encryption services, more precisely generic encryption services.
then data get passed to session layer

Session layer

As name suggests , it starts and ends sessions and it keeps sessions separate like you using more than one application which is using your network then which data sud go to which app. this will b decided by session layer

thats all for today, will post tomorrow... and yeah stay tuned some really interesting (practicals) things to come and u gonna enjoy !!!

Computer Networks: chapter 2

2012-04-11T08:14:00.001-07:00

COMPUTER NETWORKS : CHAPTER 2 -basic communication

I hope you read first chapter , well if you already know that than no problem .
we will start chapter 2 and i will be writing about how devices communicate in a LAN and how they communicate to cloud.

BRIEF INFRA OF LAN

Ok now u are in a LAN , then you must see a cable connected to your laptop or PC or watever device is there in your network.Those cables are called Ethernet Cable , and that cable is connected to NIC (network interface card ). NIC is installed in your computer , the port to which cable is connected is a part of NIC .
The cable is then connected to a SWITCH . A switch connect all the devices within your network and then in most cases switch is connected to a ROUTER .A ROUTER connects your network to outside world, which may be INTERNET or to another network.
So this was a brief infra of your LAN.

CLOUD

i have used the term CLOUD. U must have heard this word (not sky clouds LOL).Cloud is a common word by which we refer a very large
network or a very large collection of networks, which is internet.
In cloud there are a hell lot of networks which are interconnected , which are distributed all over the globe.
You can find all the servers in cloud like FTP servers, HTTP servers, SMTP servers, DHCP servers etc.

MEMORY ESSENTIALS

I know all of you know this but just for a quick revision m going through how we memories are defined in computers:
smallest unit is a BIT.
byte=8*bit
kilobyte = 1024*byte
megabyte = 1024*kilobyte
gigabyte = 1024*megabyte
terabyte = 1024*gigabyte

IMP NOTE - Whenever you say your connection speed is some Kbps or some Mbps , means your connection speed is some kilobit per second or some megabit per second
not kilobyte or megabyte .

BANDWIDTH

a rate of data transfer, bit rate or throughput, measured in bits per second (bps)
or u can say this how wide the road is

DELAY

the delay of an IP packet within an IP network
or u can say how fast cars are moving.

So thats all for this chapter . Feel free to ask. Stay connected

P.S- the symbols for router and switch shown are standard symbol . keep them in mind

Computer Networks : chapter 1

2012-04-11T08:09:00.002-07:00

COMPUTER NETWORKS

Hello guys , This is kumar sourav. I m writing my first post and i will be concentrating on computer networks as you gonna need it in long run. I will write these in different chapters , and i will focus mainly on CISCO routers , switches and hubs .

Now we start.There is mainly two types of hacking :

System hacking
Network hacking

For network hacking you gonna need sound knowledge of computer networks.According to wiki A computer network, often simply referred to as a network, is a collection of computers and devices interconnected by communications channels that facilitate communications and allows sharing of resources and information among interconnected devices.

Or as i say this is a collection of devices which can communicate with each other

There are 4 types of networks

Local area network
Metropolitan area network
Wide area network
Wireless networks (both LANs & WANs)

LOCAL AREA NETWORKS : these networks are relatively small networks and is generally implemented in a building .
METROPOLITAN AREA NETWORKS : these are larger networks than LAN . these are generally implemented in a city or in a town.
WIDE AREA NETWORKS : these networks cover a big area , you can say internet is also a WAN.
WIRELESS NETWORKS : these are wireless networks which consists of both LAN & WAN.

M gonna focus on LAN for some days.

as this is my first post , m not gonna make it long so i stop here. But in next chapters onwards m gonna discuss a lot !!!

THANK YOU

Setup LAN in virtual box - BackTrack 5 + Windows 7

2012-03-05T11:39:00.000-08:00

BackTrack 5: How to hack computers using metasploit

2012-03-05T11:35:00.000-08:00

BackTrack 5: How to install BackTrack 5 in virtual box

2012-02-13T11:38:00.000-08:00

How to do Post exploitation with metasploit

2012-02-10T11:44:00.000-08:00

BackTrack 5: How to host Apache server

2012-02-06T11:23:00.000-08:00

Hey guys how you been. Well in this post i will show you how to host webpages using apache server which is pre-intstalled in BackTrack 5.
You can use apache server in many ways. You can host simple websites. You can use that for some hacking experimentation. You can do a lot of stuffs because its really very easy to use. so lets get started.

Video

So that was it . In case of any doubt, feel free to ask.
Hope you enjoyed and its been informative to you. Stay tuned.
Thank you.

How to DoS/DDoS a server with slowloris

2012-02-02T11:42:00.000-08:00

PWNSCAR

2011-11-28T12:49:00.000-08:00