12/20/09 | Learn Ethical Hacking Tools Free Hacking Tricks How To Hack Hacking Passwords & Email Hacking

Saturday, December 26, 2009

How Hackers Manipulate the Live Data Stream on Internet

1. First of all install WebGoat and configure Web browser
2. We will use the tool Achilles. It is a tool designed for testing the security of Web applications. Achilles is a proxy server, which acts as a man-in-themiddle during an HTTP session. For more about Achilles, pls check its official website.
3. Double-click the webgoat.exe icon from the directory containing the WebGoat application.

4. onfigure the LAN setting as shown in the below fig

5. Run the Achilles application & select the options of the application as shown in below fig.

Intercept mode ON

Intercept Client Data

Ignore .jpg/.gif

Select Log to File - Save the data

6. Your Achilles screen should look like the following.

7. Open Internet Explorer and Adjust both screens equally on your desktop as shoen below.

8. Click the Start button on Achilles and notice that the status bar along the lower-left side of Achilles will let you know it is running.

9. In the address bar of Internet Explorer, enter the following address:

http://localhost/WebGoat/attack/

10. Press Enter, and Achilles will list the data flowing through to the Tomcat application. Click the Send button in Achilles. You will be presented with a login screen. For the User Name and Password enter the word guest. click the Send button again.

11. Click the Send button again & WebGoat screen will be displayed in the Web browser.

12. Under the Unvalidated Parameters section, specifically the Hidden Field Tampering area. Click on this area.

13. Click the Send button again.

14. WebGoat will appear with a shopping cart as shown below.

15. Click the Purchase button. Within Achilles you will see the QTY=1 & is Price=4999.99. Now if you want to make a purchase, whose actual cost is 4999.99 but you have only 1.99 in your account, Within Achilles edit the 4999.99 to 1.99 and then click the Send button.

16. EUREKAAAAA....!!! The sale has completed, with a total charge of $1.99.

NOTE: THIS IS ONLY THE DEMONSTRATION OF THIS TECHNIQUE AND FOR EDUCATION PURPOSE ONLY

Tuesday, December 22, 2009

On Thursday, an unknown attacker hijacked Twitter's domain name and redirected visitors to an unrelated site hosting a page claiming Twitter had been hacked by the "Iranian Cyber Army." Evidence indicates, however, that the attackers were able to change the domain-name system (DNS) entries at Twitter's provider, Dyn Inc., said Rod Rasmussen, president and CEO of Internet Identity, an infrastructure security firm which monitors DNS changes.

"First of all the name servers themselves didn't change, so someone was updating things at the provider," Rasmussen said. Because other clients were not showing signs of DNS hijacking, it's unlikely that Dyn itself had been breached, Rasmussen said. "We didn't see anything else at Dyn that indicated signs of that the service had been compromised."

On Friday, Dyn confirmed that the attacker had the proper credentials to log into Twitter's account with the company and change the addressed assigned to various hosts in the Twitter.com domain. While some media reports have called the attack a hack or a defacement against the site, neither term applies, said Kyle York, vice president of sales and marketing for the firm.

"From our point of view, no unauthenticated users logged into the system," York said.
In reality, the company's domain name had been hijacked by the vandals and visitors redirected to an unrelated site hosting the page. Passive domain-name service (DNS) records showed the DNS poisoning, as Twitter's record pointed first to two domains registered in Moldova and then to a domain registered to an undisclosed person in Pompano Beach, Florida, according to information posted by the SANS Internet Storm Center.

Twitter acknowledged the issue late last night, following earlier media reports.
"Twitter’s DNS records were temporarily compromised but have now been fixed," the site administrators' wrote at 11:28 p.m. PT. "We are looking into the underlying cause and will update with more information soon."

Monday, December 21, 2009

A quick review to few top rated hacking posts

ACCESS GRANTED....To hackers on my System ?????

SURVEILLANCE VIA INTERNET CONNECTION

OH NO! MY SYSTEM’S INFECTED

Learning the system loop hole

Top 10 Password Crackers

1. Cain and Abel : The top password recovery tool for Windows
UNIX users often smugly assert that the best free security tools support their platform first, and Windows ports are often an afterthought. They are usually right, but Cain & Abel is a glaring exception. This Windows-only password recovery tool handles an enormous variety of tasks. It can recover passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols

2. John the Ripper : A powerful, flexible, and fast multi-platform password hash cracker
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. It supports several crypt(3) password hash types which are most commonly found on various Unix flavors, as well as Kerberos AFS and Windows NT/2000/XP LM hashes

3. THC Hydra : A Fast network authentication cracker which support many different services
When you need to brute force crack a remote authentication service, Hydra is often the tool of choice. It can perform rapid dictionary attacks against more then 30 protocols, including telnet, ftp, http, https, smb, several databases, and much more
4. Aircrack : The fastest available WEP/WPA cracking tool
Aircrack is a suite of tools for 802.11a/b/g WEP and WPA cracking. It can recover a 40 through 512-bit WEP key once enough encrypted packets have been gathered. It can also attack WPA 1 or 2 networks using advanced cryptographic methods or by brute force. The suite includes airodump (an 802.11 packet capture program), aireplay (an 802.11 packet injection program), aircrack (static WEP and WPA-PSK cracking), and airdecap (decrypts WEP/WPA capture files)
5. L0phtcrack : Windows password auditing and recovery application
L0phtCrack, also known as LC5, attempts to crack Windows passwords from hashes which it can obtain (given proper access) from stand-alone Windows NT/2000 workstations, networked servers, primary domain controllers, or Active Directory. In some cases it can sniff the hashes off the wire. It also has numerous methods of generating password guesses (dictionary, brute force, etc). LC5 was discontinued by Symantec in 2006, but you can still find the LC5 installer floating around. The free trial only lasts 15 days, and Symantec won't sell you a key, so you'll either have to cease using it or find a key generator. Since it is no longer maintained, you are probably better off trying Cain and Abel, John the Ripper, or Ophcrack instead.

6. Airsnort : 802.11 WEP Encryption Cracking Tool
AirSnort is a wireless LAN (WLAN) tool that recovers encryption keys. It was developed by the Shmoo Group and operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered. You may also be interested in the similar Aircrack.

7. SolarWinds : A plethora of network discovery/monitoring/attack tools
SolarWinds has created and sells dozens of special-purpose tools targeted at systems administrators. Security-related tools include many network discovery scanners, an SNMP brute-force cracker, router password decryption, a TCP connection reset program, one of the fastest and easiest router config download/upload applications available and more.

8. Pwdump : A window password recovery tool
Pwdump is able to extract NTLM and LanMan hashes from a Windows target, regardless of whether Syskey is enabled. It is also capable of displaying password histories if they are available. It outputs the data in L0phtcrack-compatible form, and can write to an output file.
9. RainbowCrack : An Innovative Password Hash Cracker
The RainbowCrack tool is a hash cracker that makes use of a large-scale time-memory trade-off. A traditional brute force cracker tries all possible plaintexts one by one, which can be time consuming for complex passwords. RainbowCrack uses a time-memory trade-off to do all the cracking-time computation in advance and store the results in so-called "rainbow tables". It does take a long time to precompute the tables but RainbowCrack can be hundreds of times faster than a brute force cracker once the precomputation is finished.
10 Brutus : A network brute-force authentication cracker
This Windows-only cracker bangs against network services of remote systems trying to guess passwords by using a dictionary and permutations thereof. It supports HTTP, POP3, FTP, SMB, TELNET, IMAP, NTP, and more. No source code is available. UNIX users should take a look at THC Hydra.

Ultra Surf: Bypass firewall and proxies–World’s best bypass technology

what exactly it is?
It is the flagship software product from UltraReach Internet Corp. for Internet anti-censorship. It enables users inside countries with heavy Internet censorship to visit any public web sites in the world safely and freely. it enables users to browse any website freely just the same as using the regular IE browser while it automatically searches the highest speed proxy servers in the background.

What does it means??

100% freedom to have 100% information in most secure way.
It means no matter where you are you can access 100% free version of internet I mean no firewalls no restriction nothing….
Almost all schools, universities and corporate offices raise firewalls to filter out not work related sites, now those firewalls will be of no use or they have to change their plans.
Everybody can access various social networks like Orkut, , , Hi5,, etc. which are blocked almost in 99% schools and offices.
100% real time and it’s encryption is better then any online banking system.

How to get going??
It’s very simple you have to just-

download an exe file
then extract it
and run
Set proxy if u have any (generally in offices internet are provided through proxies, you can find that, through tools>>internet options>>Connections>>LAN Settings>> there you are with proxy server for your LAN and it’s port
Just copy that to proxy settings of Ultrasurf.
Then a window will pop up, says some thing in Chinese, just close this window
And open fresh internet explorer
There you are, you can surf any information.
For office people: beware don’t spread words to your colleagues keep this info as limited as you can, coz if system people got to know about it then they’ll take your comp for scrutinizing.

Useful tips:

When u download fresh version u need to tweak proxy settings of Ultra Surf. do that manually, also sometimes proxy setting of Ultra Surf get vanished automatically.. do check for proxy setting and feed it manually. For any kind of browser Proxy IP address is 127.0.0.1 with port :9666 and For Ultra Surf it depends upon your network.

Sunday, December 20, 2009

Detect Operating System of Target: Xprobe2

Countermeasures: IDS to detect UDP to port 32132, deny ICMP requests/reply.

Description: The Xprobe2 application is used to identify the possible operating system (OS) of the target. An attacker uses this information to launch appropriate attacks for the results obtained. Remember that

all commands in Linux are case sensitive.

Procedure: Uncompress, compile, create the Xprobe2 executable and execute against the target with the syntax of:

Xprobe2 options Target IP ADDRESS
From the Linux directory containing the type Xprobe compressed file, type tar –zxvf xprobe2-0.3.tar.gz
The Xprobe files will uncompress and install into a new directory named xprobe2-0.3
Change to the new directory by typing cd xprobe2-0.3 and pressing Enter
The Xprobe application needs to be configured for the machine it is currently running on by typing i ./configure

The files will configure for the machine they are currently on. Be patient as this may take a few minutes depending on the computer. The next step is to type make and press Enter.

The make command will execute. The last step prior to execution is to install the Xprobe application by typing: make install

The Xprobe application will now install. To execute Xprobe against a target, type: xprobe2 172.16.1.40. The results of the Xprobe application will be listed.

From the results of this example:

The primary guess is the target is running Microsoft Windows XP

The other guesses include:

Microsoft Windows 2000 Server Service Pack 4

Microsoft Windows 2000 Server Service Pack 3

Microsoft Windows 2000 Server Service Pack 2

Microsoft Windows 2000 Server Service Pack 1

Microsoft Windows XP SP1

Microsoft Windows 2000 Workstation Service Pack 4

In this example, the primary guess of Xprobe2 was incorrect as the target was actually Microsoft Windows 2000 Server with no updates or service packs installed. Even though Xprobe2 misidentified the target, it is possible that Xprobe has identified the host computer, which in this case is Microsoft Windows XP. Even so, Xprobe2 did identify that the target was Microsoft Windows in origin.

Share This Post With Your Friends