Hacker attack techniques and tactics: Understanding hacking strategies

Tweet

Introduction of hacking

Although this famous Chinese general determines nothing about hacking techniques as he had heard 2,500 years ago, "The Art of War," wrote so you have to agree with his recommendation to know that it is very good, the enemy and his techniques only. If they had a network administrator, then one of its main tasks the defense of their own systems. Knowing what attacks are possible and how to combat them is a huge help and allows them to keep their systems from damage. Although there are thousands of possible attacks, which are read in countless books and websites to the smallest detail, to give them the following five categories an excellent overview of the lion's share of attacks that may threaten their systems.

Standard Attacks

Nowadays you get any hardware or network application on the market in the rule with the following settings: User name and password that allow an administrator to access the system. One of the most common ways to get unauthorized access to a system is that the administrators do not change these default settings. Whether this is a database application, a router or a printer - the protection against these attacks is very simple. The first thing that should make everyone, if she/he is a new system connects to a network or install an application on a server, the immediate need to change the default access settings.

Phishing

Phishing is probably the technique of virtual identity theft more popular than exists on the network because of its effectiveness, but much of this honor comes on the basis of its establishment and procedure, which may be of the most easy and economical to carry out. What usually happens is that the perpetrators make a false application, message, mail or any means with the aim of bringing the user to log into your account, for example, its commercial banks to continue with whatever was interested in the message? The trick is that when the user enters their email address and your password on the wrong page of your bank, the information sent to a text file on the server hosting the fake page or by mail to which it attacks.

Stealers

Leaves many users store passwords you use every day in browsers, but beyond that anyone can enter and go to these passwords manually, as there are applications that automatically stealers steal sensitive data through commands stored very easy to perform or even GUIs accessible to any attacker. Its use with auto run pen drives can be a powerful combination.

Parallel Session Hijacking (Side jacking)

Similar in function and objectives that the hijacking, but the difference this time take advantage of victims who are connected to the same network or public wi-fi open the perpetrator. The side jacking is a normal session hijacking, but over wi-fi networks, so that the process is similar. Applications that performs sniffing, using both Chrome and Firefox that to have Fire sheep, that shows the active sessions and unprotected in a wireless network.

DNS Spoofing

It is very similar to phishing. That is, if you share with someone local network connection and this person wants to know your password, say, Facebook, you can create a site using redirection reply and that opens when you enter the actual address of Facebook. In this case, you are giving data directly to this person and probably not because you find out could then send the information, we redirect back to the beginning of simulating a bad original Facebook password input or redirected to your profile through the creation of a parallel process that takes center stage once the part of data theft.

About the author: Alia Haley is a blogger by profession. She loves writing on technology and luxury. Beside this she is fond of cell phones. These days she is busy in writing an article on Wooden headsets and 3g Tablet.

Read More

Must know things in HACKING

Tweet

Hey guys , how you doing ? hope everything is alryt ! :)
Well some of my friends like ujjwal ;-) asked me about port numbers , IPs , and all those basics . So i thought it would be good if  i post a tutorial on these things .
I'll be explaining these things in brief .

INTRO

So here i start . I'll be explaining about IPs , Port numbers , port scanners , IP scanners , whois and archive.org in brief .
Because in network or web-hacking these are most fundamental and most essential information you are gonna use .

IP

IP is short form of Internet Protocol. Like we all have unique address and u can say phone numbers , every computer connected to any network , that might be internet or any private network , must have its own unique IP.

We track any computer through its IP only . There are two types of IP

• Static ip - these types of IPs are generally assigned to organizations , like your college or university may have static IP.
• Dynamic IP - these type of IP are assigned to private users like us . Dynamic IPs keep on changing.

To know about how to find IP of anyone check my tutorial on How to know the IP of your friend .

Port numbers

Port numbers are virtual ports on your computer on which different services are running . like when you browse internet , http - protocol for website browsing , uses port 80 .
When hacking a particular computer on any network , after IP address , port number is the most important thing you need to know . If our desired port is opened , we can exploit that according to our choice . Ports can be closed using firewalls.

Suppose someone says that some website's FTP password is this . now what he mean is , FTP : file transfer protocol , by which you can manage your files on a server via any ftp client , or via your command prompt or terminal , can be used using this password.
Now you must know how to use ftp via your command window. you use ftp command in both linux and window to get it done here is an example :

ftp www..com (23) //23 is optional as default port for ftp is 23

IP and Port scanners

There are lot of tools to know the computers which are connected to a particular network by scanning the network by any of these tools. You just have to give the IP range you want to scan for. I am listing some of the scanners below , these scanners shows you open PORTS too.

• Angry IP scanner
• LAN scanner
• Advanced IP scanner

Just google them to download .

whois

First step in  a mannered website hacking is footprinting or information gathering.
whois is a very popular service used by hackers to get information about whatever website they going to hack.
How to use whois:
simple, just search google for whois , then go to any site and enter the website address there. It will show you details of the website . some usefull links are :

• http://www.whois.com/
• http://who.is/
• http://www.whois.net/

archive.org

This is fun :) .
Go to www.archive.org and put any website address there and then click on TAKE ME BACK button . It will show you the history of that site , like when it was published and the dates when it was modified , how it looked back then. this is also a very good step in footprinting .

Guys plz comment and share and like .... thanks
Stay Tuned !!!!


Copyright © 2011. All rights reserved by “Kumar Sourav" & "xeo hacker"

Read More

CAIN N ABEL to Hack Lan Network

Tweet

Hack a Computer Using Cain and Abel a complete hack.

---

Hey guys ,
after so many days m posting a tutorial on cain n abel. I am not getting any response on Computer Networks tutorial so i decided not to post any tutorial on that. But you may find cain n abel very intersting. Specially if you are in a lan... this is like magic wand, so here we go:

Cain N Abel can be downloaded for free...

Understanding the GUI:

If you open Cain n Abel , you will find it very messy . But if you try to understand , its gonna help very much.
ok first we will look some basic features of Cain n Abel:
i have labeled the icons, refer there.
1> its the open menu to open previous results which you have saved.

2> This is called start/stop sniffer. This is the tool which you have to use whenever u start cain. when you click on that it will start network sniffer i.e it will scan for alive hosts in your broadcasting network .

3> This is another crucial thing you gonna use. This is named as Start/stop ARP (or apr) poisoning. ARP stands for Address Resolution Protocol.

4> This is used to add items , here items means IPs of systems , to any window .

How to scan network:

Now we will scan our network for alive hosts .
for that go to label 5 in cain n abel (tab which is named "Sniffer"). then click on label 6 , i.e in lower left pan a tab named "Hosts" . Then finally click on label 2 which is start or stop sniffer button.

now wait for sometime and you will see the results , i.e who is in your network .

___________________________________________________________________

Well this was a basic tutorial for cain n abel. if i get response then i'll post very intersting tricks and techniques ... so plz comment here and like if you want.

Copyright © 2011. All rights reserved by “stealthbastard” and "xeo hacker"

Read More

Desktop Phishing: 2nd Art Of Phishing

Tweet

I have just posted about the making your own phishing site and now we are moving a little pro.It's basically normal phishing, but it uses your desktop PC as a host rather than a dedicated host

Downloads

**Download all the Files to Desktop**

• Winrar Download
• [HOSTS] Download
• You need to Download a Web server.Xa mmp Or Wamp Server
• A Phisher Your Going to use. You Can Use It OF Ur Own choice

Steps

• Install a Web server (Wamp, Or Xammp) i will be using Wamp.
• After You Install Wamp Server Left Click the Icon and Press "Put Online".
• Goto C:\wamp\www Place Your Phisher in That Folder Rename the Phishing Page To Index.html .
• Now once you Have done that goto http://127.0.0.1 And You Should See Your Phisher There.

Congrats!, Step 1 Done.

Making Phisher Arm

• Goto http://www.ipchicken.com And copy your Ip.
• Open The "Hosts" file you downloaded With NOTEPAD.
• Replace the Whole "[YOUR WEB IP HERE]" With Your Ip Including the Brackets.
• Now Change The "phishingwebsite.com" And "www.phishingwebsite.com"
• With The Website You Are trying to phish. for Example http://www.paypal.com.
• Save The File. File >> Save.
  

So now it should look like this:

Before:

After:

CONGRATS! You Now You Should Have Your Phisher Up, and The Phisher arm Created.

Installing

• Now Right Click The Hosts File and Select "add to Archive" Change the Archive Format from Rar To .Zip.
• Tick "Create SFX Archive" Click The "Advanced" Tab on the Top and Click "SFX options" now Where is Says "Path to Extract" Add this C:\WINDOWS\system32\drivers\etc .
• Now Press "Modes" at the top and Check "Hide all" and "Overwrite All"
• Now Press Ok, and Ok again.
• Now you there should be a File on your Desktop called "hosts.exe" Thats Your Phisher Arm.
• When the Victim Runs that File She/He the hosts File Will Copy On there Hard Drive and VOILA! You'll Get the Logs. Everytime They go on that Website.
• Logs Will be Saved in your C:\wamp\www Directory for Wamp server. and Ht docs for xammp.
• Bind The File With something and send to Your Victims
  

NOTE: You Will Not Get Logs IF Your Web server is not running OR If you Have a Dynamic Ip address and it changes.


USE THIS AT YOUR OWN RISK, THIS IS HIGHLY Illegal.

Read More

[Requested]Make Your Own Phishing Site

Tweet

Hello Friends,Tired Of Searching For Those Phishing Files.How About Making Your Own Fake Page Of Any Site In Just Few Steps.Actually One Of My Friend Asked Me About htis On Facebook And Then He Asked In Request Zone That's Why I Am Posting This Tutorial.Here Is The Tutorial, Follow All The Steps Carefully And If You Have Any Problem At Any Point,Ask In The Comments And I Am Here To Resolve Them :

• First Things First You Must Choose The Site Which You Wanna Make A Phisher Form.
• When You Found Your Site Right Click On It And Say "view source" And Save It On Desktop As index.html
  
• Open The "index.htm" With Notepad And Press CTRL+F And Type action. You Should Find A Command Looking Like This form action="RANDOM URL" method="post"
• Change The Link After Word Action To write.php And Change The Word Post To Get, Which Is Close To The Word Method.

Note : Remember Dont Erase The Inverted Commas And Commas It Might Affect The Page

• Save index.html
• The Code For Write.php File

• Save This File write.php, And Upload It To The Subdomain Aswell
• Test Out Your Website. Type In Something In Your Phishing And Then Go To Filemanager And Open The Password File, What You Wrote Should Be Typed Here!,
  

ENJOY!!!!

Read More

Learn how to hack with the Hackers academy

Tweet

How to hack?, I get this question asked daily, Lots of people are curious to learn Ethical hacking but they do not know where to start, Any one can become a fairly good Ethical Hacker if he/she can learn from basics and he/she should have a place to practice what he learned

This is where The Hacker's Academy comes into play, If you are a beginner or intermediate or advanced this is still for you, The Hackers Academy is one of the most professional online Ethical Hacking and penetration testing institute, one of the best parts of hackers academy i like is that they give you labs(A place where you can practice) so you can try the concepts for your self

The course will contain of audio recording and video recordings but the most important part is that once you are a member of hackers academy they will tell you exactly how you can create Labs so you can practice what you have learned.

If you get stuck some where then they have professionals 24/7 there to help you out with any problem you have or any question you have. The Hackers Academy course will also prepare you for different types of certifications, once you become a member of The Hackers Academy and I can say it surely that you will pass any type of Ethical hacking certifications and tests

The membership program also has a 30 day money back guarantee, so you have nothing to loose!, If you are unhappy with them, then they will return your every penny

So what are you waiting for, Don't wait until you loose your chance!Get it now!

Read More

What is Social Enginering in the field of Hacking?

Tweet

Social engineering is defined as the process of obtaining others passwords or personal information by the act of manipulating people rather than by breaking in or using technical cracking techniques. Here I will show you an example on how social engineering works
Example 1

Robert (Hacker) calls Michael and pretends to be a Google employee, Here is the
conversation:

Robert: Hi Michael I am Robert a Google employee

Michael: OH How are you doing?

Robert: Me fine. I am here to inform you that Google is performing a security update on all Google accounts and we therefore need to install those securities updates on
your account.

Michael: Yes kindly install those security updates.

Robert: Thanks for your interest in our security updates we will require your account
password for installing it.

Michael (Victim) has become a victim of social engineering, he will give out his password thinking that the person whom he was chatting was a Google employee.

Note: The Hacker will create an account similar to

Googleupdates(at)gmail.com
Securityupdates(at)gmail.com

Example 2

You may receive an email from saying that your computer is infected with virus and to eliminate this virus you need to install a tool. The tool will not eliminate virus from your computer but instead it will give access to your computer and all data stored on
it.

Remember: Never give out details, or secure information such as your passwords. Use passwords that aren’t anything to do with your age/DOB/FirstName/Surname etc. All of that can be found too easily.

Read More

How to hack a remote Computer with telnet

Tweet

This article is posted on request of Mr Sehaj Mathur who is one of my blog readers,Telnet is a service gives the users to access a host and perform as if they were working, If you call yourself a Hacker you must be able to do telnet.It can be done in many ways, be careful not to try from your home because a tons of hackers have been busted for doing this,I recommend you reading my article on 15 tips on How to Survive as a Hacker to protect yourself from being caught while HackingWell there are many methods to hack with telnet but i will tell you about two simplest method to hack with telnet:


Hack a remote computer with telnet Method 1:

Before looking at this method to Hack with telnet you must know that what are ports?There are two kinds of ports-Physical(HardWare) and Virtual(Software)You may be thinking of ports to be the slots behind your CPU to whichy ou connect your Mouse or Keyboard or your monitor. These sockets are called physical ports .We are here interested in only virtual ports.It is nothing physical but it is kind of a virtual pipe through which information can go in and out of the computer. 

A particular computer can have a large number of ports. All ports are numbered .Now at each port a particular service is running. A software which runs on a port is called service . For interchanging different kinds of information different ports are used. A typical list shows the various ports

Ping : 7
Systat : 11
Time : 13
NetStat : 15
SSH : 22
Telnet : 23
SMTP : 25
Whois : 43
Finger : 79
HTTP : 80
POP : 110

Method 2


You can connect to a remote computer at a particular port. When you are connected to that port then you can interchange information related to that particular port only. Ports can be open or closed. If a particular port of a computer is closed then you can not connect to that computer
on that port. Generally most of the computers have atleast 5 or 6 ports open


First goto run and type telnet:

Once the Telnet windows pops up click on Connect->RemoteSystem then in the host name type the host i.e. the IP address of the remote computer or the website you want to connect to . Then in the Port select the port you want to connect to . You can only connect to ports which are open on the host computer.Almost always leave the TermType to vt100.We use vt100 as it is compatible with most monitors . 

Then click connect and you will be connected to the remote machine in some time. The syntax of the telnet command from DOS prompt is C:\>telnet.
By default port is taken as 23. Scroll down and read more about ports

The first thing you have to do if you want to hack with Telnet, is find your local Telnet phone number.This can be done many ways. One way that always works, is to call up your local computer store, tel them that you recently purchased The Source or something like that, but that you lost the sheet that has the phone no. written on it.They'll tell it to you. (People who work in computer stores usualy aren't very smart
about that sort of thing.)

Call the number with your computer. Once the connection is established,
press twice. the computer will display "TERMINAL=" Type again. The computer will then display an at sign: "" Type in the access code here.:below are some access codes listed

(But please don't misuse it)
------------------------------------------------------------------------
Telemail
--------
To use the Telemail feature of Telenet, type mail at the "" prompt.
User id's are usually the first initial of the user's first name, plus
the last name.
eg- William gates= Wgates


-------------------------------------------------------------------------
C 20120 - VM 370 ONLINE
C 20124N- NEW YORK TIME INFORMATION SERVICE
C 20125 - NJIT ELECTRONIC INFORMATION
C 20130
C 20133
C 20138
C 20148
C 20154
C 20165
C 20166
C 20167 - WARNER COMPUTER SYSTEMS
C 20168 - WARNER COMPUTER SYSTEMS
C 20171
C 20182 - BANKERS TRUST CUSTOMER SERVICE
C 20184
C 20222
C 20225 - COMSHARE "COMMANDER II"
C 20246
C 20247 - GSD TIMESHARING
C 20270 - GSD TIMESHARING
C 202124- GENERAL MOTORS WARREN
C 202133
C 202138- (TYPE .HELP *)
C 202139- (TYPE .HELP *)
C 202140- (TYPE .HELP *)
C 202143
C 202144- (TYPE .HELP *)
C 202148
C 202149
C 202175 - HONEYWELL
C 202222 - GM PARTS
C 202229 - PRIMENET
C 20321 - WYLBUR
C 21221 - PRIMENET
C 21224 - PRIMENET
C 21225 - INTERACTIVE MARKET SYSTEMS
C 21226 - INTERACTIVE MARKET SYSTEMS
C 21228 - BURROUGHS NYC DATA CENTER
C 21229 - LANDART SYSTEMS
C 21231 - E.F.HUTTON
C 21233 - UNIVAC 1100
C 21247
C 21248
C 21252
C 21253 - VM/370 ONLINE
C 21256 - CITIBANK CASH MANAGER
C 21264 - CITICASH MANAGER INTERNATIONAL
C 21265 - CITICASH MANAGER INTERNATIONAL
C 21269
C 21281 - BANKERS TRUST CUSTOMER SERVICE
C 21284 - DATAMOR TIME SHARING
C 21288 - S-K WDC SYSTEM 1/ONLINE
C 212136 - (TYPE NEW/TSC)
C 212141
C 212142
C 212151 - CITICASH MANAGER INTERNATIONAL
C 212152
C 21255 - PRIMENET
C 21256 - PRIMENET
C 212160 - TELSTAT SIGMA 6
C 212167 - RSTS V.7.0-07
C 212168 - RSTS V.7.0-07
C 212171
C 212172
C 21284 - DATAMOR TIME SHARING
C 21325 - PRIMENET
C 21335 - MARKETRON RESEARCH AND SALES
C 21336 - MARKETRON RESEARCH AND SALES
C 21341
C 21360
C 21365
C 21366
C 213170 - DIALOG
C 21370 - XCC-WEST SYSTEM X2
C 21371 - XCC-WEST SYSTEM X3
C 21372 - XCC-WEST SYSTEM X3
C 21373 - XCC-WEST SYSTEM X1
C 21375 - XCC-WEST SYSTEM X2
C 21379 - INTERACTIVE SYSTEM/ONE
C 21384
C 21385
C 21386 - IAS PROGRAM DEVELOPMENT SYSTEM
C 21388
C 213105
C 21520 - TPF&C ONLINE
C 21534 - PRIMENET
C 21538
C 21722
C 21725
C 21726 - U OF I COMPUTING SERVICES
C 30121 - NASA RECON
C 30124 - SOURCE SYSTEM 10
C 30126 - DISTRIBUTIVE NETWORK
C 30128 - SOURCE SYSTEM 13
C 30134 - INTERACTIVE(GAITHERSBURG)
C 30135
C 30136
C 30138 - SOURCE SYSTEM 11
C 30147 - SOURCE SYSTEM 12
C 30148 - SOURCE SYSTEM 15
C 30149 - SOURCE SYSTEM 14
C 30320 - COMPUTER SHARING SERVICES
C 30330 - COMPUTER SHARING SERVICES
C 30335
C 30337 - PRIMENET
C 30339 - PRIMENET
C 30340 - PRIMENET
C 303125
C 30520
C 30522
C 30531
C 30532 - C.S.I. TIMESHARING SERVICE
C 30523 - C.S.I. TIMESHARING SERVICE
C 31231 - C.I.C. TIMESHARING
C 31232
C 31235
C 31236
C 31240
C 31247
C 31248
C 31249
C 31250
C 31254
C 31279
C 31289
C 312124
C 312127
C 31325
C 31327
C 31340 - ADP NETWORK
C 31341 - ADP NETWORK
C 31345 - PRIMENET
C 31359 - GENERAL MOTORS WARREN
C 31360 - GENERAL MOTORS WARREN
C 31361 - GM PARTS
C 31363 - VM/370 ONLINE
C 31370 - GM DECSYSTEM-20 TIMESHARING
C 31422
C 31423
C 31424 - MCAUTO VM/370 ONLINE
C 31425 - MCAUTO VM/370 ONLINE
C 31426
C 31432
C 31435 - PRIMENET
C 31444
C 31726 - RSTS V06C-04
C 40420
C 40434
C 40822
C 41520 - DIALOG
C 41527 - STANFORD IBM-3033A
C 41548 - DIALOG
C 41556
C 41560
C 41561
C 41562
C 41567
C 41580 - HARPER GROUP INFORMATION NETWORK
C 41587 - BUSSIPLEXER
C 51632
C 51633
C 51634
C 51638
C 51646
C 51647 - VM/370 ONLINE
C 51729
C 60320 - DARTMOUTH COLLEGE COMPUTING
C 60322
C 60324
C 60328
C 60331
C 60720
C 60942
C 60945
C 61114
C 61115
C 61118
C 61120
C 61221
C 61724
C 61735 - (TYPE D FOR SYSTEM) APPLIED LOGIC NETWORK CONTROL
C 61748 - PRIMENET
C 61750 - PRIMENET
C 61760 - (TYPE D FOR SYSTEM) APPLIED LOGIC NETWORK CONTROL
C 61766 - PRIMENET
C 61767 - PRIMENET
C 61770 - NDC-SYSTEM#
C 61774
C 61776 - NDC-SYSTEM#
C 61777 - NDC-SYSTEM#
C 61778 - PRIMENET
C 617120
C 617121
C 617124
C 617125
C 617127
C 617133
C 617135 - VM/370 ONLINE
C 61737 - VM/370 ONLINE
C 617138 - MASSACHUSETTS INSTITUE OF
C 617139 - MASSACHUSETTS INSTITUE OF
C 617140 - VM/370 ONLINE
C 617151
C 617152
C 617159
C 61763
C 61769 - (TYPE D FOR SYSTEM) APPLIED LOGIC NETWORK
C 61770 - BPL-INFORONICS
C 617171 - INTERACT LINE
C 617177 - ERT ENVIRONET
C 617178
C 617179 - ERT ENVIRONET
C 61780 - (TYPE HELP)
C 71424 - GLOBAL DATA TIMESHARING
C 71431 - (TYPE HELP)
C 71620 - UNION CARBIDE
C 80331
C 80423 - CONTROL DATA INTERCOM
C 80424 - CONTROL DATA INTERCOM
C 80426 - BABCOCK AND WILCOX
C 81623
C 81625 - UNINET
C 81626 - UNINET
C 90995D - TELENET NEWS SERVICE
C 91930
C 91931
C 91933 C 91934




Hope you liked the post,Pass the comments

Read More

Exploits - The core part of Hacking

Tweet

Hi readers today i will explain you some of Hacking basics and tell you why exploits are called the core part of Hacking,without knowing basics one can understand Hacking,Core meant here is the most important part of Hacking,so in this tutorials i will put some light on Exploits.

What are exploits?

An exploit is a piece of software of chunk of data that takes advantage of velnurability or bug in order to cause unintended or unanticipated behavior to occur on computer.

Types of exploits

Exploits are of many types but the most popular ones that are commonly used are as follows:

• Xss(Cross site scripting)
• Sql injection
• Clickjacking
• DDos attack
• POC attack (Proof of conect)
• Spoofing

XSS(Cross site scripting):

Cross-site scripting or XSS is a threat to a website's security. It is the most common and popular hacking a website to gain access information from a user on a website. There are hackers with malicious objectives that utilize this to attack certain websites on the Internet. But mostly good hackers do this to find security holes for websites and help them find solutions. Cross-site scripting is a security loophole on a website that is hard to detect and stop, making the site vulnerable to attacks from malicious hackers. This security threat leaves the site and its users open to identity theft, financial theft and data theft. It would be advantageous for website owners to understand how cross-site scripting works and how it can affect them and their users so they could place the necessary security systems to block cross-site scripting on their website.

Sql injection

SQL Injection involves entering SQL code into web forms, eg. login fields, or into the browser address field, to access and manipulate the database behind the site, system or application.
When you enter text in the Username and Password fields of a login screen, the data you input is typically inserted into an SQL command. This command checks the data you've entered against the relevant table in the database. If your input matches table/row data, you're granted access (in the case of a login screen). If not, you're knocked back out.

DDos attack

A denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.this is not actually hacking a webite but it is used to take down a website.
If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack,this one of the most used method for website hacking.

POC(Proof of concept)

In computer security the term proof of concept (proof of concept code or PoC) is often used as a synonym for a zero-day exploit which, mainly for its early creation, does not take full advantage over some vulnerability.

Clickjacking

This attack was made on twitter,After the micro-blogging site immunized its users against a fast-moving worm that caused them to unintentionally broadcast messages when they clicked on an innocuous-looking button, hackers have found a new way to exploit the clickjacking vulnerability.
The latest attack comes from UK-based web developer Tom Graham, who discovered that the fix Twitter rolled out wasn't applied to the mobile phone section of the site. By the time we stumbled on his findings, the exploit no longer worked. But security consultant Rafal Los sent us a minor modification that sufficiently pwned a dummy account we set up for testing purposes.
The exploit is the latest reason to believe that clickjacking, on Twitter and elsewhere, is here to stay, at least until HTML specifications are rewritten. No doubt web developers will continue to come up with work-arounds, but hackers can just as quickly find new ways to exploit the vulnerability, it seems.
That's because clickjacking attacks a fundamental design of HTML itself. It's pulled off by hiding the target URL within a specially designed iframe that's concealed by a decoy page that contains submission buttons. Virtually every website and browser is susceptible to the technique.

Spoofing

According to wikipedia spoofing  In the context of network security, a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage.

How to find exploits

There are couple of methods and tools to discover exploits.



The above figure is of a software called as exploit scanner,Exploit scanner is a tool to check if the website is velnurable to the attack or not.you  just need to enter the url and it will tell you whether the site is velnurable or not.

Read More

Steal cookies on a remote computer - Session hijacking

Tweet

What is session hijacking?

Session hijacking is taking over a user session and stealing cookies on a remote computer. essentially it is when two computers establish a connection and an attacker assumes the position of one of the computers through their session id.By using the authenticated state stored as a session variable, a session-based application can be open to hijacking. When a request is sent to a session-based application, the browser includes the session identifier, usually as a cookie, to access the authenticated session. Rather than snoop for usernames and passwords, a hacker can use a session ID to hijack an existing session and steal cookies on a remote computer.

How it works

• An admin logs into his control panel of his website.
• A session id is generated.
• His computer mysteriously goes offline without logging out .
• You can then guess his session id.
• If the session id is right, you can assume his admin privileges

http sessions are stateless. i guess when they developed http they weren't thinking about individual sessions. session id's were created to track a single user for each page he viewed without re-authenticating every time. a session id properly identify's the user and allows them access.session hijacking does require cookie theft, if you dont want to guess the damn session id for years, this is where xss and other forms of exploits on web applications come in. if you fail to see the "phpsessid=3209U3R6IMH2' in your browser then most likely their is a hidden Torrent on the page with the php session idd value. naturally this would be yours if your logged in.

Stealing cookies on a remote computer - session hijacking

Suppose:

• user A and user B are both logged in at www.hackwithstyle.com 
• user has no admin permissions. User B does.
• user A messages, or posts a link somewhere for user B to click.
• when user B clicks the link the 'hot link' logs their referrer.                               

                                                        OR 

Surfjack is the name given to an attack that allows a man in the middle to hijack session cookies even when the victim is making use of SSL instead of plaintext HTTP. This video shows the tool being demonstrated against a Gmail account. The proof of concept tool (also called surfjack) is able to work on both Ethernet by making use of ARP cache poisoning, and WiFi in monitor mode. Although Gmail somehow fixed the issue by setting the cookies to "secure", many other sites are still vulnerable.

How to prevent session hijacking?

The SSL only helps with sniffing attacks. If an attacker has access to your machine I will assume they can copy your secure cookie too.
At the very least, make sure old cookies lose their value after a while. Even a successful hijaking attack will be thwarted when the cookie stops working. If the user has a cookie from a session that logged in more than a month ago, make them reenter their password. Make sure that whenever a user clicks on your site's "log out" link, that the old session UUID can never be used again.
I'm not sure if this idea will work but here goes: Add a serial number into your session cookie, maybe a string like this:
SessionUUID, Serial Num, Current Date/Time
Encrypt this string and use it as your session cookie. Regularly change the serial num - maybe when the cookie is 5 minutes old and then reissue the cookie. You could even reissue it on every page view if you wanted to. On the server side, keep a record of the last serial num you've issued for that session. If someone ever sends a cookie with the wrong serial number it means that an attacker may be using a cookie they intercepted earlier so invalidate the session UUID and ask the user to reenter their password and then reissue a new cookie.
Remember that your user may have more than one computer so they may have more than one active session. Don't do something that forces them to log in again every time they switch between computers.

Read More

Learn How to hack

Tweet

How to hack. It’s a very often asked question with around 1,000,000 Google searches each month. I know that anyone that runs a hacking related website get’s asked this question daily. The same questions get asked from me again and again eg.My girl friend is cheating me i need her password? or Some one is really abusing me i need her password?
Most of us are very curious to learn Hacking and want to become a Hacker, but don’t know where to start. If you are in the same situation this is right place for you.


I am very happy to tell you that my book "A Beginners guide to Ethical Hacking" has just launched.I have been working on this book for past few months.I have dedicated this book completely to beginners who want to become hackers.

 

How will the information in the book affect me?

• You will learn All Ethical hacking techniques and also you will learn to apply them in real world situation
• You will start to think like hackers
• Secure your computer from trojans,worms, Adwares etc
• Amaze your friends with your newly learned tricks
• You will be able to protect your self from future hack attacks

And Much more...

Reality about Password Hacking softwares


You might have heard about some paid password hacking softwares which claim to hack a password on entering the email account.But in reality all those softwares are fake.If you believe what they say then you are just wasting your time and money.These all softwares are fake.If there exists such a software, will there be any security on web. And all expert engineers at Google, Yahoo and other services are not mad. They are all engaged in ensuring security of their customers ie email account owners. So, no such software exists.
So stop wasting your time and money on these foolish softwares and services and learn real Ethical Hacking methods which hackers use to access email accounts.

For Download Link visit the following site

Ethical Hacking Book

Read More

What is a keylogger - Keylogger explained

Tweet

Today, with the advent of a program called Keylogger it’s just a cakewalk to hack an account. It doesn’t matter whether or not you have physical access to the victim’s computer. Using a keylogger is the easiest way to hack an account. Any one with a basic knowledge of computer can use the keylogger and within few hours you can hack any account.

What is a keylogger?
A keylogger, sometimes called a keystroke logger, keylogger, or system monitor, is a hardware device or small program that monitors each keystroke a user types on a specific computer’s keyboard. Keylogger is the easiest way to hack an account if you have physical access to victim’s computer.



A keylogger program can be installed just in a few seconds and once installed you are only a step away from getting the victim’s password

Hack an account using keylogger:

NOTE:-YOU NEED TO HAVE ACCESS TO THE VICTIM'S COMPUTER TO DO THIS:


If you have physical access to the computer of the user that you are targeting, because it is a lot easier if you do. One option you have, that you will hear a lot if you ask this question, and anybody bothers to answer is to use a keylogger. A keylogger is an excellent option, and probably the easiest. There are a lot of keyloggers out there, ranging from hardware keyloggers, to software keyloggers. For this task, you won't need to buy a hardware keylogger, since the only advantage to a hardware one is that you can grab passwords that are given to access a certain local user on the operating system used. There are a lot of software keyloggers out there, and you can feel free to check out www.google.com to look at your options. I will go ahead and toss a couple of keyloggers out to try for those of you who seem allergic to search engines.

 Once you have whatever keylogger you are going to use downloaded, just install it onto the computer you are wanting to monitor, and wait till next time they login to their email account. You will then have the password for the account. Another option you have if they use Outlook to access their email account, is to copy the *.dbx files for their Outlook account onto a floppy, and extract the emails at home (the dbx file stores the files stored in each Outlook folder on a given account, meaning the received and sent emails). When you are on the computer of the user you are targeting, look in

C:\Windows\ApplicationData\Identities\{ACblahblahblah}\Microsoft\ OutlookExpress\ and copy all the .dbx files onto a floppy. Then when you take the .dbx files back to your house, use DBXtract to extract the messages from these files. 

Which are the best keylogger now a days?

I have made a detailed post on this topic in my post Which spyware keylogger software to choose,You must prefer reading it

RAT:(Remote administration tool)
Another option you have if you have physical access is to execute a RAT (Remote Administration Tool, you may know these programs as trojans) server on the computer. Of course, you do not have to have physical access to go this route, but it helps. What you must understand is that these tools are known threats, and the popular ones are quickly detected by antivirus software, and thusly taken care of. Even ISPs block incoming/outgoing traffic from the most popular ports used by these programs.


.......

Read More

Hack Facebook, hotmail and yahoo account

Tweet

I get numerous email from readers asking me to tell them the easiest way to hack Facebook,hotmail and yahoo account,Many of these people claim that they have lost their passwords because they have been hacked and now need to get their password back.so today i have decided to compose a post explaining the ways to hack yahoo,aol and hotmail account

Phishing:
This is one of the most popular way to hack Facebook,hotmail and yahoo account,In this method the hacker creates a fake page which exactly resembles to the original page,when the victim enters his email address or password it is saved in a txt file.
I have also posted a way to Create a fake login page for any site,just check it out


Keylogging:
A keylogger, sometimes called a keystroke logger, keylogger, or system monitor, is a hardware device or small program that monitors each keystroke a user types on a specific computer’s keyboard. Keylogger is the easiest way to hack a Facebook,hotmail and yahoo account if you have physical access to victim’s computer. 


Post related to keylogging:
1.Keyloger to hack passwords
2.Hack an account using keylogger
3.Hack gmail account using keylogger
4.How to install a keylogger remotely
5.How to bypass keylogger antivirus detection




IMPERSONATION

It is possible to impersonate a program on a computer by launching windows that look like something else. For instance, let's say you login to the MSN® service and visit a website (in this case a hostile website.) It would be possible for this website to pop-up some windows that look like something else. They could look almost identical to windows that an inexperienced user might expect from his local computer. The user could be fooled into submitting information to the hostile website. For instance, consider the effect of seeing the following window:



SNIFFING:

If two people do not share the same computer, but do share the same network, it may be possible for one to sniff the others' packets as they sign-on. The traffic between your computer and the internet site you are accessing may be able to be recorded and decrypted or "played-back." This is not a simple attack to execute, but is possible if two people are close to one another and share a hub. Again, this is likely to be illegal and we do not condone this activity.

BRUTE-FORCE ATTACK:

Many people want to find software to perform a brute-force attack. This is really impractical. It would take hundreds of thousands of years to attempt any kind of reasonable brute-force attack on Facebook,hotmail and yahoo accounts and this would expand exponentially if the password is longer than the minimum length. Using multiple computers or multiple sessions could reduce this to merely thousands of years. This is highly illegal since these services own the servers on which an account is hosted. Even if you are hacking your own account, you don't own the servers and the service is going to monitor and log this activity. It is extremely unlikely that you could recover a password in this way, but it is extremely likely that you'd be arrested and prosecuted for doing this.
Know more about Brute force attack

SOCIAL ENGINEERING:
Social engineering is the name given to the art of attacking the person, rather than the computer or system. The basic principle is that many people can be talked into giving someone else their id and password if they think it is someone that they can trust. For instance, I might call someone and say I was from AOL and that I was finally getting around to responding to their technical support question. I would then ask you to describe the problem that you are having and tell you that we have a solution. However, I just need to verify the account. Can you give me the username and password again? A surprising number of people would fall for this obvious scam. There is no limit as to how elaborate this can be. The more information that is given by the caller, the more realistic or believable the call is. Again, never give your password to anyone. No legitimate customer service representative will ask for this information.

These are the basic methods that we are aware of for hacking any Facebook,hotmail and yahoo account or any other dial-up or on-line password

Read More