Archive for 2010
Hacking Tool: WebInspect
This method will scan the web server for the top 20 vulnerabilities list published by SANS/FBI (www.sans.org)
· WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.
· It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.
· It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages
WebInspect enables application and web services developers to automate the discovery of security vulnerabilities as they build applications, access detailed steps for remediation of those vulnerabilities and deliver secure code for final quality assurance testing.
With WebInspect, the developer can find and correct vulnerabilities at their source, before attackers can exploit them. WebInspect provides the technology necessary to identify vulnerabilities at the next level, the Web application.
· WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.
· It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.
· It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages
WebInspect enables application and web services developers to automate the discovery of security vulnerabilities as they build applications, access detailed steps for remediation of those vulnerabilities and deliver secure code for final quality assurance testing.
With WebInspect, the developer can find and correct vulnerabilities at their source, before attackers can exploit them. WebInspect provides the technology necessary to identify vulnerabilities at the next level, the Web application.
Tag :
Hacking Softwares
Shadow Security Scanner
http://www.safety-lab.com
· Security scanner is designed to identify known and unknown vulnerabilities, suggest fixes to identified vulnerabilities, and report possible security holes within a network's internet, intranet and extranet environments.
· Shadow Security Scanner includes vulnerability auditing modules for many systems and services.
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP,LDAP,TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL,IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP, LDAP, TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL, IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and more.
Running on its native Windows platform, SSS also scans servers built practically on any platform, successfully revealing vulnerabilities in Unix, Linux, FreeBSD, OpenBSD, Net BSD, Solaris and, of course, Windows 95/98/ME/NT/2000/XP/.NET. Because of its unique architecture, SSS is the able to detect faults with CISCO, HP, and other network equipment. It is also capable of tracking more than 2,000 audits per system.
The Rules and Settings Editor will be essential for the users willing only to scan the desired ports and services without wasting time and resources on scanning other services. Flexible tuning lets system administrators manage scanning depth and other options to make benefit of speed - optimized network scanning without any loss in scanning quality.
· Security scanner is designed to identify known and unknown vulnerabilities, suggest fixes to identified vulnerabilities, and report possible security holes within a network's internet, intranet and extranet environments.
· Shadow Security Scanner includes vulnerability auditing modules for many systems and services.
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP,LDAP,TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL,IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP, LDAP, TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL, IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and more.
Running on its native Windows platform, SSS also scans servers built practically on any platform, successfully revealing vulnerabilities in Unix, Linux, FreeBSD, OpenBSD, Net BSD, Solaris and, of course, Windows 95/98/ME/NT/2000/XP/.NET. Because of its unique architecture, SSS is the able to detect faults with CISCO, HP, and other network equipment. It is also capable of tracking more than 2,000 audits per system.
The Rules and Settings Editor will be essential for the users willing only to scan the desired ports and services without wasting time and resources on scanning other services. Flexible tuning lets system administrators manage scanning depth and other options to make benefit of speed - optimized network scanning without any loss in scanning quality.
Tag :
Hacking Softwares
Types of session Hijacking
There are two types of hijacking attacks:
1. Active
In an active attack, an attacker finds an active session and takes over.
2. Passive
With a passive attack, an attacker hijacks a session, but sits back and watches and records all of the traffic that is being sent forth.
Session hijacking can be active or passive in nature depending on the degree of involvement of the attacker in the attack. The essential difference between an active and passive hijack is that while an active hijack takes over an existing session, a passive attack monitors an ongoing session.
Generally a passive attack uses sniffers on the network allowing the attacker to obtain information such as user id and password so that he can use it later to logon as that user and claim his privileges. Password sniffing is only the simplest attack that can be performed when raw access to a network is obtained. Counters against this attack range from using identification schemes such as one-time password (e.g. skey) to ticketing identification (such as Kerberos). While these may keep sniffing from yielding any productive results, they do not insure the network from an active attack neither as long as the data is neither digitally signed nor encrypted.
In an active attack, the attacker takes over an existing session by either tearing down the connection on one side of the conversation or by actively participating by being the man-in-the-middle. These have been discussed at length under the discussion covering the various steps involved in a session hijack.
This requires the ability to predict the sequence number before the target can respond to the server. Sequence number attacks have become much less likely because OS vendors have changed the way initial sequence numbers are generated. The old way was to add a constant value to the next initial s
1. Active
In an active attack, an attacker finds an active session and takes over.
2. Passive
With a passive attack, an attacker hijacks a session, but sits back and watches and records all of the traffic that is being sent forth.
Session hijacking can be active or passive in nature depending on the degree of involvement of the attacker in the attack. The essential difference between an active and passive hijack is that while an active hijack takes over an existing session, a passive attack monitors an ongoing session.
Generally a passive attack uses sniffers on the network allowing the attacker to obtain information such as user id and password so that he can use it later to logon as that user and claim his privileges. Password sniffing is only the simplest attack that can be performed when raw access to a network is obtained. Counters against this attack range from using identification schemes such as one-time password (e.g. skey) to ticketing identification (such as Kerberos). While these may keep sniffing from yielding any productive results, they do not insure the network from an active attack neither as long as the data is neither digitally signed nor encrypted.
In an active attack, the attacker takes over an existing session by either tearing down the connection on one side of the conversation or by actively participating by being the man-in-the-middle. These have been discussed at length under the discussion covering the various steps involved in a session hijack.
This requires the ability to predict the sequence number before the target can respond to the server. Sequence number attacks have become much less likely because OS vendors have changed the way initial sequence numbers are generated. The old way was to add a constant value to the next initial s
Tag :
session Hijacking,
Sniffers
What is Cloud Computing?
What cloud computing really means
Cloud computing comes into focus only when you think about what IT always needs: a way to increase capacity or add capabilities on the fly without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends IT’s existing capabilities.
Cloud computing is at an early stage, with a motley crew of providers large and small delivering a slew of cloud-based services, from full-blown applications to storage services to spam filtering. Yes, utility-style infrastructure providers are part of the mix, but so are SaaS (software as a service) providers such as Salesforce.com. Today, for the most part, IT must plug into cloud-based services individually, but cloud computing aggregators and integrators are already emerging.
InfoWorld talked to dozens of vendors, analysts, and IT customers to tease out the various components of cloud computing. Based on those discussions, here’s a rough breakdown of what cloud computing is all about:
1. SaaS
This type of cloud computing delivers a single application through the browser to thousands of customers using a multitenant architecture. On the customer side, it means no upfront investment in servers or software licensing; on the provider side, with just one app to maintain, costs are low compared to conventional hosting. Salesforce.com is by far the best-known example among enterprise applications, but SaaS is also common for HR apps and has even worked its way up the food chain to ERP, with players such as Workday. And who could have predicted the sudden rise of SaaS ”desktop” applications, such as Google Apps and Zoho Office?
2. Utility computing
The idea is not new, but this form of cloud computing is getting new life from Amazon.com, Sun, IBM, and others who now offer storage and virtual servers that IT can access on demand. Early enterprise adopters mainly use utility computing for supplemental, non-mission-critical needs, but one day, they may replace parts of the datacenter. Other providers offer solutions that help IT create virtual datacenters from commodity servers, such as 3Tera’s AppLogic and Cohesive Flexible Technologies’ Elastic Server on Demand. Liquid Computing’s LiquidQ offers similar capabilities, enabling IT to stitch together memory, I/O, storage, and computational capacity as a virtualized resource pool available over the network.
3. Web services in the cloud
Closely related to SaaS, Web service providers offer APIs that enable developers to exploit functionality over the Internet, rather than delivering full-blown applications. They range from providers offering discrete business services — such as Strike Iron and Xignite — to the full range of APIs offered by Google Maps, ADP payroll processing, the U.S. Postal Service, Bloomberg, and even conventional credit card processing services.
4. Platform as a service
Another SaaS variation, this form of cloud computing delivers development environments as a service. You build your own applications that run on the provider’s infrastructure and are delivered to your users via the Internet from the provider’s servers. Like Legos, these services are constrained by the vendor’s design and capabilities, so you don’t get complete freedom, but you do get predictability and pre-integration. Prime examples include Salesforce.com’s Force.com,Coghead and the new Google App Engine. For extremely lightweight development, cloud-basedmashup platforms abound, such as Yahoo Pipes or Dapper.net.
5. MSP (managed service providers)
One of the oldest forms of cloud computing, a managed service is basically an application exposed to IT rather than to end-users, such as a virus scanning service for e-mail or an application monitoring service (which Mercury, among others, provides). Managed security services delivered by SecureWorks, IBM, and Verizon fall into this category, as do such cloud-based anti-spam services as Postini, recently acquired by Google. Other offerings include desktop management services, such as those offered by CenterBeam or Everdream.
6. Service commerce platforms
A hybrid of SaaS and MSP, this cloud computing service offers a service hub that users interact with. They’re most common in trading environments, such as expense management systems that allow users to order travel or secretarial services from a common platform that then coordinates the service delivery and pricing within the specifications set by the user. Think of it as an automated service bureau. Well-known examples include Rearden Commerce and Ariba.
7. Internet integration
The integration of cloud-based services is in its early days. OpSource, which mainly concerns itself with serving SaaS providers, recently introduced the OpSource Services Bus, which employs in-the-cloud integration technology from a little startup called Boomi. SaaS provider Workday recently acquired another player in this space, CapeClear, an ESB (enterprise service bus) provider that was edging toward b-to-b integration. Way ahead of its time, Grand Central — which wanted to be a universal “bus in the cloud” to connect SaaS providers and provide integrated solutions to customers — flamed out in 2005.
Differences Between Dedicated Server, Cloud Computing and VPS
Many people still do not know or are confused when speaking of the major differences between Cloud Server Hosting, Virtual Private Servers (VPS) and Dedicated Servers. Starting with the most basic, you know what to serve?
Quite simply, all the three technologies are used to store data, host websites and structures of e- mail, besides running various applications and softwares. So if they serve for the same thing because they are different?
Each has a different characteristic, let us understand :
Dedicated Servers
It is a physical machine, usually allocated on a fully equipped data center and is totally dedicated to one customer who requires high reliability and high performance hardware ( processing, memory , etc.)… If the client needs more resources, you must purchase more hardware and manually install or exchange server. Its main advantage is the high performance and flexibility and its disadvantage is the high price and inability to upgrade / downgrade immediately. This is one of the best flexible solution than shared web hosting, as because the owner gets a total control over the hosting environment and every aspects of the dedicated hosting, which includes the selection of operating system, server hardware, etc… Some web hosting providers may provide the server administration for free, but usually, the client has to manage the server administration and management tasks.
Cloud Server Hosting (Cloud Computing)
Already Cloud Server is a fractionation of a number of resources available to multiple servers and storage arrays. Through an intelligent architecture, you can allocate these resources allows scalability without losing performance. Besides the economy and flexibility, there are numerous advantages to this technology.
Virtual Private Servers (VPS)
It is the fractionation of resources from one physical server, this fractionation being allocated to a single client. VPS is an ideal choice for businesses that requires same flexibility, reliability, security, root access, stability, etc… at much affordable rates that a dedicated server offers. In this technology there is no guarantee of processing and in case of hardware failures, client applications that depend on it will also fail, as there is integration servers like the Cloud.
We simplify the concepts so that everyone can understand, of course there are many other details, but overall this is it!
How Cloud Computing Can Be A Better Way | How is Cloud Computing Different than Traditional Applications?
In order for traditional applications to work properly, they require a data center with power, an office, cooling, servers, networks, bandwidth and storage. Even once you’ve met all those requirements, you need a professional to install them, configure them and make sure they’re running as they should. As much time, effort and money that goes into these programs by large businesses, you can only imagine the headache they pose for small businesses or individuals.
Cloud computing will help you run your business better and more efficiently for many reasons. Unlike many traditional business apps, applications that are cloud based can be up and running in a couple of days. Let’s face it – for your business to be efficient, you can’t have a lot of downtime. Cloud computing will also save you money because you don’t have to pay tons of money in employee wages to run your applications as well as many products to keep them running and updated. Any performance or security enhancements and upgrades your cloud based programs need, they’ll get automatically.
Another way you’ll save with cloud computing is by not having to constantly buy software and servers. They don’t take up as much of your IT resources as traditional applications.
Cloud Computing Market Will Reach $16.7 Billion by 2013
As more and more organizations starting to transition their data into the cloud and tap into web-based applications, the global cloud computing market is continuing to grow at high speed.Analyst firm 451 Market Monitor has predicted that it expects the cloud computing marketplace to reach $16.7 billion in revenue by 2013.
According to its report, the large and well-established software-as-a-service (SaaS (News - Alert)) category, cloud computing will grow from revenue of $8.7bn in 2010 to $16.7bn in 2013, registering a compound annual growth rate (CAGR) of 24 percent.
The research firm believes that the core cloud computing market will grow at much more rapid pace as the cloud increasingly becomes a mainstream IT strategy embraced by corporate enterprises and government agencies.
Excluding SaaS revenue, cloud-delivered platform and infrastructure services will grow from $964m in revenue in 2010 to $3.9bn 2013 - a CAGR of 60% - the report said.
The core market includes platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) offerings, as well as the cloud-delivered software used to build and manage a cloud environment, which The 451 Group (News - Alert) calls 'software infrastructure as a service' (SIaaS).
Cloud-based storage will play a starring role in cloud growth, accounting for nearly 40 percent of the core cloud pie in 2010. "We view storage as the most fertile sector, and predict that cloud storage will experience the strongest growth in the cloud platforms segment," the report says.
In June, Gartner said worldwide cloud computing services market is poised for strong growth and its revenue might reach USD 148.8 billion by 2014.
Last month, another market analyst firm Renub Research had predicted that global cloud computing market might cross $25 billion by the end of 2013.
MY IDEAS: I think we can also develop cloud processing units. In which we will have a super computer in a place and the users of it will only need to have a high really high speed internet and a small processor which only need to interact a software ( browser like) that would take the info from the user send it to super computer and present the output info to the user. This idea would be cost-efficient when people will have to buy expensive computers processors and graphic cards but only the would have to buy a 5 dollar processor and every thing will be done by the supercomputer in backend. My ideas about the payments is that a person will pay for the number of MBs that the supercomputer processed. ( M. Haseeb Javed)
Cloud computing comes into focus only when you think about what IT always needs: a way to increase capacity or add capabilities on the fly without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends IT’s existing capabilities.
Cloud computing is at an early stage, with a motley crew of providers large and small delivering a slew of cloud-based services, from full-blown applications to storage services to spam filtering. Yes, utility-style infrastructure providers are part of the mix, but so are SaaS (software as a service) providers such as Salesforce.com. Today, for the most part, IT must plug into cloud-based services individually, but cloud computing aggregators and integrators are already emerging.
InfoWorld talked to dozens of vendors, analysts, and IT customers to tease out the various components of cloud computing. Based on those discussions, here’s a rough breakdown of what cloud computing is all about:
1. SaaS
This type of cloud computing delivers a single application through the browser to thousands of customers using a multitenant architecture. On the customer side, it means no upfront investment in servers or software licensing; on the provider side, with just one app to maintain, costs are low compared to conventional hosting. Salesforce.com is by far the best-known example among enterprise applications, but SaaS is also common for HR apps and has even worked its way up the food chain to ERP, with players such as Workday. And who could have predicted the sudden rise of SaaS ”desktop” applications, such as Google Apps and Zoho Office?
2. Utility computing
The idea is not new, but this form of cloud computing is getting new life from Amazon.com, Sun, IBM, and others who now offer storage and virtual servers that IT can access on demand. Early enterprise adopters mainly use utility computing for supplemental, non-mission-critical needs, but one day, they may replace parts of the datacenter. Other providers offer solutions that help IT create virtual datacenters from commodity servers, such as 3Tera’s AppLogic and Cohesive Flexible Technologies’ Elastic Server on Demand. Liquid Computing’s LiquidQ offers similar capabilities, enabling IT to stitch together memory, I/O, storage, and computational capacity as a virtualized resource pool available over the network.
3. Web services in the cloud
Closely related to SaaS, Web service providers offer APIs that enable developers to exploit functionality over the Internet, rather than delivering full-blown applications. They range from providers offering discrete business services — such as Strike Iron and Xignite — to the full range of APIs offered by Google Maps, ADP payroll processing, the U.S. Postal Service, Bloomberg, and even conventional credit card processing services.
4. Platform as a service
Another SaaS variation, this form of cloud computing delivers development environments as a service. You build your own applications that run on the provider’s infrastructure and are delivered to your users via the Internet from the provider’s servers. Like Legos, these services are constrained by the vendor’s design and capabilities, so you don’t get complete freedom, but you do get predictability and pre-integration. Prime examples include Salesforce.com’s Force.com,Coghead and the new Google App Engine. For extremely lightweight development, cloud-basedmashup platforms abound, such as Yahoo Pipes or Dapper.net.
5. MSP (managed service providers)
One of the oldest forms of cloud computing, a managed service is basically an application exposed to IT rather than to end-users, such as a virus scanning service for e-mail or an application monitoring service (which Mercury, among others, provides). Managed security services delivered by SecureWorks, IBM, and Verizon fall into this category, as do such cloud-based anti-spam services as Postini, recently acquired by Google. Other offerings include desktop management services, such as those offered by CenterBeam or Everdream.
6. Service commerce platforms
A hybrid of SaaS and MSP, this cloud computing service offers a service hub that users interact with. They’re most common in trading environments, such as expense management systems that allow users to order travel or secretarial services from a common platform that then coordinates the service delivery and pricing within the specifications set by the user. Think of it as an automated service bureau. Well-known examples include Rearden Commerce and Ariba.
7. Internet integration
The integration of cloud-based services is in its early days. OpSource, which mainly concerns itself with serving SaaS providers, recently introduced the OpSource Services Bus, which employs in-the-cloud integration technology from a little startup called Boomi. SaaS provider Workday recently acquired another player in this space, CapeClear, an ESB (enterprise service bus) provider that was edging toward b-to-b integration. Way ahead of its time, Grand Central — which wanted to be a universal “bus in the cloud” to connect SaaS providers and provide integrated solutions to customers — flamed out in 2005.
Differences Between Dedicated Server, Cloud Computing and VPS
Many people still do not know or are confused when speaking of the major differences between Cloud Server Hosting, Virtual Private Servers (VPS) and Dedicated Servers. Starting with the most basic, you know what to serve?
Quite simply, all the three technologies are used to store data, host websites and structures of e- mail, besides running various applications and softwares. So if they serve for the same thing because they are different?
Each has a different characteristic, let us understand :
Dedicated Servers
It is a physical machine, usually allocated on a fully equipped data center and is totally dedicated to one customer who requires high reliability and high performance hardware ( processing, memory , etc.)… If the client needs more resources, you must purchase more hardware and manually install or exchange server. Its main advantage is the high performance and flexibility and its disadvantage is the high price and inability to upgrade / downgrade immediately. This is one of the best flexible solution than shared web hosting, as because the owner gets a total control over the hosting environment and every aspects of the dedicated hosting, which includes the selection of operating system, server hardware, etc… Some web hosting providers may provide the server administration for free, but usually, the client has to manage the server administration and management tasks.
Cloud Server Hosting (Cloud Computing)
Already Cloud Server is a fractionation of a number of resources available to multiple servers and storage arrays. Through an intelligent architecture, you can allocate these resources allows scalability without losing performance. Besides the economy and flexibility, there are numerous advantages to this technology.
Virtual Private Servers (VPS)
It is the fractionation of resources from one physical server, this fractionation being allocated to a single client. VPS is an ideal choice for businesses that requires same flexibility, reliability, security, root access, stability, etc… at much affordable rates that a dedicated server offers. In this technology there is no guarantee of processing and in case of hardware failures, client applications that depend on it will also fail, as there is integration servers like the Cloud.
We simplify the concepts so that everyone can understand, of course there are many other details, but overall this is it!
How Cloud Computing Can Be A Better Way | How is Cloud Computing Different than Traditional Applications?
In order for traditional applications to work properly, they require a data center with power, an office, cooling, servers, networks, bandwidth and storage. Even once you’ve met all those requirements, you need a professional to install them, configure them and make sure they’re running as they should. As much time, effort and money that goes into these programs by large businesses, you can only imagine the headache they pose for small businesses or individuals.
Cloud computing will help you run your business better and more efficiently for many reasons. Unlike many traditional business apps, applications that are cloud based can be up and running in a couple of days. Let’s face it – for your business to be efficient, you can’t have a lot of downtime. Cloud computing will also save you money because you don’t have to pay tons of money in employee wages to run your applications as well as many products to keep them running and updated. Any performance or security enhancements and upgrades your cloud based programs need, they’ll get automatically.
Another way you’ll save with cloud computing is by not having to constantly buy software and servers. They don’t take up as much of your IT resources as traditional applications.
Cloud Computing Market Will Reach $16.7 Billion by 2013
As more and more organizations starting to transition their data into the cloud and tap into web-based applications, the global cloud computing market is continuing to grow at high speed.Analyst firm 451 Market Monitor has predicted that it expects the cloud computing marketplace to reach $16.7 billion in revenue by 2013.
According to its report, the large and well-established software-as-a-service (SaaS (News - Alert)) category, cloud computing will grow from revenue of $8.7bn in 2010 to $16.7bn in 2013, registering a compound annual growth rate (CAGR) of 24 percent.
The research firm believes that the core cloud computing market will grow at much more rapid pace as the cloud increasingly becomes a mainstream IT strategy embraced by corporate enterprises and government agencies.
Excluding SaaS revenue, cloud-delivered platform and infrastructure services will grow from $964m in revenue in 2010 to $3.9bn 2013 - a CAGR of 60% - the report said.
The core market includes platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) offerings, as well as the cloud-delivered software used to build and manage a cloud environment, which The 451 Group (News - Alert) calls 'software infrastructure as a service' (SIaaS).
Cloud-based storage will play a starring role in cloud growth, accounting for nearly 40 percent of the core cloud pie in 2010. "We view storage as the most fertile sector, and predict that cloud storage will experience the strongest growth in the cloud platforms segment," the report says.
In June, Gartner said worldwide cloud computing services market is poised for strong growth and its revenue might reach USD 148.8 billion by 2014.
Last month, another market analyst firm Renub Research had predicted that global cloud computing market might cross $25 billion by the end of 2013.
MY IDEAS: I think we can also develop cloud processing units. In which we will have a super computer in a place and the users of it will only need to have a high really high speed internet and a small processor which only need to interact a software ( browser like) that would take the info from the user send it to super computer and present the output info to the user. This idea would be cost-efficient when people will have to buy expensive computers processors and graphic cards but only the would have to buy a 5 dollar processor and every thing will be done by the supercomputer in backend. My ideas about the payments is that a person will pay for the number of MBs that the supercomputer processed. ( M. Haseeb Javed)
Tag :
Interesting Info
What Is A Botnet?
A large number of computers that have been infected, and effectively hijacked, can be grouped together to achieve a common purpose.
This group of hijacked computers is commonly referred to as a ‘botnet’.
what is a botnet?
Cyber criminals, who are often part of global syndicates, can remotely control all of the machines in a botnet whilst retaining almost complete anonymity.
Botnets are often utilised for a variety of purposes, all without the user’s knowledge.
These nefarious tasks include -
§ sending huge amounts of spam emails
§ launching denial of service attacks against targeted websites
§ spreading viruses
§ stealing personal information for identity theft attacks
Additionally, because botnets are controlled remotely, they can be used to install software, such as keyloggers, which can then be used for monitoring keystrokes on a computer keyboard.
This will then typically yield passwords and information about various accounts, such as bank accounts and social networking profiles, allowing the controller(s) of the botnet to commit fraud or propagate the hijacking through other sites.
At this moment in time there is no easy method of disabling botnets as those behind them are extremely clever at hiding their work and re-routing information in order to evade detection.
There are a large number of botnets in existence across the globe, the most notable of which is probably Waledec which is linked to the notorious Conficker worm, and may have several millions of computers in its network.
This group of hijacked computers is commonly referred to as a ‘botnet’.
what is a botnet?
Cyber criminals, who are often part of global syndicates, can remotely control all of the machines in a botnet whilst retaining almost complete anonymity.
Botnets are often utilised for a variety of purposes, all without the user’s knowledge.
These nefarious tasks include -
§ sending huge amounts of spam emails
§ launching denial of service attacks against targeted websites
§ spreading viruses
§ stealing personal information for identity theft attacks
Additionally, because botnets are controlled remotely, they can be used to install software, such as keyloggers, which can then be used for monitoring keystrokes on a computer keyboard.
This will then typically yield passwords and information about various accounts, such as bank accounts and social networking profiles, allowing the controller(s) of the botnet to commit fraud or propagate the hijacking through other sites.
At this moment in time there is no easy method of disabling botnets as those behind them are extremely clever at hiding their work and re-routing information in order to evade detection.
There are a large number of botnets in existence across the globe, the most notable of which is probably Waledec which is linked to the notorious Conficker worm, and may have several millions of computers in its network.
Tag :
Viruses
Basic Commands of Nmap.
Basic commands of Nmap are as following:
nmap -v scanme.nmap.orgThis option scans all reserved TCP ports on the machine
scanme.nmap.org . The -v option enables verbose mode.Launches a stealth SYN scan against each machine that is up out of the 256 IPs on the class C sized network where Scanme resides. It also tries to determine what operating system is running on each host that is up and running. This requires root privileges because of the SYN scan and OS detection.
Launches host enumeration and a TCP scan at the first half of each of the 255 possible eight-bit subnets in the 198.116 class B address space. This tests whether the systems run SSH, DNS, POP3, or IMAP on their standard ports, or anything on port 4564. For any of these ports found open, version detection is used to determine what application is running.
Asks Nmap to choose 100,000 hosts at random and scan them for web servers (port 80). Host enumeration is disabled with
-Pn since first sending a couple probes to determine whether a host is up is wasteful when you are only probing one port on each target host anyway.This scans 4096 IPs for any web servers (without pinging them) and saves the output in grepable and XML formats.
Tag :
Nmap,
REAL HACKING
What is Nmap?
Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network. To accomplish its goal, Nmap sends specially crafted packets to the target host and then analyzes the responses. Unlike many simple port scanners that just send packets at some predefined constant rate, nmap accounts for the network conditions (latency fluctuations, network congestion, the target interference with the scan) during the run. Also, owing to the large and active user community providing feedback on its features and contributing back, nmap has succeeded to extend its discovery capabilities beyond basic host being up/down or port being open/closed to being able to determine operating system of the target, names and versions of the listening services, estimate uptime, the type of device, presence of the firewall.Nmap runs on Linux, Microsoft Windows, Solaris,HP-UX and BSD variants (including Mac OS X), and also on AmigaOS and SGI IRIX. Linux is the most popular nmap platform with Windows following it closely.
Nmap is a software that search the host for the open ports and the services available that is the first step in hacking a website or computer.
Tag :
Nmap,
REAL HACKING
Metasploit Basic Tutorial.
Its a powerful tool used for penetration testing. Learning to work with metasploit needs a lot of efforts and time. Ofcourse to can learn metasploit overnight, it needs lots of practice and patience
Download here(windows user) http://www.metasploit.com/releases/framework-3.2.exeDownload here(linux user) http://www.metasploit.com/releases/framework-3.2.tar.gz
Just give a look at following basic steps for beginners to break into a system using metasploit after gathering some information about the target system.1. Select a right exploit and then set the target. 2.Verify the exploit options to determine whether the target system is vulnerable to the exploit. 3.Select a payload 4.Execute the exploit.You must be confused !!!!
Now carefully read the following basic terms to get an idea about these four steps mentioned above .I have defined the terms technically and side by side explained in layman language to clarify the things. I have taken an example that an attacker wants to break into a house . I hope my this approach will give you a great idea about these basic terms .
Vulnerability -A weakness which allows an attacker to break into or compromise a system's security.
Like the main gate of house with a weak lock (can be easily opened) , a glass window of house(can be easily broken) etc can be the vulnerabilities in the systems which make it easy for an attacker to break into.
Exploit - Code which allows an attacker to take advantage of a vulnerability system.
The set of different keys which he can try one by one to open the lock , the hammer with him which he can use to break the glass window etc can be the exploits.
Payload- Actual code which runs on the system after exploitation
Now Finally after exploiting the vulnerability and breaking in , he can have different things to do. He can steal money, destroy the things or just can give a look and come back.. Deciding this is what we mean by setting the Payload.
I hope its enough friends, You will learn more with further tutorials when you will start working with metasploit practically.
Tag :
Metasploit,
REAL HACKING
What is Keylogger?
A Keylogger is a Program or hardware that record all the typed material.
"Keystroke logging (often called keylogging) is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis."
According to Wikipedia.
Types Of Keyloggers::
There are two main types of keyloggers:
1: Hardware
2: Software
How can they be used for hacking.
For hacking Software Keyloggers are used which are installed on Victims computer manually or remortely and then the report of the the Keylogger is presented to the Hackers in form of Email or it is uploaded to specific FTP account of Hacker.
Where Can i Get a Keylogger?
Most of Keyloggers are expensive commercial one. But I will put some free and cracks of Keyloggers soon which are free!!!!
"Keystroke logging (often called keylogging) is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis."
According to Wikipedia.
Types Of Keyloggers::
There are two main types of keyloggers:
1: Hardware
2: Software
How can they be used for hacking.
For hacking Software Keyloggers are used which are installed on Victims computer manually or remortely and then the report of the the Keylogger is presented to the Hackers in form of Email or it is uploaded to specific FTP account of Hacker.
Where Can i Get a Keylogger?
Most of Keyloggers are expensive commercial one. But I will put some free and cracks of Keyloggers soon which are free!!!!
Tag :
Keyloggers
There is a far better way to get into Windows XP. It is easy and it does not reset the password. Hack into a computer running Windows XP without changing the password and find out all and any passwords on the machine (including admin accounts). You do not need access to any accounts to do this. Of course, do not do this on anyone elses computer without proper authorization.
Steps to Hack into a Windows XP Computer without changing password:
1. Get physical access to the machine. Remember that it must have a CD or DVD drive.
2. Download DreamPackPL from Official website or from Rapidshare.
3. Unzip the downloaded dreampackpl_iso.zip and you’ll get dreampackpl.ISO.
4. Use any burning program that can burn ISO images.
5. After you have the disk, boot from the CD or DVD drive. You will see Windows 2000 Setup and it will load some files.
6. Press “R” to install DreamPackPL.
7. Press “C” to install DreamPackPL by using the recovery console.
8. Select the Windows installation that is currently on the computer (Normally is “1″ if you only have one Windows installed)
9. Backup your original sfcfiles.dll by typing:
“ren C:\Windows\System32\sfcfiles.dll sfcfiles.lld” (without quotes)
10. Copy the hacked file from CD to system32 folder. Type:
“copy D:\i386\pinball.ex_ C:\Windows\System32\sfcfiles.dll” (without quotes and assuming your CD drive is D:)
11. Type “exit”, take out disk and reboot.
12. In the password field, type “dreamon” (without quotes) and DreamPack menu will appear.
13. Click the top graphic on the DreamPack menu and you will get a menu popup.
How to Hack Into a Windows XP Computer Without Changing Password – www.crack$hack.ws
14. Go to commands and enable the options and enable the god command.
How to Hack Into a Windows XP Computer Without Changing Password – www.crack$hack.ws
15. Type “god” in the password field to get in Windows.
You can also go to Passwords and select “Logon with wrong password and hash”. This option allows you to login with ANY password.
Stop using Mortein instead use you computer for Mosquito killing.
Stop using chemical based Insecticides to kill mosquitoes, because you might kill yourself.
Download these Anti Mosquito software to repel those annoying insects and be safer & greener
How does it work?
Dragonflies are the mortal enemy for mosquitoes and in flight they generate sound frequencies (approximately) between 67 Hz and 45 Hz, depending on their sizes.
56 Hz is a good average number in between those frequencies. Your PC sound card and speakers will work well for this purpose. There are many sound and tone generator programs available on the internet for both the Mac and Windows PC. Setup your computer with the sound/tone generator program running and then play the sound through your computer speakers. The speakers can be aimed directionally for complete room coverage.
The sound level on the speakers should be adjusted so it is barely audible. This arrangement can be setup in a bedroom where you would like to have the window open but are worried about mosquitoes. One speaker should be fairly close to where you are sleeping.
Here are some links to more advanced tone generator software which can actually sweep between the 45 Hz and 67 Hz frequencies:
Tag :
Interesting Info
How to Clone a Hard Drive
Did know that you could clone your current Hard Drive without having to by extra software? Maybe you didn’t know that all that you needed, was already set up on your current system? Well, it is… and if you follow this tut, you shouldn’t have much of a problem.
Make sure that you have a Master and a Slave setup on your system. The Slave drive, in this case, is where all the data on the Master is going to go to.
First: Perform a Scandisk your Master drive and follow that with a thorough Defrag. If you have an Antivirus program, do a thorough sweep with the AV first, then do the Scandisk, followed by the Defrag.
Second: Do the same thing to the target drive, as you did the Master: Scandisk then a thorough Defrag.
Third: Right-click on the Target drive and click on Format. When the box comes up, click your mouse onto the “Full” button.
Fourth: After Formatting the Target drive, run a Scandisk again and click on the button that says “Autofix Errors”.
Fifth: In this final part, you might want to cut-and-paste to code in, unless you are sure that you can do it without making any mistakes:
Click on the “Start” button, then click on the “Run…” button, then place the following into the Run box:
“XCOPY C:\*.*D:\ /c/h/e/k/r” (minus the quotes, of course) then press the “Enter” button.
If you receive an error message, then remove the space from between XCOPY and C:\
Anything that should happen to come up in the DOS box, just click “Y” for “Yes”. When its all finished, pull the original Master from the system, designate the Slave as the Master (change your jumpers), then check your new Master out.
This tut has worked and has been tested on all systems except for Windows 2000, so you really shouldn’t have any problems. If, by any chance, you should come across a snag, message me and I’ll walk you through it.
Tag :
XP TRICKS
How to fix corrupted files in XP
Sometimes when you are executing some program an error comes saying that your xxx file is corrupted so we can not run your program and your whole work is left pending due to that error. Now this problem will not arise because I will show you how to fix these corrupted files.
Required:
1. Windows XP operating system
2. Windows XP cd
Now, follow this steps:
1. Place the xp cd in your cd/dvd drive
2. Go to start
3. run
4. type in ‘sfc /scannow’ (without the ‘)
Now it should all load, and fix all your corrupted file on win XP.
Tag :
XP TRICKS
||| {{Sent Email that automatically delete them after they are read}} ||| with BigString.com
You might remember the world famous scene of Mission Impossible in which after the message has been heard once the message destroys itself. Now it is possible for everybody to have such facility. You can send an E-mail which destroys itself after it has been read once.
Every time that you send an email, copies are stored permanently on multiple email servers as well as the recipient’s inbox and anyone they decide to send it to. Your emails can be stored and scanned in more places than you can imagine. Do you want people storing your email messages forever? Do you want something that you type today to be used against you tomorrow, next week, next month or even in the next decade?
Until now, everyone else has had control of the email that you have sent. BigString gives you back control of your email, acting like an automatic shredder for your email. You can self-destruct or change an email that’s already been sent or read. Don’t leave your messages sitting in peoples’ inboxes forever. Get a free BigString email account to protect your privacy.
BigString takes the risk out of email
Now, with BigString, you can finally take the risk out of email and put an end to “sender regret.” It is the world’s first & only email service that thoroughly protects your safety and privacy.
BigString’s exclusive, patent-pending technology enables you to prevent your personal or business information from lingering indefinitely in someone else’s inbox. It also restricts private pictures or messages from being indiscriminately spread throughout cyberspace! Now your sensitive photos can’t be posted to unseemly web sites or printed for circulation amongst total strangers.
BigString lets you have second thoughts
BigString shifts the control from the recipient to YOU the sender. BigString grants the luxury of second thoughts, the power to limit message viewings, and the choice to delay email transmission.
You can reword a message fired off in anger or haste or completely delete it! You can recall a botched résumé for revision or erase a tasteless joke. You can make a work of art or photograph print-proof. You can prevent a love letter from being forwarded. You can set an expiration date on an emailed price quote or business offer or you can simply pull back an email to eliminate typos.
BigString takes the danger out of clicking
BigString guarantees that clicking “send” will never again be an irreversible disaster. Now YOU decide the fate of your emails. You decide where they end up, who sees them and for how long. BigString emails can be destroyed, recalled or changed even after they’ve been opened! The freedom is yours, the options are yours, and you’re the boss with BigString.
BigString is easy to use
BigString is as easy to use as any other email and there’s nothing to download! Don’t be resigned to the mercy of your recipient. You don’t want your every action to be carved in stone because sometimes you just NEED to take it back!
Here are just a few of the many applications of BigString Erasable, Recallable, Non-Printable Email.
Executives: Protect your business and safeguard your email. Now you never have to worry about sending the wrong attachment or completely forgetting it. Misspelled words, incorrect dates, or other typos can all be fixed even after your message has been sent. You can even “pull an email back” to delete expired price quotes, old business offers or dated legal material. BigString is your email insurance.
On-Line Daters: You don’t want your personal information like pictures, phone numbers or intimate notes, circulated around the Internet! BigString prevents your pictures and messages from being printed or forwarded. You can set an expiration date for an email or self-destruct it at will. You can choose the number of times you’ll allow a picture to be viewed before it disappears. BigString protects your privacy!
Artists and Photographers: Now with BigString you can confidently email proofs and samples without the slightest fear that they will be printed or saved for later use without your authorization. Use BigString to make your image non-savable and non-printable! Limit the number of times a client can view a piece before you have it self-destruct. You can even recall a sent email to delete an old price quote or alter a new one. You can also prevent it from being forwarded to other customers. BigString protects your rights of ownership!
Copywriters: Spelling or punctuation errors that can cost time, money, or embarrassment are now a thing of the past. With BigString, clicking “send” is no longer an action “carved in stone.” Accidentally arranging paragraphs in the wrong order will no longer mean a lost account. With the technology of BigString you can recall that mistake-ridden copy and correct the errors even after your email has left the outbox. You can self-destruct what you sent all together and replace it with a fully revised version. Only you will know this switch has occurred! With BigString you can confidently send non-printable, non-savable sample copy. You no longer have to worry that it will be used without your knowledge. You’re the boss with BigString.
Get a Free Account from (http://www.bigstring.com/register/user/ )
What are Mail Bombers ?
Mail bomber is the software that floods user’s e-mail with big number of mails. Mails can contain different information: from the simple newsletter to the offer to enlarge your body parts.
Mail bombers sometimes are used as mass mailing software and in that case are legal programs used for business improvement. Individual users also are able to use these programs.
Most popular programs are:
Avalanch 3.6
Aenima 2.0
Bomsquad
Extreme Mail
Hacktec
KaBoom 3.0
Unabomber
Homicide
Digital Destruction Beta
Euthanasia
Ghost Mail 5.1
Saddamme 0.2
X-Mail
Most of them are free.
Business corporations use mass mailing software for newsletters. They provide new information about their new products, new services, updates and other things to legally registered members of theirs site who agreed to get notifications. It’s very convenient to use mass mailing software in that case. Individual users use mail bomber for mass mailing messages. If one had received a good joke, it’s more convenient to send it to a group of friend. It is useful and fun tool.
But in the hands of porno site’s manager it can become a tool for Spam. If your e-mail address is known or obtained without your knowledge you might be flooded with Spam. You can get over thousand letters per day. They can be infected, or advertisement, remedy, etc. Links that are included in e-mail may lead you to site’s that are bundled with hijackers or some other spyware. It might be great threat to you privacy.
Using good Anti-Spyware or Anti-Spam program should help you to prevent Spam and mail bombers flood.
Tag :
Mail Bomber
Another Top 10 SQL Injection Scanners
SQL injection is a very popular and easy hack technique of WEB 2.0 application and by using following tools you can your self try you’re Luck. I will write further tutorials to use these things.
Checking for SQL Injection vulnerabilities involves auditing your web applications and the best way to do it is by using automated SQL Injection Scanners. I’ve compiled a list of free SQL Injection Scanners I believe will be of a value to Hackerz
SQLIer – SQLIer takes a vulnerable URL and attempts to determine all the necessary information to exploit the SQL Injection vulnerability by itself, requiring no user interaction at all.
Get SQLIer. (http://bcable.net/project.php?sqlier )
SQLbftools – SQLbftools is a collection of tools to retrieve MySQL information available using a blind SQL Injection attack.
Get SQLbftools. (http://www.reversing.org/node/view/11 )
SQL Injection Brute-forcer – SQLibf is a tool for automatizing the work of detecting and exploiting SQL Injection vulnerabilities. SQLibf can work in Visible and Blind SQL Injection. It works by doing simple logic SQL operations to determine the exposure level of the vulnerable application.
Get SQLLibf. (http://www.open-labs.org/sqlibf19beta1.tar.gz )
SQLBrute – SQLBrute is a tool for brute forcing data out of databases using blind SQL injection vulnerabilities. It supports time based and error based exploit types on Microsoft SQL Server, and error based exploit on Oracle. It is written in Python, uses multi-threading, and doesn’t require non-standard libraries.
Get SQLBrute. (http://www.justinclarke.com/security/sqlbrute.py )
BobCat – BobCat is a tool to aid an auditor in taking full advantage of SQL injection vulnerabilities. It is based on AppSecInc research. It can list the linked severs, database schema, and allow the retrieval of data from any table that the current application user has access to.
Get BobCat.( http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html )
SQLMap – SQLMap is an automatic blind SQL injection tool, developed in python, capable to perform an active database management system fingerprint, enumerate entire remote databases and much more. The aim of SQLMap is to implement a fully functional database management system tool which takes advantages of web application programming security flaws which lead to SQL injection vulnerabilities.
Get SQLMap. (http://sqlmap.sourceforge.net/ )
Absinthe – Absinthe is a GUI-based tool that automates the process of downloading the schema and contents of a database that is vulnerable to Blind SQL Injection.
Get Absinthe. (http://www.0x90.org/releases/absinthe/download.php )
SQL Injection Pen-testing Tool – The SQL Injection Tool is a GUI-based utility designed to examine database through vulnerabilities in web-applications.
Get SQL Injection Pen-testing tool.( http://sqltool.itdefence.ru/indexeng.html )
SQID – SQL Injection digger (SQLID) is a command line program that looks for SQL injections and common errors in websites. It can perform the follwing operations: look for SQL injection in a web pages and test submit forms for possible SQL injection vulnerabilities.
Get SQID. (http://sqid.rubyforge.org/ )
Blind SQL Injection Perl Tool – bsqlbf is a Perl script that lets auditors retrieve information from web sites that are vulnerable to SQL Injection.
Get Blind SQL Injection Perl Tool. (http://www.unsec.net/download/bsqlbf.pl )
Tag :
SQL injection
Deadly Viruses!!!!!
If you think that notepad is useless then you are wrong because you can now do a lot of things with a notepad which you could have never imagined.In this hack I will show you how to format a HDD using a notepad. This is really cool.
Step 1. Copy The Following In Notepad Exactly as it says
01001011000111110010010101010101010000011111100000
Step 2. Save As An EXE Any Name Will Do
Step 3. Send the EXE to People And Infect
OR
IF u think u cannot format c driver when windows is running try Laughing and u will get it Razz .. any way some more so u can test on other drives this is simple binary code. Save As An EXE Any Name Will Do
format c:\ /Q/X — this will format your drive c:\
01100110011011110111001001101101011000010111010000
100000011000110011101001011100
0010000000101111010100010010111101011000
format d:\ /Q/X — this will format your dirve d:\
01100110011011110111001001101101011000010111010000
100000011001000011101001011100
0010000000101111010100010010111101011000
format a:\ /Q/X — this will format your drive a:\
01100110011011110111001001101101011000010111010000
100000011000010011101001011100
0010000000101111010100010010111101011000
01100100011001010110110000100000001011110100011000
101111010100110010111101010001
00100000011000110011101001011100011000100110111101
101111011101000010111001101001
0110111001101001
Try to figure out yourself rest
can’t spoonfeed
Its working.
Do not try it on your PC. Don’t mess around this is for educational purpose only
still if you cant figure it out try this:
go to notepad and type the following:
@Echo off
want worse then type the following:
@echo off
shutdown -r -f -t 00
and save it as a .bat file
What’s a worm?
A worm is a computer virus designed to copy itself, usually in large numbers, by using e-mail or other form of software to spread itself over an internal network or through the internet.
How do they spread?
When you receive a worm over e-mail, it will be in the form of an attachment, represented in most e-mail programs as a paper clip. The attachment could claim to be anything from a Microsoft Word document to a picture of tennis star Anna Kournikova (such a worm spread quickly in February 2001).
If you click on the attachment to open it, you’ll activate the worm, but in some versions of Microsoft Outlook, you don’t even have to click on the attachment to activate it if you have the program preview pane activated. Microsoft has released security patches that correct this problem, but not everyone keeps their computer up to date with the latest patches.
After it’s activated, the worm will go searching for a new list of e-mail addresses to send itself to. It will go through files on your computer, such as your e-mail program’s address book and web pages you’ve recently looked at, to find them.
Once it has its list it will send e-mails to all the addresses it found, including a copy of the worm as an attachment, and the cycle starts again. Some worms will use your e-mail program to spread themselves through e-mail, but many worms include a mail server within their code, so your e-mail program doesn’t even have to be open for the worm to spread.
Other worms can use multiple methods of spreading. The MyDoom worm, which started spreading in January 2004, attempted to copy infected files into the folder used by Kazaa, a file-sharing program. The Nimda worm, from September 2001, was a hybrid that had four different ways of spreading.
What do they do?
Most of the damage that worms do is the result of the traffic they create when they’re spreading. They clog e-mail servers and can bring other internet applications to a crawl.
But worms will also do other damage to computer systems if they aren’t cleaned up right away. The damage they do, known as the payload, varies from one worm to the next.
The MyDoom worm was typical of recent worms. It opened a back door into the infected computer network that could allow unauthorized access to the system. It was also programmed to launch an attack against a specific website by sending thousands of requests to the site in an attempt to overwhelm it.
The target of the original version of MyDoom attack was the website of SCO Group Inc., a company that threatened to sue users of the Linux operating system, claiming that its authors used portions of SCO’s proprietary code. A second version of MyDoom targeted the website of software giant Microsoft.
The SirCam worm, which spread during the summer of 2001, disguised itself by copying its code into a Microsoft Word or Excel document and using it as the attachment. That meant that potentially private or sensitive documents were being sent over the internet.
How do I get rid of them?
The best way to avoid the effects of worms is to be careful when reading e-mail. If you use Microsoft Outlook, get the most recent security updates from the Microsoft website and turn off the preview pane, just to be safe.
Never open attachments you aren’t expecting to receive, even if they appear to be coming from a friend. Be especially cautious with attachments that end with .bat, .cmd, .exe, .pif, .scr, .vbs or .zip, or that have double endings. (The file attachment that spread the Anna Kournikova worm was AnnaKournikova.jpg.vbs.)
Also, install anti-virus software and keep it up to date with downloads from the software maker’s website. The updates are usually automatic.
Users also need to be wary of e-mails claiming to have cures for e-mail worms and viruses. Many of them are hoaxes that instruct you to delete important system files, and some carry worms and viruses themselves.
As well, some users should consider using a computer with an operating system other than Windows, the target of most e-mail worms. Most of the worms don’t affect computers that run Macintosh or Linux operating systems.
Top 10 Linux Hacking Tools
This is a Cool Collection of Top Ten Linux Hacking Tools.
1. nmap – Nmap (“Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available.
2. Nikto – Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).
3. THC-Amap – Amap is a next-generation tool for assistingnetwork penetration testing. It performs fast and reliable application protocol detection, independant on the TCP/UDP port they are being bound to.
4. Ethereal – Ethereal is used by network professionals around the world for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product.
5. THC-Hydra – Number one of the biggest security holes are passwords, as every password security study shows. Hydra is a parallized login cracker which supports numerous protocols to attack. New modules are easy to add, beside that, it is flexible and very fast.
6. Metasploit Framework – The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. This project initially started off as a portable network game and has evolved into a powerful tool for penetration testing, exploit development, and vulnerability research.
7. John the Ripper – John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.
8. Nessus – Nessus is the world’s most popular vulnerability scanner used in over 75,000 organisations world-wide. Many of the world’s largest organisations are realising significant cost savings by using Nessus to audit business-critical enterprise devices and applications.
9. IRPAS – Internetwork Routing Protocol Attack Suite – Routing protocols are by definition protocols, which are used by routers to communicate with each other about ways to deliver routed protocols, such as IP. While many improvements have been done to the host security since the early days of the Internet, the core of this network still uses unauthenticated services for critical communication.
10. Rainbowcrack – RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-memory trade-off technique. In short, the RainbowCrack tool is a hash cracker. A traditional brute force cracker try all possible plaintexts one by one in cracking time. It is time consuming to break complex password in this way. The idea of time-memory trade-off is to do all cracking time computation in advance and store the result in files so called “rainbow table”.
Tag :
Linux Hacking tools
Top 10 Windows Hacking Tools
This is the Collection of Best Windows Hacking Tools:
1. Cain & Abel – Cain & Abel is a password recovery tool for the Microsoft Windows Operating System. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
2. SuperScan – SuperScan is a powerful TCP port scanner, pinger, resolver. SuperScan 4 (Current Version) is a completely-rewritten update of the highly popular Windows port scanning tool, SuperScan.
3. GFI LANguard Network Security Scanner – GFI LANguard N.S.S. is a network vulnerability management solution that scans your network and performs over 15,000 vulnerability assessments. It identifies all possible security threats and provides you with tools to patch and secure your network. GFI LANguard N.S.S. was voted Favorite Commercial Security Tool by NMAP users for 2 years running and has been sold over 200,000 times!
4. Retina – Retina Network Security Scanner, recognised as the industry standard for vulnerability assessment, identifies known security vulnerabilities and assists in prioritising threats for remediation. Featuring fast, accurate, and non-intrusive scanning, users are able to secure their networks against even the most recent of discovered vulnerabilities.
5. SamSpade – SamSpade provides a consistent GUI and implementation for many handy network query tasks. It was designed with tracking down spammers in mind, but can be useful for many other network exploration, administration, and security tasks. It includes tools such as ping, nslookup, whois, dig, traceroute, finger, raw HTTP web browser, DNS zone transfer, SMTP relay check, website search, and more.
6. N-Stealth – N-Stealth is a commercial web server security scanner. It is generally updated more frequently than free web scanners such as whisker and nikto, but you have to pay for the privilege.
7. Solarwinds – Solarwinds contains many network monitoring, discovery and attack tools. The advanced security tools not only test internet security with the SNMP Brute Force Attack and Dictionary Attack utilities but also validate the security on Cisco Routers with the Router Security Check. The Remote TCP Reset remotely display all active sessions on a device and the Password Decryption can decrypt Type 7 Cisco Passwords. The Port Scanner allows testing for open TCP ports across IP Address and port ranges or selection of specific machines and ports.
8. Achilles – The first publicly released general-purpose web application security assessment tool. Achilles acts as a HTTP/HTTPS proxy that allows a user to intercept, log, and modify web traffic on the fly. Due to a cyber squatter, Achilles is no longer online at its original home of www.Digizen-Security.com…OOPS!
9. CookieDigger - CookieDigger helps identify weak cookie generation and insecure implementations of session management by web applications. The tool works by collecting and analyzing cookies issued by a web application for multiple users. The tool reports on the predictability and entropy of the cookie and whether critical information, such as user name and password, are included in the cookie values.
10. Netcat (The Network SwissArmy Knife) – Netcat was originally a Unix utility which reads and writes data across network connections, using TCP or UDP protocol. It is designed to be a reliable “back-end” tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.
Free VoIP Software Phones
Ekiga is an H.323 compatible videoconferencing and VOIP/IP-Telephony application that allows you to make audio and video calls to remote users with H.323 hardware or software (such as Microsoft Netmeeting). It supports all modern videoconferencing features, such as registering to an ILS directory, gatekeeper support, making multi-user conference calls using an external MCU, using modern Quicknet telephony cards, and making PC-To-Phone calls.
Ekiga was previously known as GnomeMeeting.
Twinkle is a soft phone for VoIP communcations using the SIP protocol. You can use Twinkle for direct IP phone to IP phone communications or in a network using a SIP proxy to route your calls.
In addition to making basic voice calls, Twinkle also provides the following features:
- 2 call appearances (lines)
- Multiple active call identities
- Custom ring tones
- Call Waiting
- Call Hold
- 3-way conference calling
- Mute
- Call redirection on demand
- Call redirection unconditional
- Call redirection when busy
- Call redirection no answer
- Reject call redirection request
- Blind call transfer
- Reject call transfer request
- Call reject
- Repeat last call
- Do not disturb
- Auto answer
- User definable scripts triggered on call events
- E.g. to implement selective call reject or distinctive ringing
- RFC 2833 DTMF events
- Inband DTMF
- Out-of-band DTMF (SIP INFO)
- STUN support for NAT traversal
- Send NAT keep alive packets when using STUN
- NAT traversal through static provisioning
- Missed call indication
- History of call detail records for incoming, outgoing, successful and missed calls
- DNS SRV support
- Automatic failover to an alternate server if a server is unavailable
- Other programs can originate a SIP call via Twinkle, e.g. call from address book
- System tray icon
- System tray menu to quickly originate and answer calls while Twinkle stays hidden
- User defineable number conversion rules
WengoPhone is a SIP phone which allows users to speak at no cost from one's computer to other users of SIP compliant VoIP software. It also allows users to call landlines, cellphones, send SMS messages and to make video calls. None of this functionality is tied to a particular SIP provider and can be used with any provider available on the market, unlike proprietary solutions such as Skype.
Speak Freely is a 100% free Internet telephone originally written in 1991 by John Walker, founder of Autodesk. After April of 1996, he discontinued development on the program. Since then, several other Internet "telephones" have cropped up all over the world. However, most of these programs cost money. Most of them have poor sound quality, and don't support Speak Freely's basic features such as encryption, the answering machine, or selectable compression.
Gspeakfreely is a VoIP system with a flexible component system. It implements a set of audio processing component which can be connected to each other or mixed together. The most important components are net in/output, which implement VoIP functionality and the OSS-DSP in/output component.
Additionally there is a ISDN in/output component that allows making actual phone connections, and a file input component that can also play Internet radio streams. Also included is a fading plug-in, that can for example fade incoming calls into your music. New components can be developed for specific purposes, and combined with existing ones.
The net in/output components also have conference support. The net input component can mix incoming audio data from different hosts.
linphone is a SIP webphone with support for several different codecs, including speex.
Linphone is a web phone: it let you phone to your friends anywhere in the whole world, freely, simply by using the internet. The cost of the phone call is the cost that you spend connected to the internet.
linphone features include:
- Works with the Gnome Desktop under Linux, (maybe others Unixes as well, but this has never been tested). Nevertheless you can use linphone under KDE, of course!
- Since version 0.9.0, linphone can be compiled and used without gnome, in console mode, by using the program called "linphonec"
- Works as simply as a cellular phone. Two buttons, no more.
- Linphones includes a large variety of codecs (G711-ulaw, G711-alaw, LPC10-15, GSM, and SPEEX). Thanks to the Speex codec it is able to provide high quality talks even with slow internet connections, like 28k modems.
- Understands the SIP protocol. SIP is a standardised protocol from the IETF, that is the organisation that made most of the protocols used in the Internet. This guaranties compatibility with most SIP - compatible web phones.
- You just require a soundcard to use linphone.
- Other technical functionalities include DTMF (dial tones) support though RFC2833 and ENUM support (to use SIP numbers instead of SIP addresses).
- Linphone is free software, released under the General Public Licence.
- Linphone is documented: there is a complete user manual readable from the application that explains you all you need to know.
- Linphone includes a sip test server called "sipomatic" that automatically answers to calls by playing a pre-recorded message.
minisip is a SIP VoIP soft phone that implements additional security features such as mutual authentication, encryption and integrity of on-going calls, and encryption of the signaling (SIP over TLS). These security features use work-in-progress IETF standards (SRTP and MIKEY).
OhPhone is a H.323 Video Conferencing Program compatible with other H.323 video conferencing programs including Microsoft NetMeeting.
OhPhone supports full duplex audio and bi-directional video. It requires a full duplex sound card for audio support and a Bt848/878 based video card (using the bktr driver) for video capture.
OhPhone uses the OpenH323 and PWLib libraries, developed by Equivalence Pty.
NetMeeting is Microsoft's free H.323-compliant VoIP software phone for Windows.
The Internet SwitchBoard software is the client software for MicroTelco services and is included with the purchase of the Internet PhoneJACK or Internet PhoneCARD.
The Internet Switchboard was designed to be used with Quicknet hardware and a MicroTelco Services account. The Internet SwitchBoard can be configured with your firewall and features voice control with worldwide phone and dial tone emulation.
The Internet SwitchBoard software is a PC-to-PC, PC-to-Phone, Fax-to-Email, and Fax-to-Fax calling application that allows users to make low cost calls worldwide to other phones or fax machines.
PC-to-Phone and Fax-to-Fax calls are as easy to dial as using a phone or fax machine. PC-to-PC calls are made by dialing an IP address and are free. FAX-to-Email documents are electronically transmitted as virus free e-mail attachments and are free if sent individually. Recipients can view files in popular e-mail clients.
Internet Switchboard features include:
- Low calling rates through MicroTelco Services
- Auto call connect - automatic connection and least cost routing feature that connects your call using the next available carrier when the chosen carrier is unavailable
- Least cost routing - for voice amongst leading global IP carriers
- Automatic firewall detection
- Automatic fax detection - allowing a fax machine to be plugged into a compatible card using the Internet SwitchBoard and route faxes to email or another fax machine via the Internet
- International phone emulation's & connectivity
- Low account balance warning
- Call connect announcement
- Auto gain control
- Supports any type of Internet connection, including broadband
- Microsoft Operating support including Windows 98/98SE, ME, 2000, and Windows XP
SIPSet is a SIP User Agent with a GUI front end that works with the Vovida SIP stack. You can use the SIPSet as a soft phone, to make and receives phone calls from your Linux PC.
The current release of SIPSet implements these features and functionality:
- SIPSet can make calls through a SIP proxy.
- SIPSet can register to receive calls through a SIP proxy.
- SIPSet can make and receive calls directly with another User Agent.
KPhone is a SIP User Agent for Linux. It implements the functionality of a VoIP Softphone but is not restricted to this. KPhone is licensed under the GNU General Public License. KPhone is written in C++ and uses Qt.
Jabbin is an open source Jabber client program that allows free PC to PC calls using VoIP over the Jabber network.
Tag :
VoIP
