Archive for December 2010
Hacking Tool: WebInspect
This method will scan the web server for the top 20 vulnerabilities list published by SANS/FBI (www.sans.org)
· WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.
· It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.
· It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages
WebInspect enables application and web services developers to automate the discovery of security vulnerabilities as they build applications, access detailed steps for remediation of those vulnerabilities and deliver secure code for final quality assurance testing.
With WebInspect, the developer can find and correct vulnerabilities at their source, before attackers can exploit them. WebInspect provides the technology necessary to identify vulnerabilities at the next level, the Web application.
· WebInspect is an impressive Web server and application-level vulnerability scanner which scans over 1500 known attacks.
· It checks site contents and analyzes for rudimentary application-issues like smart guesswork checks, password guessing, parameter passing, and hidden parameter checks.
· It can analyze a basic Webserver in 4 minutes cataloging over 1500 HTML pages
WebInspect enables application and web services developers to automate the discovery of security vulnerabilities as they build applications, access detailed steps for remediation of those vulnerabilities and deliver secure code for final quality assurance testing.
With WebInspect, the developer can find and correct vulnerabilities at their source, before attackers can exploit them. WebInspect provides the technology necessary to identify vulnerabilities at the next level, the Web application.
Tag :
Hacking Softwares
Shadow Security Scanner
http://www.safety-lab.com
· Security scanner is designed to identify known and unknown vulnerabilities, suggest fixes to identified vulnerabilities, and report possible security holes within a network's internet, intranet and extranet environments.
· Shadow Security Scanner includes vulnerability auditing modules for many systems and services.
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP,LDAP,TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL,IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP, LDAP, TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL, IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and more.
Running on its native Windows platform, SSS also scans servers built practically on any platform, successfully revealing vulnerabilities in Unix, Linux, FreeBSD, OpenBSD, Net BSD, Solaris and, of course, Windows 95/98/ME/NT/2000/XP/.NET. Because of its unique architecture, SSS is the able to detect faults with CISCO, HP, and other network equipment. It is also capable of tracking more than 2,000 audits per system.
The Rules and Settings Editor will be essential for the users willing only to scan the desired ports and services without wasting time and resources on scanning other services. Flexible tuning lets system administrators manage scanning depth and other options to make benefit of speed - optimized network scanning without any loss in scanning quality.
· Security scanner is designed to identify known and unknown vulnerabilities, suggest fixes to identified vulnerabilities, and report possible security holes within a network's internet, intranet and extranet environments.
· Shadow Security Scanner includes vulnerability auditing modules for many systems and services.
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP,LDAP,TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL,IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and
These include NetBIOS, HTTP, CGI and WinCGI, FTP, DNS, DoS vulnerabilities, POP3, SMTP, LDAP, TCP/IP, UDP, Registry, Services, Users and accounts, Password vulnerabilities, publishing extensions, MSSQL, IBM DB2, Oracle, MySQL, PostgressSQL, Interbase, MiniSQL and more.
Running on its native Windows platform, SSS also scans servers built practically on any platform, successfully revealing vulnerabilities in Unix, Linux, FreeBSD, OpenBSD, Net BSD, Solaris and, of course, Windows 95/98/ME/NT/2000/XP/.NET. Because of its unique architecture, SSS is the able to detect faults with CISCO, HP, and other network equipment. It is also capable of tracking more than 2,000 audits per system.
The Rules and Settings Editor will be essential for the users willing only to scan the desired ports and services without wasting time and resources on scanning other services. Flexible tuning lets system administrators manage scanning depth and other options to make benefit of speed - optimized network scanning without any loss in scanning quality.
Tag :
Hacking Softwares
Types of session Hijacking
There are two types of hijacking attacks:
1. Active
In an active attack, an attacker finds an active session and takes over.
2. Passive
With a passive attack, an attacker hijacks a session, but sits back and watches and records all of the traffic that is being sent forth.
Session hijacking can be active or passive in nature depending on the degree of involvement of the attacker in the attack. The essential difference between an active and passive hijack is that while an active hijack takes over an existing session, a passive attack monitors an ongoing session.
Generally a passive attack uses sniffers on the network allowing the attacker to obtain information such as user id and password so that he can use it later to logon as that user and claim his privileges. Password sniffing is only the simplest attack that can be performed when raw access to a network is obtained. Counters against this attack range from using identification schemes such as one-time password (e.g. skey) to ticketing identification (such as Kerberos). While these may keep sniffing from yielding any productive results, they do not insure the network from an active attack neither as long as the data is neither digitally signed nor encrypted.
In an active attack, the attacker takes over an existing session by either tearing down the connection on one side of the conversation or by actively participating by being the man-in-the-middle. These have been discussed at length under the discussion covering the various steps involved in a session hijack.
This requires the ability to predict the sequence number before the target can respond to the server. Sequence number attacks have become much less likely because OS vendors have changed the way initial sequence numbers are generated. The old way was to add a constant value to the next initial s
1. Active
In an active attack, an attacker finds an active session and takes over.
2. Passive
With a passive attack, an attacker hijacks a session, but sits back and watches and records all of the traffic that is being sent forth.
Session hijacking can be active or passive in nature depending on the degree of involvement of the attacker in the attack. The essential difference between an active and passive hijack is that while an active hijack takes over an existing session, a passive attack monitors an ongoing session.
Generally a passive attack uses sniffers on the network allowing the attacker to obtain information such as user id and password so that he can use it later to logon as that user and claim his privileges. Password sniffing is only the simplest attack that can be performed when raw access to a network is obtained. Counters against this attack range from using identification schemes such as one-time password (e.g. skey) to ticketing identification (such as Kerberos). While these may keep sniffing from yielding any productive results, they do not insure the network from an active attack neither as long as the data is neither digitally signed nor encrypted.
In an active attack, the attacker takes over an existing session by either tearing down the connection on one side of the conversation or by actively participating by being the man-in-the-middle. These have been discussed at length under the discussion covering the various steps involved in a session hijack.
This requires the ability to predict the sequence number before the target can respond to the server. Sequence number attacks have become much less likely because OS vendors have changed the way initial sequence numbers are generated. The old way was to add a constant value to the next initial s
Tag :
session Hijacking,
Sniffers
What is Cloud Computing?
What cloud computing really means
Cloud computing comes into focus only when you think about what IT always needs: a way to increase capacity or add capabilities on the fly without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends IT’s existing capabilities.
Cloud computing is at an early stage, with a motley crew of providers large and small delivering a slew of cloud-based services, from full-blown applications to storage services to spam filtering. Yes, utility-style infrastructure providers are part of the mix, but so are SaaS (software as a service) providers such as Salesforce.com. Today, for the most part, IT must plug into cloud-based services individually, but cloud computing aggregators and integrators are already emerging.
InfoWorld talked to dozens of vendors, analysts, and IT customers to tease out the various components of cloud computing. Based on those discussions, here’s a rough breakdown of what cloud computing is all about:
1. SaaS
This type of cloud computing delivers a single application through the browser to thousands of customers using a multitenant architecture. On the customer side, it means no upfront investment in servers or software licensing; on the provider side, with just one app to maintain, costs are low compared to conventional hosting. Salesforce.com is by far the best-known example among enterprise applications, but SaaS is also common for HR apps and has even worked its way up the food chain to ERP, with players such as Workday. And who could have predicted the sudden rise of SaaS ”desktop” applications, such as Google Apps and Zoho Office?
2. Utility computing
The idea is not new, but this form of cloud computing is getting new life from Amazon.com, Sun, IBM, and others who now offer storage and virtual servers that IT can access on demand. Early enterprise adopters mainly use utility computing for supplemental, non-mission-critical needs, but one day, they may replace parts of the datacenter. Other providers offer solutions that help IT create virtual datacenters from commodity servers, such as 3Tera’s AppLogic and Cohesive Flexible Technologies’ Elastic Server on Demand. Liquid Computing’s LiquidQ offers similar capabilities, enabling IT to stitch together memory, I/O, storage, and computational capacity as a virtualized resource pool available over the network.
3. Web services in the cloud
Closely related to SaaS, Web service providers offer APIs that enable developers to exploit functionality over the Internet, rather than delivering full-blown applications. They range from providers offering discrete business services — such as Strike Iron and Xignite — to the full range of APIs offered by Google Maps, ADP payroll processing, the U.S. Postal Service, Bloomberg, and even conventional credit card processing services.
4. Platform as a service
Another SaaS variation, this form of cloud computing delivers development environments as a service. You build your own applications that run on the provider’s infrastructure and are delivered to your users via the Internet from the provider’s servers. Like Legos, these services are constrained by the vendor’s design and capabilities, so you don’t get complete freedom, but you do get predictability and pre-integration. Prime examples include Salesforce.com’s Force.com,Coghead and the new Google App Engine. For extremely lightweight development, cloud-basedmashup platforms abound, such as Yahoo Pipes or Dapper.net.
5. MSP (managed service providers)
One of the oldest forms of cloud computing, a managed service is basically an application exposed to IT rather than to end-users, such as a virus scanning service for e-mail or an application monitoring service (which Mercury, among others, provides). Managed security services delivered by SecureWorks, IBM, and Verizon fall into this category, as do such cloud-based anti-spam services as Postini, recently acquired by Google. Other offerings include desktop management services, such as those offered by CenterBeam or Everdream.
6. Service commerce platforms
A hybrid of SaaS and MSP, this cloud computing service offers a service hub that users interact with. They’re most common in trading environments, such as expense management systems that allow users to order travel or secretarial services from a common platform that then coordinates the service delivery and pricing within the specifications set by the user. Think of it as an automated service bureau. Well-known examples include Rearden Commerce and Ariba.
7. Internet integration
The integration of cloud-based services is in its early days. OpSource, which mainly concerns itself with serving SaaS providers, recently introduced the OpSource Services Bus, which employs in-the-cloud integration technology from a little startup called Boomi. SaaS provider Workday recently acquired another player in this space, CapeClear, an ESB (enterprise service bus) provider that was edging toward b-to-b integration. Way ahead of its time, Grand Central — which wanted to be a universal “bus in the cloud” to connect SaaS providers and provide integrated solutions to customers — flamed out in 2005.
Differences Between Dedicated Server, Cloud Computing and VPS
Many people still do not know or are confused when speaking of the major differences between Cloud Server Hosting, Virtual Private Servers (VPS) and Dedicated Servers. Starting with the most basic, you know what to serve?
Quite simply, all the three technologies are used to store data, host websites and structures of e- mail, besides running various applications and softwares. So if they serve for the same thing because they are different?
Each has a different characteristic, let us understand :
Dedicated Servers
It is a physical machine, usually allocated on a fully equipped data center and is totally dedicated to one customer who requires high reliability and high performance hardware ( processing, memory , etc.)… If the client needs more resources, you must purchase more hardware and manually install or exchange server. Its main advantage is the high performance and flexibility and its disadvantage is the high price and inability to upgrade / downgrade immediately. This is one of the best flexible solution than shared web hosting, as because the owner gets a total control over the hosting environment and every aspects of the dedicated hosting, which includes the selection of operating system, server hardware, etc… Some web hosting providers may provide the server administration for free, but usually, the client has to manage the server administration and management tasks.
Cloud Server Hosting (Cloud Computing)
Already Cloud Server is a fractionation of a number of resources available to multiple servers and storage arrays. Through an intelligent architecture, you can allocate these resources allows scalability without losing performance. Besides the economy and flexibility, there are numerous advantages to this technology.
Virtual Private Servers (VPS)
It is the fractionation of resources from one physical server, this fractionation being allocated to a single client. VPS is an ideal choice for businesses that requires same flexibility, reliability, security, root access, stability, etc… at much affordable rates that a dedicated server offers. In this technology there is no guarantee of processing and in case of hardware failures, client applications that depend on it will also fail, as there is integration servers like the Cloud.
We simplify the concepts so that everyone can understand, of course there are many other details, but overall this is it!
How Cloud Computing Can Be A Better Way | How is Cloud Computing Different than Traditional Applications?
In order for traditional applications to work properly, they require a data center with power, an office, cooling, servers, networks, bandwidth and storage. Even once you’ve met all those requirements, you need a professional to install them, configure them and make sure they’re running as they should. As much time, effort and money that goes into these programs by large businesses, you can only imagine the headache they pose for small businesses or individuals.
Cloud computing will help you run your business better and more efficiently for many reasons. Unlike many traditional business apps, applications that are cloud based can be up and running in a couple of days. Let’s face it – for your business to be efficient, you can’t have a lot of downtime. Cloud computing will also save you money because you don’t have to pay tons of money in employee wages to run your applications as well as many products to keep them running and updated. Any performance or security enhancements and upgrades your cloud based programs need, they’ll get automatically.
Another way you’ll save with cloud computing is by not having to constantly buy software and servers. They don’t take up as much of your IT resources as traditional applications.
Cloud Computing Market Will Reach $16.7 Billion by 2013
As more and more organizations starting to transition their data into the cloud and tap into web-based applications, the global cloud computing market is continuing to grow at high speed.Analyst firm 451 Market Monitor has predicted that it expects the cloud computing marketplace to reach $16.7 billion in revenue by 2013.
According to its report, the large and well-established software-as-a-service (SaaS (News - Alert)) category, cloud computing will grow from revenue of $8.7bn in 2010 to $16.7bn in 2013, registering a compound annual growth rate (CAGR) of 24 percent.
The research firm believes that the core cloud computing market will grow at much more rapid pace as the cloud increasingly becomes a mainstream IT strategy embraced by corporate enterprises and government agencies.
Excluding SaaS revenue, cloud-delivered platform and infrastructure services will grow from $964m in revenue in 2010 to $3.9bn 2013 - a CAGR of 60% - the report said.
The core market includes platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) offerings, as well as the cloud-delivered software used to build and manage a cloud environment, which The 451 Group (News - Alert) calls 'software infrastructure as a service' (SIaaS).
Cloud-based storage will play a starring role in cloud growth, accounting for nearly 40 percent of the core cloud pie in 2010. "We view storage as the most fertile sector, and predict that cloud storage will experience the strongest growth in the cloud platforms segment," the report says.
In June, Gartner said worldwide cloud computing services market is poised for strong growth and its revenue might reach USD 148.8 billion by 2014.
Last month, another market analyst firm Renub Research had predicted that global cloud computing market might cross $25 billion by the end of 2013.
MY IDEAS: I think we can also develop cloud processing units. In which we will have a super computer in a place and the users of it will only need to have a high really high speed internet and a small processor which only need to interact a software ( browser like) that would take the info from the user send it to super computer and present the output info to the user. This idea would be cost-efficient when people will have to buy expensive computers processors and graphic cards but only the would have to buy a 5 dollar processor and every thing will be done by the supercomputer in backend. My ideas about the payments is that a person will pay for the number of MBs that the supercomputer processed. ( M. Haseeb Javed)
Cloud computing comes into focus only when you think about what IT always needs: a way to increase capacity or add capabilities on the fly without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends IT’s existing capabilities.
Cloud computing is at an early stage, with a motley crew of providers large and small delivering a slew of cloud-based services, from full-blown applications to storage services to spam filtering. Yes, utility-style infrastructure providers are part of the mix, but so are SaaS (software as a service) providers such as Salesforce.com. Today, for the most part, IT must plug into cloud-based services individually, but cloud computing aggregators and integrators are already emerging.
InfoWorld talked to dozens of vendors, analysts, and IT customers to tease out the various components of cloud computing. Based on those discussions, here’s a rough breakdown of what cloud computing is all about:
1. SaaS
This type of cloud computing delivers a single application through the browser to thousands of customers using a multitenant architecture. On the customer side, it means no upfront investment in servers or software licensing; on the provider side, with just one app to maintain, costs are low compared to conventional hosting. Salesforce.com is by far the best-known example among enterprise applications, but SaaS is also common for HR apps and has even worked its way up the food chain to ERP, with players such as Workday. And who could have predicted the sudden rise of SaaS ”desktop” applications, such as Google Apps and Zoho Office?
2. Utility computing
The idea is not new, but this form of cloud computing is getting new life from Amazon.com, Sun, IBM, and others who now offer storage and virtual servers that IT can access on demand. Early enterprise adopters mainly use utility computing for supplemental, non-mission-critical needs, but one day, they may replace parts of the datacenter. Other providers offer solutions that help IT create virtual datacenters from commodity servers, such as 3Tera’s AppLogic and Cohesive Flexible Technologies’ Elastic Server on Demand. Liquid Computing’s LiquidQ offers similar capabilities, enabling IT to stitch together memory, I/O, storage, and computational capacity as a virtualized resource pool available over the network.
3. Web services in the cloud
Closely related to SaaS, Web service providers offer APIs that enable developers to exploit functionality over the Internet, rather than delivering full-blown applications. They range from providers offering discrete business services — such as Strike Iron and Xignite — to the full range of APIs offered by Google Maps, ADP payroll processing, the U.S. Postal Service, Bloomberg, and even conventional credit card processing services.
4. Platform as a service
Another SaaS variation, this form of cloud computing delivers development environments as a service. You build your own applications that run on the provider’s infrastructure and are delivered to your users via the Internet from the provider’s servers. Like Legos, these services are constrained by the vendor’s design and capabilities, so you don’t get complete freedom, but you do get predictability and pre-integration. Prime examples include Salesforce.com’s Force.com,Coghead and the new Google App Engine. For extremely lightweight development, cloud-basedmashup platforms abound, such as Yahoo Pipes or Dapper.net.
5. MSP (managed service providers)
One of the oldest forms of cloud computing, a managed service is basically an application exposed to IT rather than to end-users, such as a virus scanning service for e-mail or an application monitoring service (which Mercury, among others, provides). Managed security services delivered by SecureWorks, IBM, and Verizon fall into this category, as do such cloud-based anti-spam services as Postini, recently acquired by Google. Other offerings include desktop management services, such as those offered by CenterBeam or Everdream.
6. Service commerce platforms
A hybrid of SaaS and MSP, this cloud computing service offers a service hub that users interact with. They’re most common in trading environments, such as expense management systems that allow users to order travel or secretarial services from a common platform that then coordinates the service delivery and pricing within the specifications set by the user. Think of it as an automated service bureau. Well-known examples include Rearden Commerce and Ariba.
7. Internet integration
The integration of cloud-based services is in its early days. OpSource, which mainly concerns itself with serving SaaS providers, recently introduced the OpSource Services Bus, which employs in-the-cloud integration technology from a little startup called Boomi. SaaS provider Workday recently acquired another player in this space, CapeClear, an ESB (enterprise service bus) provider that was edging toward b-to-b integration. Way ahead of its time, Grand Central — which wanted to be a universal “bus in the cloud” to connect SaaS providers and provide integrated solutions to customers — flamed out in 2005.
Differences Between Dedicated Server, Cloud Computing and VPS
Many people still do not know or are confused when speaking of the major differences between Cloud Server Hosting, Virtual Private Servers (VPS) and Dedicated Servers. Starting with the most basic, you know what to serve?
Quite simply, all the three technologies are used to store data, host websites and structures of e- mail, besides running various applications and softwares. So if they serve for the same thing because they are different?
Each has a different characteristic, let us understand :
Dedicated Servers
It is a physical machine, usually allocated on a fully equipped data center and is totally dedicated to one customer who requires high reliability and high performance hardware ( processing, memory , etc.)… If the client needs more resources, you must purchase more hardware and manually install or exchange server. Its main advantage is the high performance and flexibility and its disadvantage is the high price and inability to upgrade / downgrade immediately. This is one of the best flexible solution than shared web hosting, as because the owner gets a total control over the hosting environment and every aspects of the dedicated hosting, which includes the selection of operating system, server hardware, etc… Some web hosting providers may provide the server administration for free, but usually, the client has to manage the server administration and management tasks.
Cloud Server Hosting (Cloud Computing)
Already Cloud Server is a fractionation of a number of resources available to multiple servers and storage arrays. Through an intelligent architecture, you can allocate these resources allows scalability without losing performance. Besides the economy and flexibility, there are numerous advantages to this technology.
Virtual Private Servers (VPS)
It is the fractionation of resources from one physical server, this fractionation being allocated to a single client. VPS is an ideal choice for businesses that requires same flexibility, reliability, security, root access, stability, etc… at much affordable rates that a dedicated server offers. In this technology there is no guarantee of processing and in case of hardware failures, client applications that depend on it will also fail, as there is integration servers like the Cloud.
We simplify the concepts so that everyone can understand, of course there are many other details, but overall this is it!
How Cloud Computing Can Be A Better Way | How is Cloud Computing Different than Traditional Applications?
In order for traditional applications to work properly, they require a data center with power, an office, cooling, servers, networks, bandwidth and storage. Even once you’ve met all those requirements, you need a professional to install them, configure them and make sure they’re running as they should. As much time, effort and money that goes into these programs by large businesses, you can only imagine the headache they pose for small businesses or individuals.
Cloud computing will help you run your business better and more efficiently for many reasons. Unlike many traditional business apps, applications that are cloud based can be up and running in a couple of days. Let’s face it – for your business to be efficient, you can’t have a lot of downtime. Cloud computing will also save you money because you don’t have to pay tons of money in employee wages to run your applications as well as many products to keep them running and updated. Any performance or security enhancements and upgrades your cloud based programs need, they’ll get automatically.
Another way you’ll save with cloud computing is by not having to constantly buy software and servers. They don’t take up as much of your IT resources as traditional applications.
Cloud Computing Market Will Reach $16.7 Billion by 2013
As more and more organizations starting to transition their data into the cloud and tap into web-based applications, the global cloud computing market is continuing to grow at high speed.Analyst firm 451 Market Monitor has predicted that it expects the cloud computing marketplace to reach $16.7 billion in revenue by 2013.
According to its report, the large and well-established software-as-a-service (SaaS (News - Alert)) category, cloud computing will grow from revenue of $8.7bn in 2010 to $16.7bn in 2013, registering a compound annual growth rate (CAGR) of 24 percent.
The research firm believes that the core cloud computing market will grow at much more rapid pace as the cloud increasingly becomes a mainstream IT strategy embraced by corporate enterprises and government agencies.
Excluding SaaS revenue, cloud-delivered platform and infrastructure services will grow from $964m in revenue in 2010 to $3.9bn 2013 - a CAGR of 60% - the report said.
The core market includes platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) offerings, as well as the cloud-delivered software used to build and manage a cloud environment, which The 451 Group (News - Alert) calls 'software infrastructure as a service' (SIaaS).
Cloud-based storage will play a starring role in cloud growth, accounting for nearly 40 percent of the core cloud pie in 2010. "We view storage as the most fertile sector, and predict that cloud storage will experience the strongest growth in the cloud platforms segment," the report says.
In June, Gartner said worldwide cloud computing services market is poised for strong growth and its revenue might reach USD 148.8 billion by 2014.
Last month, another market analyst firm Renub Research had predicted that global cloud computing market might cross $25 billion by the end of 2013.
MY IDEAS: I think we can also develop cloud processing units. In which we will have a super computer in a place and the users of it will only need to have a high really high speed internet and a small processor which only need to interact a software ( browser like) that would take the info from the user send it to super computer and present the output info to the user. This idea would be cost-efficient when people will have to buy expensive computers processors and graphic cards but only the would have to buy a 5 dollar processor and every thing will be done by the supercomputer in backend. My ideas about the payments is that a person will pay for the number of MBs that the supercomputer processed. ( M. Haseeb Javed)
Tag :
Interesting Info
What Is A Botnet?
A large number of computers that have been infected, and effectively hijacked, can be grouped together to achieve a common purpose.
This group of hijacked computers is commonly referred to as a ‘botnet’.
what is a botnet?
Cyber criminals, who are often part of global syndicates, can remotely control all of the machines in a botnet whilst retaining almost complete anonymity.
Botnets are often utilised for a variety of purposes, all without the user’s knowledge.
These nefarious tasks include -
§ sending huge amounts of spam emails
§ launching denial of service attacks against targeted websites
§ spreading viruses
§ stealing personal information for identity theft attacks
Additionally, because botnets are controlled remotely, they can be used to install software, such as keyloggers, which can then be used for monitoring keystrokes on a computer keyboard.
This will then typically yield passwords and information about various accounts, such as bank accounts and social networking profiles, allowing the controller(s) of the botnet to commit fraud or propagate the hijacking through other sites.
At this moment in time there is no easy method of disabling botnets as those behind them are extremely clever at hiding their work and re-routing information in order to evade detection.
There are a large number of botnets in existence across the globe, the most notable of which is probably Waledec which is linked to the notorious Conficker worm, and may have several millions of computers in its network.
This group of hijacked computers is commonly referred to as a ‘botnet’.
what is a botnet?
Cyber criminals, who are often part of global syndicates, can remotely control all of the machines in a botnet whilst retaining almost complete anonymity.
Botnets are often utilised for a variety of purposes, all without the user’s knowledge.
These nefarious tasks include -
§ sending huge amounts of spam emails
§ launching denial of service attacks against targeted websites
§ spreading viruses
§ stealing personal information for identity theft attacks
Additionally, because botnets are controlled remotely, they can be used to install software, such as keyloggers, which can then be used for monitoring keystrokes on a computer keyboard.
This will then typically yield passwords and information about various accounts, such as bank accounts and social networking profiles, allowing the controller(s) of the botnet to commit fraud or propagate the hijacking through other sites.
At this moment in time there is no easy method of disabling botnets as those behind them are extremely clever at hiding their work and re-routing information in order to evade detection.
There are a large number of botnets in existence across the globe, the most notable of which is probably Waledec which is linked to the notorious Conficker worm, and may have several millions of computers in its network.
Tag :
Viruses
Basic Commands of Nmap.
Basic commands of Nmap are as following:
nmap -v scanme.nmap.orgThis option scans all reserved TCP ports on the machine
scanme.nmap.org . The -v option enables verbose mode.Launches a stealth SYN scan against each machine that is up out of the 256 IPs on the class C sized network where Scanme resides. It also tries to determine what operating system is running on each host that is up and running. This requires root privileges because of the SYN scan and OS detection.
Launches host enumeration and a TCP scan at the first half of each of the 255 possible eight-bit subnets in the 198.116 class B address space. This tests whether the systems run SSH, DNS, POP3, or IMAP on their standard ports, or anything on port 4564. For any of these ports found open, version detection is used to determine what application is running.
Asks Nmap to choose 100,000 hosts at random and scan them for web servers (port 80). Host enumeration is disabled with
-Pn since first sending a couple probes to determine whether a host is up is wasteful when you are only probing one port on each target host anyway.This scans 4096 IPs for any web servers (without pinging them) and saves the output in grepable and XML formats.
Tag :
Nmap,
REAL HACKING
What is Nmap?
Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network. To accomplish its goal, Nmap sends specially crafted packets to the target host and then analyzes the responses. Unlike many simple port scanners that just send packets at some predefined constant rate, nmap accounts for the network conditions (latency fluctuations, network congestion, the target interference with the scan) during the run. Also, owing to the large and active user community providing feedback on its features and contributing back, nmap has succeeded to extend its discovery capabilities beyond basic host being up/down or port being open/closed to being able to determine operating system of the target, names and versions of the listening services, estimate uptime, the type of device, presence of the firewall.Nmap runs on Linux, Microsoft Windows, Solaris,HP-UX and BSD variants (including Mac OS X), and also on AmigaOS and SGI IRIX. Linux is the most popular nmap platform with Windows following it closely.
Nmap is a software that search the host for the open ports and the services available that is the first step in hacking a website or computer.
Tag :
Nmap,
REAL HACKING
Metasploit Basic Tutorial.
Its a powerful tool used for penetration testing. Learning to work with metasploit needs a lot of efforts and time. Ofcourse to can learn metasploit overnight, it needs lots of practice and patience
Download here(windows user) http://www.metasploit.com/releases/framework-3.2.exeDownload here(linux user) http://www.metasploit.com/releases/framework-3.2.tar.gz
Just give a look at following basic steps for beginners to break into a system using metasploit after gathering some information about the target system.1. Select a right exploit and then set the target. 2.Verify the exploit options to determine whether the target system is vulnerable to the exploit. 3.Select a payload 4.Execute the exploit.You must be confused !!!!
Now carefully read the following basic terms to get an idea about these four steps mentioned above .I have defined the terms technically and side by side explained in layman language to clarify the things. I have taken an example that an attacker wants to break into a house . I hope my this approach will give you a great idea about these basic terms .
Vulnerability -A weakness which allows an attacker to break into or compromise a system's security.
Like the main gate of house with a weak lock (can be easily opened) , a glass window of house(can be easily broken) etc can be the vulnerabilities in the systems which make it easy for an attacker to break into.
Exploit - Code which allows an attacker to take advantage of a vulnerability system.
The set of different keys which he can try one by one to open the lock , the hammer with him which he can use to break the glass window etc can be the exploits.
Payload- Actual code which runs on the system after exploitation
Now Finally after exploiting the vulnerability and breaking in , he can have different things to do. He can steal money, destroy the things or just can give a look and come back.. Deciding this is what we mean by setting the Payload.
I hope its enough friends, You will learn more with further tutorials when you will start working with metasploit practically.
Tag :
Metasploit,
REAL HACKING
What is Keylogger?
A Keylogger is a Program or hardware that record all the typed material.
"Keystroke logging (often called keylogging) is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis."
According to Wikipedia.
Types Of Keyloggers::
There are two main types of keyloggers:
1: Hardware
2: Software
How can they be used for hacking.
For hacking Software Keyloggers are used which are installed on Victims computer manually or remortely and then the report of the the Keylogger is presented to the Hackers in form of Email or it is uploaded to specific FTP account of Hacker.
Where Can i Get a Keylogger?
Most of Keyloggers are expensive commercial one. But I will put some free and cracks of Keyloggers soon which are free!!!!
"Keystroke logging (often called keylogging) is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis."
According to Wikipedia.
Types Of Keyloggers::
There are two main types of keyloggers:
1: Hardware
2: Software
How can they be used for hacking.
For hacking Software Keyloggers are used which are installed on Victims computer manually or remortely and then the report of the the Keylogger is presented to the Hackers in form of Email or it is uploaded to specific FTP account of Hacker.
Where Can i Get a Keylogger?
Most of Keyloggers are expensive commercial one. But I will put some free and cracks of Keyloggers soon which are free!!!!
Tag :
Keyloggers
There is a far better way to get into Windows XP. It is easy and it does not reset the password. Hack into a computer running Windows XP without changing the password and find out all and any passwords on the machine (including admin accounts). You do not need access to any accounts to do this. Of course, do not do this on anyone elses computer without proper authorization.
Steps to Hack into a Windows XP Computer without changing password:
1. Get physical access to the machine. Remember that it must have a CD or DVD drive.
2. Download DreamPackPL from Official website or from Rapidshare.
3. Unzip the downloaded dreampackpl_iso.zip and you’ll get dreampackpl.ISO.
4. Use any burning program that can burn ISO images.
5. After you have the disk, boot from the CD or DVD drive. You will see Windows 2000 Setup and it will load some files.
6. Press “R” to install DreamPackPL.
7. Press “C” to install DreamPackPL by using the recovery console.
8. Select the Windows installation that is currently on the computer (Normally is “1″ if you only have one Windows installed)
9. Backup your original sfcfiles.dll by typing:
“ren C:\Windows\System32\sfcfiles.dll sfcfiles.lld” (without quotes)
10. Copy the hacked file from CD to system32 folder. Type:
“copy D:\i386\pinball.ex_ C:\Windows\System32\sfcfiles.dll” (without quotes and assuming your CD drive is D:)
11. Type “exit”, take out disk and reboot.
12. In the password field, type “dreamon” (without quotes) and DreamPack menu will appear.
13. Click the top graphic on the DreamPack menu and you will get a menu popup.
How to Hack Into a Windows XP Computer Without Changing Password – www.crack$hack.ws
14. Go to commands and enable the options and enable the god command.
How to Hack Into a Windows XP Computer Without Changing Password – www.crack$hack.ws
15. Type “god” in the password field to get in Windows.
You can also go to Passwords and select “Logon with wrong password and hash”. This option allows you to login with ANY password.
