Sunday, September 11, 2011

BUG IN XP EXPLANATION!!

act. if you:

1. Load Notepad in Windows (in my case XP Pro)

2. Type "bush hid the facts" (all in lowercase, no quotes)

3. Save this file under a name of your choice

4. Re-open the file

you will not see the text that you typed, but instead you will see a bunch of squares (or, as I later found out, some Chinese characters - that is, if you have the Chinese fonts installed, which is not my case).

Most people think it's a Windows Notepad easter egg (I thought so myself, to be honest), but in fact, it isn't. It's just a lousy Notepad bug. Let me explain...

I was myself curious about the cause of this phenomenon, and I found out that this text is not the only one to cause problems. There are other strings that cause Notepad to screw up, including "this app can break", which was another version of the bug that generated a lot of buzz. I've personally tested a series of strings that have the same effect, including "this api can break", "this cat can split", "jane can not dance", "text wit hou tcaps" and even "abcd efg hij klmno" and "xxxx xxx xxx xxxxx". What do these phrases have in common? They are made up by four words made up by four, three, three and five letters, all lowercase. So, by induction, all "4-3-3-5" strings should work.
Now, let's get to why this thing happens. First of all, it seems that Notepad writes the files just fine, it just can't read them again correctly. As a proof, try opening your saved file, the one that Notepad screws up, with another text editor. I used EditPlus and it turned out to be OK. So why the Notepad thing then? Well, it's a Windows thing. Notepad uses a Windows function that allows it to figure out whether a text file is Unicode or not. And that function, my friends, is the one that screws it up. Because the way it checks can easily be described as "guessing". And it guesses that the file is actually Unicode, and not Ascii, as it is supposed to be.
CONTD....

UG IN XP EXPLANATION!!

Now, two different but similar explanations can be given.

The first is that, after the ASCII-to-hex conversion of the string, Notepad rearranges the hex codes not according to ASCII standards, but to Unicode, and that messes it up. Here's the example:

Take "bush hid the facts". The hex codes (they can be seen with any hex editor you want to download) for the string are:

62 75 73 68 20 68 69 64 20 74 68 65 20 66 61 63 74 73

Arrange the codes to make up Unicode characters and you get:

7562 6873 6820 6964 7420 6568 6620 6163 7473

You'll notice that every code is hyperlinked. If you click on each one of them, you'll see that each one represents a Chinese (I think) "letter".

So this whole thing's cause is the coincidence that the 18 ASCII characters happen to represent 9 Unicode characters. And, of course, Windows' inability to determine the right encoding of the file.

The second explanation is slightly different, but the basics are the same: the difference between ASCII and Unicode. It's just a matter of Notepad defaults. You see, when you save the file, in the "Encoding" field, the default drop-down is set to ANSI. So, by default, Notepad saves as ANSI. But if you do a File -> Open, the default Encoding is set to Unicode. That's exactly what happens when you double click a saved file. Notepad knows the path, but not the Encoding. So it uses the default Unicode encoding, which spits the Chinese characters as explained above.

And that's about it. No easter eggs, no conspiracies, no Bush interventions. Just plain old Microsoft.
BY,

Saturday, September 10, 2011

Free Megaupload Premium Link Generator Service (100 % Legit and Working)

During the Past month i got many emails from my blog readers especially from A.Hossain asking me to post an article on some kind of hack which will enable us to download  megaupload files Like a premium user  , Most of us know that there are lots of  free premium link generators which claim to generate Premium links for your downloads but about 90 % of those generators are fake , That's why i always advice my blog readers to use torrents , But yesterday when i was surfing the net i came across Megakey service which claims to generate premium links for Megaupload. So i decided to test it, and i found out that it was a 100 % legit and working service , So today i wanted to share this hack with you. Follow the steps given below to download Megaupload files like a premium User   It is a free service provided by magakey it removes limitations on megaupload files and megaupload videos ,Its a 100 % legit  and working service ,Its free from malware and viruses 1. To use this service you have to first install megakey software ,You can Download megakey software From Here & to get the password click Here 2. Extract the file using Winrar or Winzip and Install the megakey software 3. After installing you will see a Small  Megakey icon on the task bar  as shown , Right click and  select megakey benefits
4. Now check all the boxes and enter your information as shown
5. Now open your browser, paste your megaupload link that you want to download,  Now You will see a premium download button as shown
Note :- This service only works two hours a day (9.00 AM to 11.00 AM GMT ). Use the GMT Time converter to know your corresponding local time ,You can also check it by going to megaupload .com, If your with in the particular time you will see a small smiley icon on the top right corner near login saying its happy hour

Hope you like the Post , If you have any doubts regarding the Article please fell free to post a comment  

Arachni v0.3 Released – Web Application Security Scanner Framework

It’s been a while since we last mentioned Arachni, it was back in February – Arachni v0.2.2.1 – Web Application Security Scanner Framework.


For those who are not aware, Arachni is a fully automated system which tries to enforce the fire and forget principle. As soon as a scan is started it will not bother you for anything nor require further user interaction. Upon completion, the scan results will be saved in a file which you can later convert to several different formats (HTML, Plain Text, XML, etc.)


The project was initially started as an educational exercise though it has since evolved into a powerful and modular framework allowing for fast, accurate and flexible security/vulnerability assessments..


More than that, Arachni is highly extend-able allowing for anyone to improve upon it by adding custom components and tailoring most aspects to meet most needs.


The author notified us of a major new release (v0.3) which has some great new features, a few of those being:


A new custom-written, lightweight SpiderAdd-on support for the WebUI Scan schedulerAutoDeploy — Convert any SSH enabled Linux box into a DispatcherImproved accuracy of differential analysis auditsImproved accuracy of timing attack auditsHighly optimized timing attacks

If you are interested in the WebUI aspect you can check out some screenshots here, the more comprehensive ChangeLog is also available here.


For those of you into benchmarking and testing you might be interested to know that during a recent test Arachni was the only (from a long list of commercial and F/OSS systems) that hit 100% on both XSS and SQLi tests in the WAVSEP benchmark:


Commercial Web Application Scanner Benchmark


The author is doing a great job with this tool and rapidly closing the gap between free security scanners and the very expensive commercial options. If you do have any feedback on Arachni v0.3 drop a comment here or hit up the Arachni Google Group.


You can download Arachni v0.3 here:


arachni-v0.3-cde.tar.gz


Or read more here.

winAUTOPWN v2.7 Released – Windows Autohacking Tool

I’ve always been skeptical about this tool, especially seen as though the first version was released on April Fools day in 2009, anyway it’s 2 years later now and it still seems to be around so I think it’s worth publishing an update.


If any of you have actually tested this tool out, do drop a comment below.


winAUTOPWN and bsdAUTOPWN are minimal Interactive Frameworks which act as a frontend for quick systems vulnerability exploitation. It takes inputs like IP address, Hostname, CMS Path, etc. and does a smart multi-threaded portscan for TCP ports 1 to 65535. Exploits capable of giving Remote Shells, which are released publicly over the Internet by active contributors and exploit writers are constantly added to winAUTOPWN/bsdAUTOPWN. A lot of these exploits are written in scripting languages like python, perl and php. Presence of these language interpreters is essential for successful exploitations using winAUTOPWN/bsdAUTOPWN.


Exploits written in languages like C, Delphi, ASM which can be compiled are pre-compiled and added along-with others. On successful exploitation winAUTOPWN/bsdAUTOPWN gives a remote shell and waits for the attacker to use the shell before trying other exploits. This way the attacker can count and check the number of exploits which actually worked on a Target System.


New in v2.7


This version covers almost all remote exploits up-till mid-July 2011 and a few older ones as well. This version incorporates a few new commandline parameters: -perlrevshURL (for a PERL Reverse Shell URL), – mailFROM (smtpsender) and -mailTO (smtpreceiver). These are the commandline arguments required for a few exploits which require remote connect-back using a perl shell and email server exploits requiring authentication respectively. This version also tackles various internal bugs and fixes them.


A complete list of all Exploits in winAUTOPWN is available in CHANGELOG.TXT
A complete list of User Interface changes is available in UI_CHANGES.txt


Also, in this version :

BSDAUTOPWN has been upgraded to version 1.5.In this release you will also find pre-compiled binaries for :FreeBSD x86FreeBSD x64DragonFly BSD x86

You can download winAUTOPWN v2.7 here:


winAUTOPWN_2.7.RAR


Or read more here.

Agnitio v2.0 Released – Code Security Review Tool

It’s been a while since we’ve mentioned Agnitio, it was earlier this year in March: Agnitio v1.2 – Manual Security Code Review Tool.


The author notified me of a new version that was recently released with quite a few additions. For those not familiar with it, Agnitio is a tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.


Changes in V2.0


The major changes in v2.0 is the addition of a code analysis module which comes with Android and iOS rules, an editor for the checklist questions and the ability to create/edit/remove code analysis rules.

Fixed verify report button bug. It used to make the app crash if the report path field was empty because it didn’t check if it was empty before trying to use the field value.Delete profile functionality added on the “view profiles” tab. Some users requested this functionality.Removed hard coded filesystem paths and database names/locations from the code and make them configuration items.Data editor for both principles and checklist guidance sections. This allows users to customise the guidance using their own languages, guidance text etc.Increase the max size value of the text boxes on the principles guidance tab to allow more information to be entered by users.More accurate error on the profile creation tab – specify exactly what fields have been missed rather than listing all.Added “About” form with info, license, credits etcRegular expressions expanded to include a wider range of characters including non English characters.Turn the “other” language box red if the user clicks save with the other check box ticked but not language entered on the create and view profile tabs.Metrics tab now “returns” if only one app is available rather than trying to load all graphs and throwing a separate error for each one.

The author is always interested in feedback and has integrated a lot of it into v2.0 of Agnitio, if you want to give some suggestions/bug reports or whatever after using the tool you can do so via the Security Ninja blog here, or on Twitter @securityninja.


You can download Agnitio v2.0 here:


Agnitio v2.zip


Or read more here.

Mediggo – Tool To Detect Weak Or Insecure Cryptosystems Using Generic Cryptanalysis Techniques

Mediggo is an opensource cryptanalysis library. This library implements generic cryptanalysis techniques to detect weak or insecure cryptosystems or learn and practice with cryptanalysis.


This library is open source (LGPL licence) and written in C programming language. Samples and test cases are provided with each techniques:

the solution is not always given to make people practicethe solution can always be obtained by contacting the development team

Current Features

Detection and cryptanalysis of weakly implemented or trapped systems

Future Features

Automatic detection of statistical biases in cryptographic algorithms.Specific cryptanalysis tools.

You can download Mediggo here:


megiddo-0.4.0.tar.gz


Or read more here.

WebSurgery – Web Application Security Testing Suite

WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Brute forcer, Fuzzer for advanced exploitation of known and unusual vulnerabilities such as SQL Injection, Cross site scripting (XSS), Brute force for login forms, identification of firewall-filtered rules, DOS Attacks and WEB Proxy to analyze, intercept and manipulate the traffic between your browser and the target web application.


WEB Crawler


WEB Crawler was designed to be fast, accurate, stable, completely parametrable and the use of advanced techniques to extract links from Javascript and HTML Tags. It works with parametrable timing settings (Timeout, Threading, Max Data Size, Retries) and a number of rules parameters to prevent infinitive loops and pointless scanning (Case Sensitive, Dir Depth, Process Above/Below, Submit Forms, Fetch Indexes/Sitemaps, Max Requests per File/Script Parameters). It is also possible to apply custom headers (user agent, cookies etc) and Include/Exclude Filters. WEB Crawler come with an embedded File/Dir Brute Forcer which helps to directly brute force for files/dirs in the directories found from crawling.


WEB Bruteforcer


WEB Bruteforcer is a brute forcer for files and directories within the web application which helps to identify the hidden structure. It is also multi-threaded and completely parametrable for timing settings (Timeout, Threading, Max Data Size, Retries) and rules (Headers, Base Dir, Brute force Dirs/Files, Recursive, File’s Extension, Send GET/HEAD, Follow Redirects, Process Cookies and List generator configuration).
By default, it will brute force from root / base dir recursively for both files and directories. It sends both HEAD and GET requests when it needs it (HEAD to identify if the file/dir exists and then GET to retrieve the full response).


WEB Fuzzer


WEB Fuzzer is a more advanced tool to create a number of requests based on one initial request. Fuzzer has no limits and can be used to exploit known vulnerabilities such (blind) SQL Inections and more unsual ways such identifing improper input handling, firewall/filtering rules, DOS Attacks.


WEB Editor


A simple WEB Editor to send individual requests. It also contains a HEX Editor for more advanced requests.


WEB Proxy


WEB Proxy is a proxy server running locally and will allow you to analyze, intercept and manipulate HTTP/HTTPS requests coming from your browser or other application which support proxies.


You can download WebSurgery here:


Setup – setup.msi
Portable – websurgery.zip


Or read more here.

Friday, September 9, 2011

Uniscan 4.0 Released - vulnerability scanner


Uniscan 4.0 Released 


The Uniscan vulnerability scanner is aimed at information security, which aims at finding vulnerabilities in Web systems and is licensed under the GNU GENERAL PUBLIC LICENSE 3.0 (GPL 3). The Uniscan was developed using the Perl programming language to be easier to work with text, has an easy to use regular expressions and is also multi-threaded.


Uniscan Features Identification of system pages through a Web Crawler.Use of threads in the crawler.Control the maximum number of requests the crawler.Control of variation of system pages identified by Web Crawler.Control of file extensions that are ignored.Test of pages found via the GET method.Test the forms found via the POST method.Support for SSL requests (HTTPS).Proxy support.


Official Change Log : Uniscan is now Modularized.Added directory checks.Added file checks.Added PUT method enabled check.Bug fix in crawler when found ../ directory.Crawler support POST method.Configuration by file uniscan.conf.Added checks for backup of files found by crawler.Added Blind SQL-i checks.Added static RCE, RFI, LFI checks.Crawler improved by checking /robots.txt.improved XSS vulnerability detection.improved SQL-i vulnerability detection.


Download Here:
http://sourceforge.net/projects/uniscan/files/4.0/uniscan.tar/download

winAUTOPWN v2.7 – Windows Autohacking Tool


winAUTOPWN v2.7 – Windows Autohacking Tool


This version covers almost all remote exploits up-till mid-July 2011 and a few older ones as well. This version incorporates a few new commandline parameters: -perlrevshURL (for a PERL Reverse Shell URL), – mailFROM (smtpsender) and -mailTO (smtpreceiver). These are the commandline arguments required for a few exploits which require remote connect-back using a perl shell and email server exploits requiring authentication respectively. This version also tackles various internal bugs and fixes them.
A complete list of all Exploits in winAUTOPWN is available in CHANGELOG.TXT
A complete list of User Interface changes is available in UI_CHANGES.txt
Also, in this version :


BSDAUTOPWN has been upgraded to version 1.5.
In this release you will also find pre-compiled binaries for :
FreeBSD x86
FreeBSD x64
DragonFly BSD x86


Download winAUTOPWN v2.7
http://27.106.39.229/w/Downloads.html

Yersinia - tool for analyzing and testing networks and systems.


Yersinia - tool for analyzing and testing networks and systems.




Yersinia is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.


Currently, there are some network protocols implemented, but others are coming (tell us which one is your preferred). Attacks for the following network protocols are implemented (but of course you are free for implementing new ones):


Spanning Tree Protocol (STP)
Cisco Discovery Protocol (CDP)
Dynamic Trunking Protocol (DTP)
Dynamic Host Configuration Protocol (DHCP)
Hot Standby Router Protocol (HSRP)
IEEE 802.1Q
IEEE 802.1X
Inter-Switch Link Protocol (ISL)
VLAN Trunking Protocol (VTP)




Download Here:
http://www.yersinia.net/download.htm

tutorial on Session hijacking attack




When a user log in to the acccount, it starts a session with that account and this session ends up with logout. In a running session, user is given a session id which is unique identifier of the user for that session and is only valid for that session. Session hijacking is the type of attack in which hacker gain access to the session id to gain unauthorized access to information or services.


Session hijacking can be done at 2 levels: Network level (TCP and UDP session hijacking)Application level (HTTP session hijacking)


Network level (TCP and UDP session hijacking)


TCP session hijacking
TCP session hijacking is when a hacker takes over a TCP session between two machines. Since most authentication only occurs at the start of a TCP session, this allows the hacker to gain access to a machine. It can be done by following ways. IP Spoofing: Assuming the identityMan in the Middle attack using Packet SniffersBlind attacks which involves bruteforcing of session id.


UDP session hijacking
It is similar to TCP session hijacking but easier than that because UDP does not use packet sequencing and synchronizing.


Hijacking Application Levels
In HTTP session hijacking hacker tries to get access to the session ID used in the session to identify the user. HTTP is state less so it need session ID with each request. If hacker get the session id, he can hijack the victim's session. XSSMan in the middle attackBruteforcing session idMan in the browser attack
Session hijacking is widely used for hacking into website accounts. In websites, session id is stored in the form of cookies in the client browser. If you want to hijack some one's session, you have to steal the session informations of that user.
Session hijacking has been an ongoing problem for web browser developers and security experts for at least 5 years.


Prevention: Use of ArpON which is used to prevent Man In The Middle Attack through ARP Spoofing.Use of HTTPS protocol for secure sessions. It uses an encrypted sessions.Set the expiry time of cookies as less as possible.

WebSurgery v.0.6 Released - Web application testing suite




WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Brute forcer, Fuzzer for advanced exploitation of known and unusual vulnerabilities such as SQL Injections, Cross site scripting (XSS), Brute force for login forms, identification of firewall-filtered rules, DOS Attacks and WEB Proxy to analyze, intercept and manipulate the traffic between your browser and the target web application.


download Here:
http://www.surgeonix.com/blog/index.php/archives/117

XPath injection tutorial




X-path injection is a type of web attack which target a website that create XPath queries from user-supplied data. Querying XML is done with XPath, a type of simple descriptive statement that allows the XML query to locate a piece of information.  By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured, or access data that he may not normally have access to.


XPath Injections might be even more dangerous than SQL Injections since XPath lacks access control and allows querying of the complete database (XML document), whereas many SQL databases have meta tables that cannot be accessed by regular queries.


Now i am going to give a demo of this.. It is similar to SQL Injection attack


See this user.xml file

 
 
       
          Ben
          Elmore 
          abc 
          test123 
       
       
          Shlomy
          Gantz
          xyz 
          123test 
       
       
          Jeghis
          Katz
          mrj 
          jk2468 
       
       
          Darien
          Heap
          drano 
          2mne8s 
       
 


       
          Ben
          Elmore 
          abc 
          test123 
       
       
          Shlomy
          Gantz
          xyz 
          123test 
       
       
          Jeghis
          Katz
          mrj 
          jk2468 
       
       
          Darien
          Heap
          drano 
          2mne8s 
       





Xpath query              
//users/user[loginID/text()='abc' and password/text()='test123']


Now bypassing authentication in the query
//users/user[LoginID/text()='' or 1=1  and password/text()='' or 1=1]




See the link for detail demonstration.
link


Prevention


XPATH Injection can be prevented in the same way as SQL injection. Some of the
Input ValidationParametrized Queries

Packet Sniffer for Android phones


Packet Sniffer for Android phones

This is a nice app to capture and display WiFi and bluetooth traffic on Android phones. But for using this app, you have to root your phone and have "su" command install.



This app is based on the tcpdump package therefor it have to be installed manually.
1. Download and Install PacketSniffer App from the market or from the following link.
http://dl.dropbox.com/u/3775726/PacketSniffer/PacketSniffer.apk
2. Copy the precompiled TCPDUMP file to the "/data"  library on your phone:  
             first make sure your "/data" library has READ and WRITE privileges. if not use:  "chmod 777 data"
             in order to copy use the following command if you have ADB :"adb push c:\locationOfTheTcpdumpFile /data"
            in case you don't have ADB you can copy the tcpdump file to the SD card and do:  "cat /sdcard/tcpdump > /data/tcpdump
3. Give the tcpdump file Read Write and Exec privileges :    "chmod 777 /data/tcpdump"


Before you start to capture you can pick weather to save the captured data on a local SQL DB on the device
or on to a file on the SD card.


Read More on
https://sites.google.com/site/androidarts/packet-sniffer

download Sniffjoke - Anti-sniffing Framework & Tool For Session Scrambling


download Sniffjoke - Anti-sniffing Framework & Tool For Session Scrambling

SniffJoke is an application for Linux that handle transparently your TCP connection, delaying, modifying and injecting fake packets inside your transmission, make them almost impossible to be correctly read by a passive wiretapping technology (IDS or sniffer).


An Internet client running SniffJoke injects in the transmission flow some packets able to seriously disturb passive analysis like sniffing, interception and low level information theft. No server support is needed!


The internet protocols have been developed to allow two elements to communicate, not some third-parts to intercept their communication. This will happen, but the communication system has been not developed with this objective. SniffJoke uses the network protocol in a permitted way, exploiting the implicit difference of network stack present in an operating system respect the sniffers dissector.


How Does It Work?
It works only under Linux (at the moment), creates a fake default gateway in your OS (the client or a default gateway) using a TUN interface check every traffic passing thru it, tracks every session and
applyies two concepts: the scramble and the hack.


The scramble is the technology to bring:


A sniffer to accept as true a packet who will be discarded by the server, or
A sniffer to drop a packet who will be accepted by the server.
The scramble technology brings in desynchronisation between the sniffer flow and the real flow.


The bogus packet accepted by the sniffer is generated by the “plugin” is a C++ simple class, which in a pseudo statefull tracking will forge the packet to be injected inside the flow. is pretty easy to develop
anew one, and if someone wants to make research on sniffers attack (or fuzzing the flow searching for bugs) need to make the hand inside its.


The configuration permits to define blacklist/whitelist ip address to scramble, a degree of aggressivity for each port, which plugin will be used.


download here:
http://www.delirandom.net/sniffjoke/sniffjoke-howto-usage/

DarkComet-RAT v.4.0 released


DarkComet-RAT (Remote Administration Tool) is the most complete and one of the most stable RAT in the scene.this software is design for people that have a very good knowledge in computer security, it can be userfull in many case. 


Remote control your network computers (LAN / WAN) 
Remote assist your clients if you manage a company 
Find your lost passwords in your computers 
Spy your home networks (For your childs,Wife,Husband...) 
Test the security of your computers or your company 
To develop your knowledge in RAT softwares 


Change log: 
DarkComet-RAT is now compiled on Delphi XE instead of Delphi 2010. 
Synthax highlighter added in remote keylogger. 
Get hard drive information added in file manager 
Bot logs in main form had change, it is more efficient / fast and user friendly 
Whole system parser is now far stable and faster 
No-IP was moded and is now better ;) 
Flags manager has been ported to the main client settings form 
Now you can change the default size Width and Height of the users thumbnails 
No more menu in the top of the SIN (Main Window - Users list)so it is more clear 
and much more 


Download Here:
http://www.darkcomet-rat.com/process_download.php?id=5

Tutorial on Arbitrary File uploading Vulnerability


Tutorial on Arbitrary File uploading Vulnerability

Arbitrary File uploading vulnerabilities are the type of vulnerabiliy which occurs in web applications in which there is a file uploading form but file format is not checked or filtered during file upload.
Now you are thinking that what is the problem in that. Now think that the website has a uploader form which do not check for file type and you have a malicious  PHP, ASP script. You can upload the script using this form and then you can execute your malicious script on the website server. You can run any kind of commands on the server using your script which would lead to a full compromise of the server.
If you do not know how to create a malicious script, you can simly download those scripts from internet and use it on any server having this type of vulnerability.


Some PHP Shells :-


Ani-Shell
R57 Shell
C99 Shell


Note: This tutorial and script is only for educational purpose. Use of these scripts on web servers in illegal.

Download Xcobra - Web Application Vulnerability Scanner


Download Xcobra - Web Application Vulnerability Scanner

Xcobra - Web Application Vulnerability Scanner.


Features
URL finder with adjustable deep
Passive XSS scan
Forms processing
Simple SQL injection scan
Blind SQL injection scan
Plugins
Report generators (Text, HTML, ...)
CLI and GUI interfaces
Cross-platform (Python + GTK)


Download
http://code.google.com/p/xcobra/downloads/list

Spyeye Toolkit Has Been Leaked onto the Internet


Spyeye Toolkit Has Been Leaked onto the Internet

According to the report, the source code of the Spyeye toolkit has been leaked onto the Internet. This kit has been incorporating functionality of the Zeus malware builder kit since early 2011. the Spyeye toolkit, which includes the Zeus malware builder, was leaked by an infamous French security researcher named Xyliton, who is part of the Reverse Engineers Dream Crew (RED Crew).
Now the security researchers can analyse the code to know the actual working of the kit and modify it t make it more powerful. They can also get the info obout the working of this team.
Now it will be interesting to see the next updates of this kit by other security researchers..


Read More:
http://blog.damballa.com/?p=1357

How to use megaupload as premium user




If you want to enjoy megaupload as premium usr, download this tool and install. I got this tool on the website www.egyhacks.net and the reviews were good. The name of the tool is Megakey


Features.
1) It removes limitations on megaupload and megavideo.
2) It provides happy hour premium access to all mega sites.
3) It allows for ultra fast up & downloads thanks to multiplexing technology.
4) It identifies music files on your PC and make them available in your megabox.
5) It gives you a direct connection to mega servers.
6) No delays and availability. In the future you get free access to movies, music and games licensed by mega.


Download Here:


I am not the uploader of this tool and will not be responsible for this.. download at your own risk

Backtrack 5 R1 released






Backtrack, the operating system for pnetration testers, 5R1 released. 


This release contains over 120 bug fixes, 30 new tools and 70 tool updates.
The kernel was updated to 2.6.39.4 and includes the relevant injection patches.


The company posted on the blog, "We are really happy with this release, and believe that as with every release, this is our best one yet. Some pesky issues such as rfkill in VMWare with rtl8187 issues have been fixed, which provides for a much more solid experience with BackTrack. 
We’ve released Gnome and KDE ISO images for 32 and 64 bit (no arm this release, sorry!), as well as a VMWare image of a 32 bit Gnome install, with VMWare Tools pre-installed."


Download Here:
http://www.backtrack-linux.org/downloads/

download AnDOSid - DOS tool for android


download AnDOSid - DOS tool for android

A new product released by SCOTT HERBERT for Android mobile phones,Its AnDOSid - the DOS tool for Android Phones. The rise of groups like Anonymous and LuzSec, as well as constant India / Pakistan cyberwar has raised the issue of cyber-security high(er) in the minds of web owners.


Pentesting tools exist to simulate such attacks and help website security people defend against them, however for the most part they currently only exist for desktop computers. Mobile phones have, over the last few years, grown from simple devices that send and receive calls to mobile computing platforms which can be purchased for less than $100 a device.


AnDOSid fills that gap, allowing security professionals to simulate a DOS attack (An http post flood attack to be exact) and of course a dDOS on a web server, from mobile phones. AnDOSid is actively being developed and I welcome feedback from the security community as to how you would like the application to evolve.




Features:
Requires Internet access to send the http post data
Requires phone state to access the IMEI (one of the two identifiers sent with each post)


Download Here:
https://market.android.com/details?id=com.scott.herbert.AnDOSid&feature=featured-apps


A-ddos - Kernel solution to prevent ddos attack


A-ddos - Kernel solution to prevent ddos attack

a-ddos is a kernel patch in order to prevent DDos attack at the low-hardware-level. It works well on a netbridge.


DDos is short for distributed denial-of-service,it becomes a serious threat nowadays. There hasn't been a perfect solution yet. a-ddos uses 512M(128M in current version) memory to keep tracks of every ipv4 address and a kernel-level timmer to record connections pre-second. While under attack, only the available IPs are allowed to be connected to the server.


Highlighted features
Fast
In order to determine every connection, only one memory-access is needed.


Stable
The implementation is simple and fast, while under syn-flood attack a-ddos takes less than 10% cpu time to handle.


Flexible
It's easy to extend the memory usage, nevertheless 4G/8 bit = 512MB can handle the whole IPV4 space!


Download
http://code.google.com/p/a-ddos/downloads/list


Read more:
http://code.google.com/p/a-ddos/wiki/PreviewWiki

Funny Trick To Hack Facebook

If you really want to impress someone with your hacking skills then this trick will surely help you.Well this is actually not any hacking just a simple javacript trick but the other person will surely believe you as a hacker.
So what can you do with this trick?

You can edit content of any website including facebook,myspace,twitter etc.For instance see the pic
below(click to zoom)



How to perform this trick?
Open any website of your choice (like facebook) in  browser (internet explorer,google chrome,firefox) and clear the address bar of the browser.
Copy paste the following javascript code in the address bar of your browser


javascript:document.body.contentEditable='true'; document.designMode='on'; void 0


And thats it.Now you can edit anything that is written on the page.
How this trick actually work?
This is a javascript code on the the browser side.It is temporary and the changes will be gone once you refresh the webpage.
The javascript code JavaScript:document.body.contentEditable=’true’; makes the website editable in your browser.
The code document.designMode=’on’ tells the browser to turn the designmode on
The code void 0 tells the browser not to show any error
So, enjoy this funny trick to hack facebook

Encrypt Your Search Queries Using SSL Search Engine

Every time when you use a regular search engine, your search data is recorded. Major search engines capture your IP address and use tracking cookies to make a record of your search terms, the time of your visit, and the links you choose - then they store that information in a giant database.


What is SSL?
SSL (Secure Sockets Layer) is a protocol that helps to provide secure Internet communications for services like web browsing, e-mail, instant messaging, and other data transfers. When you search over SSL, your search queries and search traffic are encrypted so they can't be read by any intermediary party such as employers and internet service providers (ISPs).
Here a list of SSL (Secure Sockets Layer) search engines for anonymous Internet search is given below:
Encrypted Google Search over Secure Sockets Layer (SSL) get a complete encrypted search link between your computer and Google. When search traffic is encrypted, it can't be read by third parties trying to access the connection between a searcher's computer and Google's servers. The service is available on web searches only, images and maps search are still not using SSL encryption.
Google Encrypted can be accessed through:
https://encrypted.google.com

Duck Duck Go is an another SSL search engine Challenges Google on Privacy, Which pulls an seach result for Microsoft Bling’s and Google search APIs. It has its own syntax, !bang command allows you to search another site directly. It allows you to change the look and feel of search engine and another awesome thing is duck duck go managed by an single person named as Gabriel Weinberg's and there is no advisement in this search engine.
Duck Duck Go can be accessed through:
http://duckduckgo.com/
IxQuick SSL search engine was awarded as first European Privacy Seal. IxQuick changes its name to Startpage on July 2009. Ixquick privacy policy is to not save the IP number or any other private data on any search and it announced that it would remove its users personal data within 48 hours.
IxQuick | Startpage can be accessed through:
http://www.ixquick.com/
http://www.startpage.com/
Yauba is the world’s first privacy safe; real-time Search Engine. Yuba is a new, experimental, Indian search engine that seeks to transform the way people find information online, while providing maximum protection for their safety, security and privacy. Yauba privacy policy to claims that they do not use any cookies and they say to delete all of your personally identifiable information from their servers on a daily basis.
Yauba can be accessed through:
http://www.yauba.com/

Scroogle is an ad-free Google search proxy which prevents the searcher's data being stored by Google Scroogle aims at letting you use Google without getting tracked. They work very simply: they act as a middleman between you and Google: you send your search query to Scroogle, they send it to Google, Google sends Scroogle the result, and finally Scroogle sends you the result. In the end, Google has no way to know you’re the person who did the search. Additionally, Scroogle also offers the ability to search over an encrypted (SSL) connection, so your ISP (or corporate network, etc) can’t see what you’re searching either.
Scroogle can be accessed through:
http://www.scroogle.org/
https://ssl.scroogle.org/
 
Benefits of using SSL Search EngineTracking of your personal computer IP address is avoidedPeriod (Date & Time) of searching is hidedCookie that generated will be deleted after your search, Duck Duck Go search engine doesnot use cookies by defaultQuery terms/Keyword will not be stored in a database

Facebook RSS Reader Application: "Connect Blog|Website to Your Facebook"


RSS(Really Simple Syndication) is used to publish frequently updated works such as blog entries, news headlines, audio, and video in a standardized format. RSS reader is a small software program that collects and displays RSS feeds. It allows you to scan headlines and short description from a various website and blogs.
Facebook RSS reader application keeps your Facebook fans Page and friends to updated with the latest news from your sites. Using a RSS application is an great time saving i.e., the post you posted in blog/site will automatically transfer to a Facebook
How it works?
Facebook RSS reader application periodically checks the RSS/Atom feeds that you specify and compare the log file. If any new entry is found, it will publish in your Facebook Walls that you specify.
Top Facebook RSS Feed Reader Application:
RSS Graffiti: Reads your Feeds; Writes your Walls. RSS Graffiti allows you to publish multiple RSS/ATOM feeds on your Facebook profile's & page’s walls and automatically pushes them to the news-feeds (Facebook homepage) of your Facebook friends & fans.
Social RSS: Social RSS allows you to add your blog/favorite RSS feeds to your wall, boxes tab or a dedicated tab on your profile or Facebook Page. It updates automatically and lets your readers subscribe to the feeds if they wish!
Networked Blogs: Bring your blog to Facebook and Facebook to your blog. Supports multiple blogs, RSS and ATOM feeds, and fan/business pages. The best to import your feed. Get your blog networked with the largest blogger community on Facebook.
Benefit of RSS Reader Application
It connect your site to your Facebook fans and friendsIt increase your blog/website trafficYour visitor will get updated information about your site

Doxing - Hackers Information Gathering Technique

Doxing is a technique of tracing someone or gather information about an individual using sources on the internet. Its name is derived from “Documents” or “Docx”. Doxing method is based purely on the ability of the hacker to recognize valuable information about his target and use this information to his benefit. It is also based around the idea that, “The more you know about your target, the easier it will be to find his or her flaws”. This article gives you a brief explanation about doxing and explains how to hack user accounts using doxing


Information that You Can Find Using Doxing
People using internet usually left their information in some website and mostly in social networking site like Facebook, Twitter, Google Plus, etc. Information that you can find using doxing technique are given below.
ActivitiesBirthdayContact InformationGenderIP – AddressLocationNamePersonal InformationSocial Networking Site ProfilesWebsite and many more. . .
Useful Website for Doxing
Pipl - Most of the higher quality information about people is simply "invisible" to a regular search engine. Unlike a typical search-engine, Pipl is designed to retrieve information from the deep web. Pipl robots are set to interact with searchable databases and extract facts, contact details and other relevant information from personal profiles, member directories, scientific publications, court records and numerous other deep-web sources.
Wink - It’s similar to Pipl to find people by name and get their phone number,
Address, Websites, photos, work, school and more.
123people - 123people is a real time people search service that looks into nearly every corner of the Web.  Using 123people proprietary search algorithm, you can find comprehensive and centralized name related information consisting of images, videos, phone numbers, email addresses, social networking and Wikipedia profiles plus and much more.
Zaba Search - Information found using ZabaSearch is all available elsewhere on the web and is all public information. ZabaSearch is a search engine, not a database and does not house, create or manage the information in the search results.
WHOIS – Domain Tools provides a directory that serves as a comprehensive snapshot of past and present domain name registration and ownership records. Most Domain hacking is done by gathering information in this website
Social Networking Site - Social networking site is website where individuals can set up an online profile, describing his/her interests, and add links to other profiles. Social Networking is one of the major source for doxing technique. Some social networking sites like Facebook, Google Plus, Hi5, LinkedIn, MySpace, and Twitter contains lot of information about victim.
Search Engine - Search engine is designed to search for information on the World Wide Web and FTP servers. Information may consist of web pages, images, information and other types of files. Some top search engines for doxing are Ask, Bing, Google, Yahoo!.
Useful Tools for Doxing
Maltego - Maltego is an open source intelligence and forensics application. It will offer you timeous mining and gathering of information as well as the representation of this information in an easy to understand format.
Creepy - Creepy is an application that allows you to gather geolocation related information about users from social networking platforms and image hosting services. The information is presented in a map inside the application where all the retrieved data is shown accompanied with relevant information to provide context to the presentation.
How Doxing is Used for Hacking?
Hackers can gather information about the victim and create a dictionary file for a target person alone. Using that dictionary file, he can crack your passwords.Hacker can get the victim's security question answer using doxing.
Conclusion
Doxing needs Intelligence and searching ability. You have to guess where to search and what to search about person. Depending on searching ability, you will get what you required. Doxing is used mainly by Cyber Crime Experts and Hackers. Overall doxing is a powerful hacking technique. If you like this article please leaves your small comment/feedback below..

Creating IM Bot Using IMified with PHP

Instant messaging (IM) is a form of real-time direct text-based communication between two or more people using personal computers or other devices, along with shared clients. The user's text is conveyed over a network, such as the Internet. More advanced instant messaging software clients also allow enhanced modes of communication, such as live voice or video calling.
IM bot is a bot program that uses instant messaging as an application interface. IM users can add the name of the IM bot to their buddy list. Because the bot uses artificial intelligence, the end user thinks that he is talking to a real person and can forget that he is actually just querying a database. Some IM bots are able to connect to outside databases

IMified platform allows anyone with basic web programming skills to quickly and easily create and run an IMR (Interactive Messaging Response) application more commonly known as a "BOT" on public IM networks client like Google Talk, AIM, MSN, Windows Live, Jabber and Twitter.

Steps to create IM Bot using php
Here, I given steps to create a personal IM bot using php.
? Go to www.imified.com and register a new account.
? Now create a bot with your favorite server side programming language like PHP, Perl, Python or any other language.
Example :
";
break;
}
?>
? Once your bot script is ready, put it somewhere on your web server and note the url of your bot in web server
For Free Hosting|Web Server : x10hosting.com
? Now login to your imified account, and click "create a new bot". Fill the following field to complete your bot creation
Bot Name : General identifier for your bot
Example : Hacker's Lodge
Screen Name : To get you started we'll give you your own bot.im screen name that is accessible via Gtalk and Jabber. You can add other networks to your bot after its created.
Example : lodge4hacker@bot.im
Bot URL : Enter the url of your bot that you uploaded in web server.
Example : http://lodge4hacker.com/test.php
That's it, Now your IM bot is created!!.
? Finally add bot to your IM friends list and enjoy chat with your bot. This is a simple bot creation steps, you can a create your own bot to do things for you. Imified provides you a feature to connect bot to your existing IM account.

Conclusion
Imified provides a best platform to create your own Innovative And Inspiring bot,which helps you to do things faster. If you like this post please give your feedback with few lines in a below comment box.

Computer Cookie - Working, Vulnerability and Security


Computer cookies are small piece of information in text format that’s sent to an web browser by an web server. This information can be accessed either by the web server or by the client computer. Cookie information can be used for authentication, identification of a user session, user's preferences, shopping cart contents, or anything else that can be accomplished through storing text data.

What are the types of Cookie?
Session cookiePersistent cookieSecure cookieHttpOnly cookieFirst-Party CookieThird-Party CookieSuper cookieZombie cookieUnsatisfactory Cookie
Role of Cookie in Internet
Session Management
Session management is the process of keeping track of a user's activity across sessions of interaction with the computer system.
Personalization
Cookies may be used to remember the information about the user who has visited a website in order to show relevant content in the future. For example a web server may send a cookie containing the username last used to log in to a web site so that it may be filled in for future visits.
Tracking
Tracking cookies may be used to track internet users' web browsing habits. This can also be done in part by using the IP address of the computer requesting the page or the referrer field of the HTTP request header, but cookies allow for greater precision.
How to View Cookies in Web Browser?
Microsoft Internet Explorer
Open the Microsoft Internet Explorer software program.Click on “Tools” in the main menu area of the Internet Explorer browser.Scroll down and select “Internet Options” from the tools menu.Look under the Browsing History section on the General settings tab.Press the “Settings” button.Select the “View Files” button and scroll down until you see the files labeled as cookies.Mozilla Firefox
Start or open your Firefox Internet browser.Select the “Tools” option from the main menu of the Firefox 3 software program.Find the “Options” setting on the tools menu and click on it.Click on the “Privacy” button.Locate the “Use Setting for history” tab and select the “Show Cookies”.Google Chrome
Launch your Google Chrome Internet browser.Find the wrench icon located on the main menu and right click on it.Choose “Options” from the menu.Locate and select the “Under the Hood” tab.Look under cookie settings and press “Show Cookies.”Apple Safari

Open the Safari Internet browser software program.Click on “Preferences” in the main browser menu.Discover the “Security” tab and click on it.Select the “Show Cookies” option on the Security.
Vulnerability on Cookies
Cookies are tracking devices for websites They keep track of commonly used information to help your browser operate more efficiently. They usually won't store passwords but often times track browser history, usernames, and other possible identifiers that can be used to gain access to accounts or exploit security vulnerabilities in your computer. Often they are simply text or web URL files so they won’t contain programs (i.e. viruses). The problem that cookies pose is that they have the ability to “share” this information over the internet.
How to Prevent Cookie from hackers?
Delete all cookies or individual cookies from your browser regularlyUse an updated antivirus in your systemEnable a firewall in your systemUse HTTP Secure Connection if available

Brute Force Attack

Brute force attack is a computer cracking technique in which the attacker uses an automated program to try every possible combination for a password.This password attack does not attempt to decrypt any information but continue to try different passwords again and again to gain a authentication/access.The amount of time it takes to complete these attacks is dependent on length of the password.Traditional brute force attacks attempt to guess username and password combinations for services like FTP, SSH, or other authenticated

Example
Let us assume the password length is 3. we have characters set (abcdefghijklmnopqrstuvwxyz0123456789)
Number of Permutation to first character :
Upper case letters(26 )+Lower Case Letters(26)+10 Numbers =62
Total permutation to find Password:
62*62*62=238328 ways.
Thus the automated brute force program need to try for an 238028 possible password. You can also calculate the time take to complete the brute force attack from "Last Bit"

Tools for Brute Force Attack
Here,I suggest some of the tools to crack an password using brute force technique
Cain and Abel
Aircrack
L0phtcrack
Brutus

Advantage
Probability of finding the password highIts fairly simple attack that doesn't require a lot of work to setup or initiate.
Disadvantage
Brute Force attack is noisy, and they take a long timeIt takes an processing power and hardware intensive.Nowadays a security measures is done that they might lock you out after 3 fail attempts and this extends the amount of time needed to crack

Free Backlink Checker Tools to Find Your Link Popularity

Backlinks are the links on other websites that direct the users to your website/blog, This incoming links to your website is used to determine the page rank of your site in a search engine like Google,Yahoo,Bling,etc., The number of backlinks is one indication of the popularity or importance of that website or blog

Lot of tools are available in online to check your site backlink. Here, I suggest you some backlink checker tools that show maximum accuracy or your link popularity.
Backlinkwatch: This is a most popular tool to check your bakclinks, dofollow or nofollow links, anchor text links, no of out bound links and more.
iwebtools: It’s also very popular like backlinkwatch.com. its shows no of backlinks, with page rank of the link.


Backlink Analyzer: Good tool to check your link popularity. Its shows anchor links, number of out bound links and more.


Backlink Finder: Favorite backlink checker tool, it’s says no of links in google, yahoo, alexa rank, domain age and more.
Webmaster Toolkit: The Link Popularity Checker tells you how many websites are linking to yours. You should try different methods of inputting your URL, as some search engines treat them differently. Different methods will probably produce slightly different results.
Submit Express: How popular is your website? This tool will show you how many other sites are linking to you. Most search engines use this data to calculate how popular your website is.
Link Popularity.com: Knowing who links to your site and increasing the number of quality links is an important part of any web site promotion effort. This free service allows you to query Google, Yahoo, and MSN and reports on link popularity.
SEO Centro: The Link Popularity analysis program will search Google, Yahoo, AllTheWeb, AltaVista, and MSN to determine how many pages are linking to your web page.


Add pro: Use this free tool to check the number of web pages linking to your site. You can also use it to find out how many links your competitors have and who’s linking to them. Some of the websites that are linking to your competitors could also be linking to you, if you let them know you exists.
SEO Chat: This tool will query all the major search engines (Google, Yahoo, and MSN) when you enter the “link:” operator with your chosen URL. It will return the total link count for each URL.
Add me: To find out how popular your site is, just enter your URL in the box below and press the “Check Popularity” button. If your site represents a business, don’t forget to also check your competitors backlinks as well! You might be surprised by the results.
SEO Guy: Just type in www.domain.com in the “Your URL” Field and hit “GO” also if you want to see how you stack up against your competition feel free to place up to 3 competitors URL’s in there to compare.
Free Web Submission: Their Link Popularity script checks links to your website on 3 major search engines.
SELF Seo: With this tool you can check the link popularity for any given page – just enter the URL in the box below. You will see how many links has been already “noticed” by the major search engines – Google, Yahoo, MSN, AltaVista, and Alltheweb & Hotbot.
Go Rank Tool: This link popularity tool will detect up to the first 30 links currently present in Google as backlinks for the URL you enter. This tool then analyzes the contents of each of these pages for the specific link text to the URL you selected. The text of each link is displayed in the final report as well as the title of each linking page.
Google Backlink Checker tool: Google Back link Checker tool enables you to know the number of websites who have given a link to your website or web page.
Yahoo Backlink Checker Tool: A back link is an inward link to your site that may or may not be reciprocated with an outward link back. If page A links to page B then a back link would be a link which goes from page B back to page A.
MSN Backlink Checker Tool: Our tool for checking your back links tells you how many websites are linking to yours. Website popularity is an important factor in your search engine ranking.
Link Popularity Checking Tool: Tells you the number of backlinks for AltaVista & All the web.
Link Popularity Comparison Tool: This Link Popularity Comparison Tool allows you to quickly and easily compare your link popularity scores to competitor’s websites.


Web Confs Backlink Summary Tool: This tool will give you a summary of your competitor’s backlinks.


Multiple Datacenter Backlink Checker Tool: Their Multiple Datacenter Backlink Checker Tool helps you determine the backlinks of your site with various Google Datacenters.
Link Popularity Romov: Measure the link popularity by checking its Google Page Rank, search engine backlinks, Alexa traffic rank, as well as its popularity on major social networking web sites.


Free Link Popularity Checker Tool: Link Popularity Check offers free, instant, online reports of a webpage’s link popularity rating in 3 top search engines; Google, Yahoo! Search and Bing (MSN)

Make Firefox Address Bar Work Like Google Chrome's OmniBar

Google Chrome‘s Omnibar is one of the best feature in an Chrome browser, which combines the regular address bar and the search box into one which is said to be an "Omnibar". Mozilla Firefox being the most popular and fastest  browser has an many features but it loses this Omnibar feature.

Omnibar Firefox addon that integrates Address bar  and Search bar of the browser into one bar allowing you to search directly using the address bar. After its installation, on typing the search query in the address bar, Omnibar for firefox shows your search and URL suggestions. It can also quickly switch search engines using search engine keywords.

Download link for Omnibar Add-on :
https://addons.mozilla.org/en-US/firefox/addon/omnibar/
Note: To View the above picture in larger view click on the picture

Disable Google.com From Redirecting To Local Country Google Domain

Google Web Search is customized for a number of countries and regions across the world. For example, Google.co.in provides search results that are most relevant for users in India; Google.co.uk is the Google domain for United Kingdom.Google try to direct users to the site that will give them the most relevant results.


Google.com redirects to local Google country specific domain, depending on the country you are located. For example in India Google.com redirects to Google.co.in and In China Google.com redirects to Google.cn, Similarly it redirects in other countries.In the below picture "Image-1" show browser before redirecting,"Image-2" shows browser after redirecting.  

How to disable this redirection and use Google.com for search queries?
  This does not involve any software or plugin install. Just type www.google.com/ncr instead of just typing www.google.com in the address bar, where ncr stands for “No Country Redirect”. Next time you type Google.com it won’t get redirected to your country google domain.This information is stored in cookie and you can turn ON the redirection again by deleting internet files and cookies.