Researchers Uncover Spying Tool Used by Governments to Hijack all Types of Smartphones #Hacking #Privacy #Spying #Hijacking #Surveillance

Purchasing malware to victimize people is illegal by laws but if the same thing any government official do, then its not!! Yes, the police forces around the World are following the footsteps of U.S. National Security Agency (NSA) and FBI.

Researchers from the Citizen Lab at the Munk School of Global Affairs at the University of Toronto and computer security firm Kaspersky Lab have unearthed a broad network of controversial spyware which is specially designed to give law enforcement agencies complete access to a suspect's phone for the purpose of surveillance.

MALWARE FOR DESKTOPS AND ALL MOBILE DEVICES

The malware, dubbed as Remote Control System (RCS), also known as Da Vinci and Galileo, is developed by an Italian company known as Hacking Team, available for desktop computers, laptops, and mobile devices. The latest version of the malware works for all phone including Android, iOS, Windows Mobile, Symbian and BlackBerry devices, but best on Android devices, and can also be installed on jailbroken iOS devices. But even if the targeted iOS device is not jailbroken, the malware uses the famous Evasi0n jailbreaking tool to install the malware easily.

The team of researchers from both Citizen Lab and Kaspersky Lab in collaboration has presented their findings during an event in London. According to the report published, the diameter of the command infrastructure supporting Hacking Team, which sells the RCS to governments and law enforcement, is very vast with 326 command-and-control (C&C) servers running in more than 40 countries.

MALWARE DEVELOPERS - ‘HACKING TEAM’

Hacking Team is a Milan-based IT company with more than 50 employees that has made a totally different place for itself selling "offensive" intrusion and surveillance software to governments and law enforcement agencies in "several dozen countries" on "six continents."

“It was a well-known fact for quite some time that the HackingTeam products included malware for mobile phones. However, these were rarely seen,” said Kaspersky Lab experts on the blog post. “In particular, the Android and iOS Trojans have never been identified before and represented one of the remaining blank spots in the story.”
WORLD WIDE WEB OF COMMAND-N-CONTROL SERVERS

Kaspersky Lab researchers have used a fingerprinting method to scan the entire IPv4 space and to identify the IP addresses of RCS Command & Control servers around the world and found the biggest host in United States with 64 counts of C&C servers. Next on the list was Kazakhstan with 49, Ecuador has 35, UK which hosts 32 control systems and many other countries with a grand total of 326 Command & Control servers.

"The presence of these servers in a given country doesn't mean to say they are used by that particular country's law enforcement agencies," said Sergey Golovanov, principal security researcher at Kaspersky Lab. "However, it makes sense for the users of RCS to deploy C&Cs in locations they control – where there are minimal risks of cross-border legal issues or server seizures."

RCS can be physically implanted on the victim’s device through a USB or SD card, and remotely it can be installed through spear phishing, exploit kits, drive-by downloads or network traffic injection.

Once installed on Apple iOS and Android device, the new module enable governments and law enforcement officers with larger capabilities to monitor victim devices, including the ability to:

• control phone network
• steal data from their device
• record voice E-mail
• intercept SMS and MMS messages
• obtain call history
• report on their location
• use the device’s microphone in real time
• intercept voice and SMS messages sent via applications such as Skype, WhatsApp, Viber, and much more.

"Secretly activating the microphone and taking regular camera shots provides constant surveillance of the target—which is much more powerful than traditional cloak and dagger operations," Golovanov wrote.

While, the Android module is protected by an optimizer for Android called DexGuard that made the it extremely difficult to analyze. However, most of the iOS capabilities mentioned above are also available for Android, along with the support for hijacking applications such Facebook, Google Talk, Tencent of China and many more.

The mobile modules for each are custom-built for each target, researchers said. From previous disclosures we have seen that RCS is currently being used to spy on political dissidents, journalists, human rights advocates, and opposing political figures.

Credited to: Hacker News Website

The Heartbleed Bug #Infosec #SSL #Vulnerability

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs). The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

What leaks in practice?

We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

How to stop the leak?

As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

---

Q&A

What is the CVE-2014-0160?

CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by MITRE. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.

Why it is called the Heartbleed Bug?

Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

What makes the Heartbleed Bug unique?

Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

Is this a design flaw in SSL/TLS protocol specification?

No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.

What is being leaked?

Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

What is leaked primary key material and how to recover?

These are the crown jewels, the encryption keys themselves. Leaked secret keys allow the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

What is leaked secondary key material and how to recover?

These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leak requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalidated and considered compromised.

What is leaked protected content and how to recover?

This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption. Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future.

What is leaked collateral and how to recover?

Leaked collateral are other details that have been exposed to the attacker in the leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks. These have only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.

Recovery sounds laborious, is there a short cut?

After seeing what we saw by "attacking" ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.

How revocation and reissuing of certificates works in practice?

If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.

Am I affected by the bug?

You are likely to be affected either directly or indirectly. OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet. Your popular social site, your company's site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

How widespread is this?

The most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to Netcraft's April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.

What versions of the OpenSSL are affected?

Status of different versions:

• OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
• OpenSSL 1.0.1g is NOT vulnerable
• OpenSSL 1.0.0 branch is NOT vulnerable
• OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

How common are the vulnerable OpenSSL versions?

The vulnerable versions have been out there for over two years now and they have been rapidly adopted by modern operating systems. A major contributing factor has been that TLS versions 1.1 and 1.2 came available with the first vulnerable OpenSSL version (1.0.1) and security community has been pushing the TLS 1.2 due to earlier attacks against TLS (such as the BEAST).

How about operating systems?

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:

• Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
• Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
• CentOS 6.5, OpenSSL 1.0.1e-15
• Fedora 18, OpenSSL 1.0.1e-4
• OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
• FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
• NetBSD 5.0.2 (OpenSSL 1.0.1e)
• OpenSUSE 12.2 (OpenSSL 1.0.1c)

Operating system distribution with versions that are not vulnerable:

• Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
• SUSE Linux Enterprise Server
• FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
• FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
• FreeBSD 10.0p1 - OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)
• FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

How can OpenSSL be fixed?

Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option -DOPENSSL_NO_HEARTBEATS.

Should heartbeat be removed to aid in detection of vulnerable services?

Recovery from this bug might have benefitted if the new version of the OpenSSL would both have fixed the bug and disabled heartbeat temporarily until some future version. Majority, if not almost all, of TLS implementations that responded to the heartbeat request at the time of discovery were vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would have continued to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible. However, swift response by the Internet community in developing online and standalone detection tools quickly surpassed the need for removing heartbeat altogether.

Can I detect if someone has exploited this against me?

Exploitation of this bug does not leave any trace of anything abnormal happening to the logs.

Can IDS/IPS detect or block this attack?

Although the heartbeat can appear in different phases of the connection setup, intrusion detection and prevention systems (IDS/IPS) rules to detect heartbeat have been developed. Due to encryption differentiating between legitimate use and attack cannot be based on the content of the request, but the attack may be detected by comparing the size of the request against the size of the reply. This implies that IDS/IPS can be programmed to detect the attack but not to block it unless heartbeat requests are blocked altogether.

Has this been abused in the wild?

We don't know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.

Can attacker access only 64k of the memory?

There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

Is this a MITM bug like Apple's goto fail bug was?

No, this does not require a man in the middle attack (MITM). Attacker can directly contact the vulnerable service or attack any user connecting to a malicious service. However in addition to direct threat the theft of the key material allows man in the middle attackers to impersonate compromised services.

Does TLS client certificate authentication mitigate this?

No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.

Does OpenSSL's FIPS mode mitigate this?

No, OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality.

Does Perfect Forward Secrecy (PFS) mitigate this?

Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please see https://twitter.com/ivanristic/status/453280081897467905 how leaked tickets may affect this.

Can heartbeat extension be disabled during the TLS handshake?

No, vulnerable heartbeat extension code is activated regardless of the results of the handshake phase negotiations. Only way to protect yourself is to upgrade to fixed version of OpenSSL or to recompile OpenSSL with the handshake removed from the code.

Who found the Heartbleed Bug?

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon's Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.

What is the Defensics SafeGuard?

The SafeGuard feature of the Codenomicon's Defensics security testtools automatically tests the target system for weaknesses that compromise the integrity, privacy or safety. The SafeGuard is systematic solution to expose failed cryptographic certificate checks, privacy leaks or authentication bypass weaknesses that have exposed the Internet users to man in the middle attacks and eavesdropping. In addition to the Heartbleed bug the new Defensics TLS Safeguard feature can detect for instance the exploitable security flaw in widely used GnuTLS open source software implementing SSL/TLS functionality and the "goto fail;" bug in Apple's TLS/SSL implementation that was patched in February 2014.

Who coordinates response to this vulnerability?

Immediately after our discovery of the bug on 3rd of April 2014, NCSC-FI took up the task of verifying it, analyzing it further and reaching out to the authors of OpenSSL, software, operating system and appliance vendors, which were potentially affected. However, this vulnerability had been found and details released independently by others before this work was completed. Vendors should be notifying their users and service providers. Internet service providers should be notifying their end users where and when potential action is required.

Is there a bright side to all this?

For those service providers who are affected this is a good opportunity to upgrade security strength of the secret keys used. A lot of software gets updates which otherwise would have not been urgent. Although this is painful for the security community, we can rest assured that infrastructure of the cyber criminals and their secrets have been exposed as well.

What can be done to prevent this from happening in future?

The security community, we included, must learn to find these inevitable human mistakes sooner. Please support the development effort of software you trust your privacy to. Donate money to the OpenSSL project.

Where to find more information?

This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement at https://www.openssl.org/news/secadv_20140407.txt. NCSC-FI published an advisory at https://www.cert.fi/en/reports/2014/vulnerability788210.html. Individual vendors of operating system distributions, affected owners of Internet services, software packages and appliance vendors may issue their own advisories.

References

• CVE-2014-0160
• NCSC-FI case# 788210
• OpenSSL Security Advisory (published 7th of April 2014, ~17:30 UTC)
• CloudFlare: Staying ahead of OpenSSL vulnerabilities (published 7th of April 2014, ~18:00 UTC)
• heartbleed.com (published 7th of April 2014, ~19:00 UTC)
• Ubuntu / Security Notice USN-2165-1
• FreeBSD / SA-14:06.openssl
• FreshPorts / openssl 1.0.1_10
• Tor Project / OpenSSL bug CVE-2014-0160
• RedHat / RHSA-2014:0376-1
• CentOS / CESA-2014:0376
• Fedora / Status on CVE-2014-0160
• CERT/CC (USA)
• NCSC-FI (Finland)
• CERT.at (Austria)
• CIRCL (Luxembourg)
• CERT-FR (France)
• JPCERT/CC (Japan)
• CERT-SE (Sweden)
• NorCERT (Norway)
• NCSC-NL (Netherlands)
• CNCERT/CC (People's Republic of China)
• Public Safety Canada
• LITNET CERT (Lithuania)
• MyCERT (Malaysia)
• UNAM-CERT (Mexico)
• SingCERT (Singapore)
• Q-CERT (Qatar)

Depicted from Heart Bleed Website

Backtracking A Keylogger #Infosec #Hacker #Hacking #Wireshark #Blackhat #WhiteHat #Keylogger #Rat

Now all keyloggers and RATs are sending data to the hacker in regular intervals (usually every 5 to 10 minutes) by using one of the two methods below:

1. Using the Emails: where hacker configures his email ID and password while creating the server. Keylogger records the key strokes in a temp file and sends it to the hacker in form of emails. But this has a limit as most free email servers like Gmail or Yahoo or Hotmail has limit of 500 composed and received mails. So most hackers use the second method.

2. FTP server: While creating the keylogger server, hackers configure their FTP server, where they receive the logs of key strokes in the form of text file(usually labeled on the

basis of current system time stamp).

Hackers keylogger server uploads the files to FTP server after every few minutes interval.

If we monitor all data packages we can easily scan for one of these and then we’ll have the hackers email info or FTP info. What can we do with this, you might ask; highly skilled hackers obviously won’t allow this as they create a completely seperate email or FTP site which leaves no traces of them, but novice skilled hackers (there’s plenty of those) will just use their own email or leaving behind information about them. An example could be that you find the name of the person from the email you backtraced – this ain’t his primary email, so there’s nothing valuable. From there you can look up his name on Google, you’ll probably find his real email on some site; then simply try to login to it using the password from the fake email (most novice skilled hackers will have the same password).

Wireshark is a very famous network scanning hack tool which is used by hackers or network forensic experts to monitor the packet flow of their network cards like Ethernet or WLAN. It records each and every packet coming and going out of your system’s Network card.

Packets is just a bunch of data. Whenever you feel anything suspicious in your system like your system is compromised or you are infected follow the steps below prior to removing the keylogger or RAT from your system.

Steps To Reverse Engineering The Email Or FTP Servers Password:

1. First of all download and install Wireshark. You can easily get this simply by Googling it.

Note: While Wireshark is getting installed, ensure that it installs the Winpcap with it otherwise it won’t work properly.

2. Now go to the “Capture”-button in the top menu of the Wireshark and select the interface (means your network card which can be Ethernet or WLAN).

3. It will now start capturing the packets through that Network card.

What you have to do is just keep capturing the records for atleast 30 minutes for getting the best results.

After 30 minutes, stop capturing the packets.

4. Now you need to filter your results, for this go to the filter box and type FTP and SMTP one by one.

Note: if you get records for FTP then hacker has used FTP server and if you didn’t get FTP that means the hacker has used SMTP, so give SMTP in Filter box.

5. As you scroll down you will find the “FTP username” and “Password”

for victims ftp account in case FTP server is used. And if hacker has used SMTP then you will find “email address” and its “password” that hacker has used to create the server.

NOTE: This won’t work in all cases, but it’s certainly worth trying. You would definitely want to know who is snooping for information a round you:sometimes it's the last person you'll ever suspect

Happy Hunting *Smiling* 

 

Turning Mozilla Firefox Into A Hacking Machine {And Secure In Some Way}!! ;D #Mozilla #Firefox #Hacking #Infosec #Hackers

Internet is an amazing virtual world where you can "virtually" do anything: gambling, playing, watching movies, shopping, working, “VoIPying”, spying on other people and for sure auditing remote systems.

The security testers’ community has a large panel of security tools, methodologies and much more to perform their pentests and audit assessments. But what happens if you find yourself weaponless.

No more Top 100 security tools, no more LiveCDs and no more exploitation  frameworks. A security auditor without toolbox is like a cop without gun.

Nevertheless, there is maybe a way to rescue yourself from this nightmare situation.

The magical solution could be Firefox and its extensions developed by hackers and coders. If you don’t want to do the work  below then there is a open source browser based security framework called mantra which comes with preconfigured with all the above extensions + many more. You can download it from H3R3 . Yeah!!

Here is a list of useful security auditing extensions:

*Information Gathering*

Whois And Geo-location

Ø ShowIP : Show the IP address of the current page in the status bar.

It also allows querying custom services by IP (right mouse button) and Hostname (left mouse button), like whois, netcraft.

ØShazou : The product called Shazou (pronounced Shazoo it is Japanese for mapping) enables the user with one-click to map and geo- locate any website they are currently viewing.

Ø HostIP.info Geolocation : Displays Geolocation information for a website using hostip.info data. Works with all versions of Firefox.

ØActive Whois : Starting Active Whois to get details about any Web site owner and its host server.

ØBibirmer Toolbar : An all-in-one extension. But auditors need to play with the toolbox. It includes (WhoIs, DNS Report, Geolocation, Traceroute, Ping). Very useful for information gathering phase.

  

*Enumeration / Fingerprinting*

Ø Header Spy : Shows HTTP headers on statusbar.

Ø Header Monitor : This is Firefox extension for display on statusbar panel any HTTP response header of top level document returned by a web server. Example: Server (by default), Content Encoding, Content- Type, X-Powered-By and others.

*Social Engineering*

ØPeople Search and Public Record : This Firefox extension is a handy menu tool for investigators, reporters, legal professionals, real estate agents, online researchers and anyone interested in doing their own basic people searches and public record lookups as well as background research.

 *Googling And Spidering*

ØAdvanced dork : Gives quick access to Google’s Advanced

 Operators directly from the context menu. This could be used to spider a site or scan for hidden files (this spider technique is used via scroogle.org)

Ø SpiderZilla : Spiderzilla is an easy- to-use website mirror utility, based on Httrack-Download from H3R3

ØView Dependencies : View Dependencies adds a tab to the "page info" window, in which it lists all the files which were loaded to show the current page. (useful for a spidering technique) Security Assessment / Code auditing

*Editors*

Ø JSView : The ’view page source’ menu item now opens files based on the behaviour you  choose in the jsview options. This allows you to open the source code of any web page in a new tab or in an external editor.

Ø Cert Viewer Plus : Adds two options to the certificate viewer in Firefox or Thunderbird: an X.509 certificate can either be displayed in PEM format (Base64/RFC 1421, opens in a new window) or saved to a file (in PEM or DER format – and PKCS#7 provided that the respective patch has been applied - cf.

Ø Firebug : Firebug integrates with Firefox to put a wealth of development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page.

Ø XML Developer Toolbar: Allows XML Developer’s use of standard tools all from your browser.

*Headers Manipulation*

Ø HeaderMonitor : This is Firefox extension for display on statusbar panel any HTTP response header of top level document returned by a web server. Example: Server (by default), Content Encoding, Content- Type, X-Powered-By and others.

Ø RefControl : Control what gets sent as the HTTP Referrer on a per- site basis.

Ø User Agent Switcher : Adds a menu and a toolbar button to switch the user agent of the browser.

*Cookies Manipulation*

Ø Add N Edit Cookies : Cookie Editor that allows you add and edit "session" and saved cookies.

ØCookieSwap : CookieSwap is an extension that enables you to maintain numerous sets or "profiles" of cookies that you can quickly swap between while browsing.

Ø httpOnly : Adds httpOnly cookie support to Firefox by encrypting cookies marked as http Only on the browser side.

Ø Allcookies : Dumps ALL cookies (including session cookies) to Firefox standard cookies.txt file.

 *Security Auditing*

Ø HackBar : This toolbar will help you in testing SQL injections, XSS holes and site security. It is NOT a tool for executing standard exploits and it will NOT teach you how to hack a site. Its main purpose is to help a developer do security audits on his code.

Ø Tamper Data : Use “tamper data” to view and modify HTTP/HTTPS headers and post parameters.

Ø Chickenfoot : Chickenfoot is a Firefox extension that puts a programming environment in the browser’s sidebar so you can write scripts to manipulate web pages and automate web browsing. In Chickenfoot, scripts are written in a superset of JavaScript that includes special functions specific to web tasks.*Misc*

 *Hacks For Fun*

Ø Greasemonkey : Allows you to customize the way a webpage displays using small bits of JavaScript (scripts could be download here)

Ø Encryption Fire Encrypter : FireEncrypter is a Firefox extension which gives you encryption/decryption and hashing functionalities right from your Firefox browser, mostly useful for developers or for education & fun.

*Malware Scanner*

Ø QArchive.org web files checker : Allowing people to check web files for any malware (viruses, trojans, worms, adware, spyware and other unwanted things) inclusions.

Ø Dr.Web anti-virus link checker :

Ø This plugin allows you to check any file you are about to download, any page you are about to visit

Ø ClamWin Antivirus Glue for Firefox : This extension scans every downloaded file automatically with ClamWin.

*Anti Spoof*

Ø refspoof : Easy to pretend to origin from a site by overriding the URL referrer (in a http request). — It incorporates this feature by using the pseudo-protocol spoof:// .. Thus it’s possible to store the information in a "hyperlink" – that can be used in any context... like html pages or bookmarks.

Thanks For Visiting