Undefeated

Saturday, 19 October 2013

Cross Site Scripting (XSS) #XSS #Infosec #Vulnerability #Pentesting #Hacking #Website #Defacing

It is a vulnerability found in websites which allows an malicious attack/cracker to inject client-side scripts into the web pages. By using this vulnerability an attaker can deface a website, redirection attacks can be done and session cookie stealing is also possible by exploiting this vulnerability.
There are two types of XSS vulnerability found in web applications.
1. Non-persistent
2. Persistent

Non-persistent
Non-persistent type of XSS vulnerability is the most common one. Non-persistent XSS happens when a malicious HTML query is done by an attacker and that query is used immediately by the server-side to generate the page result.

Persistent
Persistent type of XSS vulnerability is a dangerous kind of vulnerability. This happens when a malicious HTML query is done by the attacker and that query is immediately saved by the server and is permanently displayed on the normal pages.
In this tutorial we're going to learn how to deface a XSS vulnerable site via Non-persistent XSS vulnerability.

In order to find sites vulnerable to XSS use Google dorks. The most common Google dork used by attackers to exploit the XSS vulnerability is: inurl:search.php?q=

How to find if the website is XSS vulnerable or not. Example Website: "www.website.com/search.php?q="
Open the website, you will find a search box. in that search box type this code: <script>alert("XSS Detected !!")</script>

And click on search. If the site is vulnerable, you will get a Jquery box saying "XSS Detected", if you got that you can move forward to deface the website site. Now if you want just to display a simple message like
"H4CK3D", Enter the below HTML code and click on search. <h1><center><b>Hacked by RY44ND4V15</h1></center></b>

Computer Viruses: Definition,Types,What Happens When Executed/Run #ComputerVirus #Infosec

A potentially damaging computer program capable of reproducing itself causing great harm to files or other programs without permission or knowledge of the user.
Virus - A program that when run, has the ability to self replicate by infecting other programs and files on your computer. These programs can have many effects ranging from wiping your hard drive, displaying a joke in a small box, or doing nothing at all except to replicate itself. These types of infections tend to be localized to your computer and not have the ability to spread to another computer on their own. The word virus has incorrectly become a general term that encompasses trojans, worms, and viruses.

Types of viruses:-
The different types of viruses are as follows-
1) Boot Sector Virus: - Boot sector viruses infect either the master boot record of the hard disk or the floppy drive. The boot record program responsible for the booting of operating system is replaced by the virus.
The virus either copies the master boot program to another part of the hard disk or overwrites it. They infect a computer when it boots up or when it accesses the infected floppy disk in the floppy drive. i.e. Once a system is infected with a boot-sector virus, any non-write protected disk accessed by this system will become infected.
Examples of boot- sector viruses are Michelangelo and Stoned.

2) File or Program Viruses: - Some files/programs, when executed, load the virus in the memory and perform predefined functions to infect the system. They infect program files with extensions like .EXE, .COM, .BIN, .DRV and .SYS .
Some common file viruses are Sunday, Cascade.

3) Multipartite Viruses: - A multipartite virus is a computer virus that infects multiple different target platforms, and remains recursively infective in each target. It attempts to attack both the boot sector and the executable, or programs, files at the same time. When the virus attaches to the boot sector, it will in turn affect the system’s files, and when the virus attaches to the files, it will in turn infect the boot sector.
This type of virus can re-infect a system over and over again if all parts of the virus are not eradicated. Ghostball was the first multipartite virus, discovered by Fridrik Skulason in October 1989. Other examples are Invader, Flip, etc.

4) Stealth Viruses: - These viruses are stealthy in nature means it uses various methods for hiding themselves to avoid detection. They sometimes remove themselves from the memory temporarily to avoid detection by antivirus. They are somewhat difficult to detect. When an antivirus program tries to detect the virus, the stealth virus feeds the antivirus program a clean image of the file or boot sector.

5) Polymorphic Viruses: - Polymorphic viruses have the ability to mutate implying that they change the viral code known as the signature each time they spread or infect. Thus an antivirus program which is scanning for specific virus codes unable to detect it's presence.

6) Macro Viruses: - A macro virus is a computer virus that "infects" a Microsoft Word or similar application and causes a sequence of actions to be performed automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless.A macro virus is often spread as an e-mail virus. Well-known examples are Concept Virus and Melissa Worm

-----------------Click Here To Read About Computer Malware-----------------

Computer Malware: Definition,Generic Malware Terms #Malware #Infosec

If you use a computer, read articles from blogs, you will know about computer viruses or other malware. These are those malicious programs that once they infect your machine will start causing havoc on your computer. What many people do not know is that there are many different types of infections that are categorized in the general category of Malware.
Malware - Malware is programming or files that are developed for the purpose of doing harm. Thus, malware includes computer viruses, worms, Trojan horses, spyware, hijackers, and certain type of adware.
This article will focus on those malware that are considered viruses, trojans, worms, and viruses, though this information can be used to remove the other types of malware as well. We will not go into specific details about any one particular infection, but rather provide a
broad overview.

It is important to understand the generic malware terms that may assist you identify the kind of malware you're dealing with/infected with

Backdoor- A program that allows a remote user to execute commands and tasks on your computer without your permission. These types of programs are typically used to launch attacks on other computers, distribute copyrighted software or media, or hack other computers.

Hijackers- A program that attempts to hijack certain Internet functions like redirecting your start page to the hijacker's own start page, redirecting search queries to a undesired search engine, or replace search results from popular search engines with their own information.

Spyware- A program that monitors your activity or information on your computer and sends that information to a remote computer without your Knowledge.

Adware- A program that generates popups on your computer or displays advertisements. It is important to note that not all adware programs are necessarily considered malware.
There are many legitimate programs that are given for free that display ads in their programs in order to generate revenue. As long as this information is provided up front then they are generally not considered malware.

Dialler - A program that typically dials a premium rate number that has per minute charges over and above the typical call charge. These calls are with the intent of gaining access to pornographic material.

Trojan- A program that has been designed to appear innocent but has been intentionally designed to cause some malicious activity or to provide a backdoor to your system.

Worm- A program that when run, has the ability to spread to other computers on its own using either massmailing techniques to email addresses found on your computer or by using the Internet to infect a remote computer using known security holes.

---------------------Click Here to Read About Computer Viruses-------------------

DNS Hijacking: Definition And How It's Executed #DNSHijacking #Hijacking #Infosec

DNS hijacking (sometimes referred to as DNS redirection) is a type of malicious attack that overrides a computer’s TCP/IP settings to point it at a rogue DNS server, thereby invalidating the default DNS settings. In other words, when an attacker takes control of a computer to alter its DNS settings, so that it now points to a rogue DNS server, the process is referred to as DNS hijacking.

As we all know, the “Domain Name System (DNS)” is mainly responsible for translating a user friendly domain name such as “google.com” to its corresponding IP address “74.125.235.46″. Having a clear idea of DNS and its working can help you better understand what DNS hijacking is all about. If you are fairly new to the concept of DNS, I would recommend reading my previous post on How Domain Name System Works.

How DNS Hijacking Works?

DNS is the one that is responsible for mapping the user friendly domain names to their corresponding IP addresses. This DNS server is owned and maintained by your Internet service provider (ISP) and many other private business organizations. By default, your computer is configured to use the DNS server from the ISP. In some cases, your computer may even be using the DNS services of other reputed organizations such as Google. In this case, you are said to be safe and everything seems to work normally.

But, imagine a situation where a hacker or a malware program gains unauthorized access to your computer and changes the DNS settings, so that your computer now uses one of the rogue DNS servers that is owned and maintained by the hacker. When this happens, the rogue DNS server may translate domain names of desirable websites (such as banks, search engines, social networking sites etc.) to IP addresses of malicious websites. As a result, when you type the URL of a website in the address bar, you may be taken to a fake website instead of the one you are intending for. Sometimes, this can put you in deep trouble!

What are the Dangers of DNS Hijacking?

The dangers of DNS hijacking can vary and depend on the intention behind the attack. Many ISPs such as “OpenDNS” and “Comcast” use DNS hijacking for introducing advertisements or collecting statistics. Even though this can cause no serious damage to the users, it is considered as a violation of RFC standards for DNS responses.

Other dangers of DNS hijacking include the following attacks:

Pharming: This is a kind of attack where a website’s traffic is redirected to another website that is a fake one. For example, when a user tries to visit a social networking website such as Facebook.com he may be redirected to another website that is filled with pop-ups and advertisements. This is often done by hackers in order to generate advertising revenue.

Phishing: This is a kind of attack where users are redirected to a malicious website whose design (look and feel) matches exactly with that of the original one. For example, when a user tries to log in to his bank account, he may be redirected to a malicious website that steals his login details.

How to Prevent DNS Hijacking?

In most cases, attackers make use of malware programs such as a trojan horse to carry out DNS hijacking. These DNS hijacking trojans are often distributed as video and audio codecs, video downloaders, YouTube downloaders or as other free utilities. So, in order to stay protected, it is recommended to stay away from untrusted websites that offer free downloads. The DNSChanger trojan is an example of one such malware that hijacked the DNS settings of over 4 million computers to drive a profit of about 14 million USD through fraudulent advertising revenue.

Also, it is necessary to change the default password of your router, so that it would not be possible for the attacker to modify your router settings using the default password that came with the factory setting. For more details on this topic you can read my other post on How to Hack an Ethernet ADSL Router.

Installing a good antivirus program and keeping it up-to-date can offer a great deal of protection to your computer against any such attacks.

What if you are already a victim of DNS hijacking?

If you suspect that your computer is infected with a malware program such as DNSChanger, you need not panic. It is fairly simple and easy to recover from the damage caused by such programs. All you have to do is, just verify your current DNS settings to make sure that you are not using any of those DNS IPs that are blacklisted. Otherwise re-configure your DNS settings as per the guidelines of your ISP.

Friday, 18 October 2013

What Is Doxing:How Is It Done- #Doxing #Anonymity #Infosec #Internet

In the modern world, Internet has become a wonderful place to gain knowledge, exchange ideas, share information, make new friends and whatnot. Even though, you can do all of this by remaining anonymous behind your monitor, your real life identity and personal details can still be at the risk of falling into the hands of strangers. This is where the term “doxing” comes into play!

What is Doxing?

Doxing simply refers to the process of gathering or deducing other people’s information such as name, age, email, address, telephone number, photographs etc. using publicly available sources such as the Internet. In other words, doxing is the act of using the Internet to search for personal details about a person.

Doxing is done by initially taking a piece of information (such as “name” or “email address”) and keeping it as a base to find out other possible details about the person. The term “doxing” is derived from the word “document tracing” which means to retrieve documents about a particular person or company in order to learn more about them.

Doxing Techniques:

Today, Internet has grown to such a size that it contains almost any information that you’ve ever imagined! All you’ve to do is use the right techniques to search for what you want. Here is a list of doxing techniques that are most commonly used by Internet geeks and ethical hackers:

Using Google:

Google is undoubtedly a powerful tool that plays a key role in doxing. Since Google indexes almost anything on the Internet (sometimes even the private information), it is possible to dox for details such as email ID, address, phone numbers and photographs of a person or company. Once you obtain the search results for your query, carefully examine the description part which in most cases contain the piece of information that you are looking for.

Social Networking Websites:

As most Internet users are found to be active on social media, social networking sites such as Facebook and LinkedIn provide a virtual goldmine of information necessary to perform doxing. As most users are unaware of online security issues, they have weak privacy settings on their profile. This makes it easy for the attackers to gain access to personal information such as photographs, real names, location, job, partner’s name etc.

Reverse Cell Phone LookUp:

A “Reverse Cell Phone Lookup” is simply a process of finding someone’s personal details such as name, age, address and related information by using their cell phone number and vice versa. There are many online services out there such as cell phone registry that provide access to the personal details about a given person based on his/her phone, name and email ID.

Whois Searches:

If a person or company has a website (or domain name) associated with them, you can easily perform a “whois search” for their website to obtain personal details such as full name, address, email and phone number. Just visit whois.domaintools.com and enter the domain name for which you want to perform a whois search. It will show up all the details associated with the domain name.

Why Would Anyone Want to Perform Doxing?

Most people perform doxing out of general curiosity about a person or company. However, there are some wicked minds out there who do this for the purpose of blackmailing or taking revenge by exposing the information that they have gathered about the person.

What are the Consequences of Doxing?

It can be slightly irritating and embarrassing when private data fall in the hands of people who are not intended to have access to such information. However, things can go even worse if the doxed information such as a person’s social activities, medical history, sexual preference and other vital bits of information is made public. This can have a serious threat to health, livelihood or relationship of the victim.

Steps to Protect Yourself from Doxing:

The following are some of the most commonly targeted pieces of information that can be easily obtained through doxing:

Full name
Age, gender and date of birth
Location and place of birth
Email addresses and username
Phone number
Social networking profiles, websites and blogs

So, it is always a good practice to keep the above bits of information hidden. Even though it is not possible to do this in all cases, you can still take care to protect as much information as you can from going public.

You can consider the following additional tips for further protection:

Do not upload personal photographs on web albums such as “Picasa”. Even if you do, make sure that your album is hidden from public and search engines.
If you do not intend to show up your profile on search engines, it is a wise choice to make all the Internet profiles private.
Maximize the privacy settings of your social network profiles. Make sure that your individual albums and photographs have their privacy settings configured.
Do not use the same email address for all you accounts. Instead, create separate email IDs for individual activities such as gaming, forum participation, banking accounts etc.

Is Doxing a Crime?

Doxing is definitely not a crime when used within the ethical standards and no harm is being caused to anyone. However, if doxing is done to cause intentional damage such as harassment, blackmailing or taking revenge it might well be considered an offence.

Mozilla Firefox Add-ons A Hacker Must Have And Use #Hacker #Infosec #Browser

Firefox's one of the most secure browser in the world,like other browsers Mozilla Firefox has add-ons. This article brings the best and the most effective hacking add-ons ever on Firefox. In short this article's listing the most popular and interesting firefox add-ons that are useful for hackers and also security experts.The list vary from information gathering firefox add-ons to attacking tools/add-ons.

brings you the best and most effective Hacking add-ons ever on Firefox. In short, we are listing a most popular and interesting Firefox add-ons that are useful for Hackers. This list of 11 add-ons vary from information gathering tools to attacking tools. All these add-ons are available for free and you can download from the Mozilla add-on website. So friends lets see what Darkhtu has bring this time for you. I will list them in way from top( I like most) to bottom pattern but note that all of them are extremely good tools. - See more at: http://www.darkhtu.net/2013/10/11-firefox-addons-hacker-must-have-and.html#sthash.DmID8xii.dpuf

All the add-on listed on this article are available and free on the Mozilla add-on website.

1. Tamper Data

Tamper data is an great tool to to view and modify HTTP/HTTPS headers and post parameters. We can alter each request going from our machine to destination host with this. Thus it helps in security testing web application by modifying POST parameters. It can be used in performing XSS and SQL Injection attacks by modifying header data. Add Tamper data to Firefox: https://addons.mozilla.org/en-us/firefox/addon/tamper-data/

2. Firebug

Firebug is a nice add-on that integrates a web development tool inside the browser. With this tool, you can edit and debug HTML, CSS and JavaScript live in any webpage to see the effect of changes. It helps in analyzing JS files to find XSS vulnerabilities. It’s an really helpful add-on in finding DOM based XSS for security testing professionals. Add firebug to your browser : https://addons.mozilla.org/en-US/firefox/addon/firebug/

3. Hackbar

Hackbar is a simple penetration tool for Firefox. It helps in testing simple SQL injection and XSS holes. You cannot execute standard exploits but you can easily use it to test whether vulnerability exists or not. You can also manually submit form data with GET or POST requests. It also has encryption and encoding tools. Most of the times, this tool helps in testing XSS vulnerability with encoded XSS payloads. It also supports keyboard shortcuts to perform various tasks.I am sure, most of the persons in the security field already know about this tool. This tool is mostly used in finding POST XSS vulnerabilities because it can send POST data manually to any page you like. With the ability of manually sending POST form data, you can easily bypass client side validations of the page. If your payload is being encoded at client side, you can use an encoding tool to encode your payload and then perform the attack. If the application is vulnerable to the XSS, I am sure you will find the vulnerability with the help of the Hackbar add-on on Firefox browser. Add Hackbar to Firefox: https://addons.mozilla.org/en-US/firefox/addon/hackbar/

4. Cookies Manager +
Cookie Manager is one of the greatest tool ever made. Using this tool you can actually play with cookies. You can alter almost all cookie using this tool. You can use Cookies manager to view, edit and create new cookies. It also shows extra information about cookies, allows edit multiple cookies at once and backup/restore them. Add Cookies Manager to Firefox: https://addons.mozilla.org/en-US/firefox/addon/cookies-manager-plus/

5. NoScript

No Script add-ons greatness is beyond imagination. With this tool you can monitor each an every script running on website, you can block any of scripts and see what actually that scripts does on website. But this add-on is for experts, newbies will face problems using this. Note: If you are testing XSS, HTTPS header modifications, Injection attacks on any website you need to disable this plugin because it will not allow you to do so. Add NoScript to Firefox: https://addons.mozilla.org/en-us/firefox/addon/noscript/

6. Grease Monkey

Grease Monkey is an counter part of No Script, its actually behaves opposite of Noscript. We use Noscript to block the scripts and use GreaseMonkey to run the scripts. It allows you to customize the way a web page displays or behaves, by using small bits of JavaScript. Add Grease Monkey to Firefox : https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/

7. User Agent Switcher

User Agent Switcher add-on; adds a one click user agent switch to the browser. It adds a menu and tool bar button in the browser. Whenever you want to switch the user agent, use the browser button. User Agent add on helps in spoofing the browser while performing some attack. Add user agent Switcher to Firefox: https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/

8. CryptoFox

CryptoFox is an encryption or decryption tool for Mozilla Firefox. It supports most of the available encryption algorithm. So, you can easily encrypt or decrypt data with supported encryption algorithm. This add-on comes with dictionary attack support, to crack MD5 cracking passwords. Although, it hasn’t have good reviews, it works satisfactorily. Add CryptoFox to Firefox: https://addons.mozilla.org/en-US/firefox/addon/cryptofox/

9. SQL Inject Me

SQL Inject Me is another nice Firefox add-on used to find SQL injection vulnerabilities in web applications. This tool does not exploit the vulnerability but display that it exists. SQL injection is one of the most harmful web application vulnerabilities, it can allow attackers to view, modify, edit, add or delete records in a database.The tool sends escape strings through form fields, and tries to search database error messages. If it finds a database error message, it marks the page as vulnerable. Hackers can use this tool for SQL injection testing. Add SQL Inject Me to Firefox: https://addons.mozilla.org/en-us/firefox/addon/sql-inject-me/

10. XSS ME

Cross Site Scripting is the most found web application vulnerability. For detecting XSS vulnerabilities in web applications, this add-on can be a useful tool. XSS-Me is used to find reflected XSS vulnerabilities from a browser. It scans all forms of the page, and then performs an attack on the selected pages with pre-defined XSS payloads. After the scan is complete, it lists all the pages that renders a payload on the page, and may be vulnerable to XSS attack. Now, you can manually test the web page to find whether the vulnerability exists or not. Add XSS ME to Firefox: https://addons.mozilla.org/en-us/firefox/addon/xss-me/

11. Passive Recon

Last but not the least. Passive recon is a good information gathering tool.
PassiveRecon provides information security professionals with the ability to perform "packetless" discovery of target resources utilizing publicly available information. It gathers information like DnsStuff tool available on backtrack. Add Passive Recon to Firefox: https://addons.mozilla.org/en-US/firefox/addon/passiverecon/

---------------------------- Source Of The Article -------------------------------

Tuesday, 15 October 2013

Penetration Testing Tools #Infosec #Websecurity #Forensic #Penetration

Here is a compilation of multiple forensic and penetration testing tools for applications, networks, and websites.

Nmap is a very versatile tool developed to scan addresses (IPV6 included), this tool allows the users to gather a mass amount of information about the target quickly, information including open ports, + much, much more. Nmap supports a large number of scanning techniques such as: UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce attack), ICMP (ping sweep), FIN, ACK sweep, Xmas Tree, SYN sweep, IP Protocol, and Null scan.
—————————————————————————————————————————————-

[Image: IXcgJ.png]

A very powerful network troubleshooting and analysis tool, WireShark provides the ability to view data from a live network, and supports hundreds of protocols and media formats.
—————————————————————————————————————————————-
[Image: logooxid.png]

Cain and Abel is a revolutionary tool that provides many functions that are able to do various password retrieval jobs, cracking passwords, sniffing networks, and routing/analyzing protocols. This tool is Windows-only, unlike many other tools that exist, this is a pleasant twist to modern penetration testing and forensic tools.
—————————————————————————————————————————————
[Image: logo.png]

MetaSploit, a very powerful network security and analysis tool, used often for penetration attacks, this tool has a clean interface and easily gathers the information that you seek.
[Image: HkR4k.png]

—————————————————————————————————————————————
Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis. (Taken from their website)
———————————————————————————————————————————-

The Nessus tool provides high-speed data discovery, asset profiling, configuration auditing, and vulnerability analysis of networks.
—————————————————————————————————————————————

[Image: 7diZx.png]

Havij is the most common and heard of testing tool for SQLI injection and many other web-based injection types. It fluently provides the site’s scan, admin look-up, password cracking, and database retrieval. It literally makes it a breeze to hack, and find, vulnerable websites
—————————————————————————————————————————————

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. (Taken from http://portswigger.net/burp/)
—————————————————————————————————————————————-
[Image: L4fYp.png]

Acunetix is a strong, and very popular website security tool. It provides many tools to test your website, (or others) for various injections. Acunetix WVS automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.
—————————————————————————————————————————————-

Back Track is a widely popular bootable Live-CD of a Linux Distro. Back Track offers a vast variety of penetration testing tools, along with those for network attacks, and supports many other forms of testing/attacking, for VOIP networks, Websites + more. The tool’s interface and design provides an easy to use layout.

Credit goes to: TEAM IHA